Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10bin/antvms.dll
windows7-x64
1bin/antvms.dll
windows10-2004-x64
1bin/debug/AnyDesk.exe
windows7-x64
5bin/debug/AnyDesk.exe
windows10-2004-x64
5bin/debug/...in.exe
windows7-x64
10bin/debug/...in.exe
windows10-2004-x64
10bin/releas...se.exe
windows7-x64
10bin/releas...se.exe
windows10-2004-x64
10bin/traffi...or.dll
windows7-x64
1bin/traffi...or.dll
windows10-2004-x64
1bin/xfcmain.dll
windows7-x64
1bin/xfcmain.dll
windows10-2004-x64
1bin/xfcstart.dll
windows7-x64
1bin/xfcstart.dll
windows10-2004-x64
1debugger.exe
windows7-x64
10debugger.exe
windows10-2004-x64
10execution.dll
windows7-x64
1execution.dll
windows10-2004-x64
1injectprint.dll
windows10-2004-x64
3lz4.dll
windows7-x64
1lz4.dll
windows10-2004-x64
1offsets.dll
windows7-x64
1offsets.dll
windows10-2004-x64
1topware.inject.js
windows7-x64
3topware.inject.js
windows10-2004-x64
3topware.py
windows7-x64
3topware.py
windows10-2004-x64
3xxhash.dll
windows7-x64
1xxhash.dll
windows10-2004-x64
1zinl1.dll
windows7-x64
1zinl1.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
1Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 03:20
Behavioral task
behavioral1
Sample
bin/antvms.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bin/antvms.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
bin/debug/AnyDesk.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
bin/debug/AnyDesk.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
bin/debug/debug.main.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
bin/debug/debug.main.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
bin/release/release.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
bin/release/release.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
bin/trafficencryptor.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
bin/trafficencryptor.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
bin/xfcmain.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
bin/xfcmain.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
bin/xfcstart.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
bin/xfcstart.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
debugger.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
debugger.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
execution.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
execution.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
injectprint.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
lz4.dll
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
lz4.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral22
Sample
offsets.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
offsets.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
topware.inject.js
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
topware.inject.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
topware.py
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
topware.py
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
xxhash.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
xxhash.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral30
Sample
zinl1.dll
Resource
win7-20240704-en
Behavioral task
behavioral31
Sample
zinl1.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
zlib1.dll
Resource
win7-20240705-en
General
-
Target
debugger.exe
-
Size
64KB
-
MD5
36969de6b4bf8de24684de1bb71f624f
-
SHA1
0327d7d9d7f739e4b09bab680249ed997a281c9b
-
SHA256
57035572212814c4666994f1a0d2b6955b0951a8f1e9e1686dead895de5f64cf
-
SHA512
cd8eae1b19c8ae9a2d22b999e85e86625a1e74630e6f3155ff63965b8f116e62f79dcc23b88c92f51fa42ee26f7bd87cad22a21f32f16306890576e309dfe548
-
SSDEEP
1536:TTodvW06WoBsscJSbigiYUVkaNW6PmqCO26erLq:UenWissBbigHmkaRmHO26erLq
Malware Config
Extracted
xworm
79.110.49.233:4444
-
Install_directory
%AppData%
-
install_file
VSREDIST.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral16/memory/4880-1-0x0000000000F40000-0x0000000000F56000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 832 powershell.exe 4368 powershell.exe 2160 powershell.exe 1008 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation debugger.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VSREDIST.lnk debugger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VSREDIST.lnk debugger.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VSREDIST = "C:\\Users\\Admin\\AppData\\Roaming\\VSREDIST.exe" debugger.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4368 powershell.exe 4368 powershell.exe 2160 powershell.exe 2160 powershell.exe 1008 powershell.exe 1008 powershell.exe 832 powershell.exe 832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4880 debugger.exe Token: SeDebugPrivilege 4368 powershell.exe Token: SeDebugPrivilege 2160 powershell.exe Token: SeDebugPrivilege 1008 powershell.exe Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 4880 debugger.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4880 wrote to memory of 4368 4880 debugger.exe 85 PID 4880 wrote to memory of 4368 4880 debugger.exe 85 PID 4880 wrote to memory of 2160 4880 debugger.exe 87 PID 4880 wrote to memory of 2160 4880 debugger.exe 87 PID 4880 wrote to memory of 1008 4880 debugger.exe 89 PID 4880 wrote to memory of 1008 4880 debugger.exe 89 PID 4880 wrote to memory of 832 4880 debugger.exe 91 PID 4880 wrote to memory of 832 4880 debugger.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\debugger.exe"C:\Users\Admin\AppData\Local\Temp\debugger.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\debugger.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'debugger.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\VSREDIST.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VSREDIST.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5eb1ad317bd25b55b2bbdce8a28a74a94
SHA198a3978be4d10d62e7411946474579ee5bdc5ea6
SHA2569e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
-
Filesize
944B
MD515dde0683cd1ca19785d7262f554ba93
SHA1d039c577e438546d10ac64837b05da480d06bf69
SHA256d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA51257c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82