Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10bin/antvms.dll
windows7-x64
1bin/antvms.dll
windows10-2004-x64
1bin/debug/AnyDesk.exe
windows7-x64
5bin/debug/AnyDesk.exe
windows10-2004-x64
5bin/debug/...in.exe
windows7-x64
10bin/debug/...in.exe
windows10-2004-x64
10bin/releas...se.exe
windows7-x64
10bin/releas...se.exe
windows10-2004-x64
10bin/traffi...or.dll
windows7-x64
1bin/traffi...or.dll
windows10-2004-x64
1bin/xfcmain.dll
windows7-x64
1bin/xfcmain.dll
windows10-2004-x64
1bin/xfcstart.dll
windows7-x64
1bin/xfcstart.dll
windows10-2004-x64
1debugger.exe
windows7-x64
10debugger.exe
windows10-2004-x64
10execution.dll
windows7-x64
1execution.dll
windows10-2004-x64
1injectprint.dll
windows10-2004-x64
3lz4.dll
windows7-x64
1lz4.dll
windows10-2004-x64
1offsets.dll
windows7-x64
1offsets.dll
windows10-2004-x64
1topware.inject.js
windows7-x64
3topware.inject.js
windows10-2004-x64
3topware.py
windows7-x64
3topware.py
windows10-2004-x64
3xxhash.dll
windows7-x64
1xxhash.dll
windows10-2004-x64
1zinl1.dll
windows7-x64
1zinl1.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
1Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 03:20
Behavioral task
behavioral1
Sample
bin/antvms.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bin/antvms.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
bin/debug/AnyDesk.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
bin/debug/AnyDesk.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
bin/debug/debug.main.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
bin/debug/debug.main.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
bin/release/release.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
bin/release/release.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
bin/trafficencryptor.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
bin/trafficencryptor.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
bin/xfcmain.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
bin/xfcmain.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
bin/xfcstart.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
bin/xfcstart.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
debugger.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
debugger.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
execution.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
execution.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
injectprint.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
lz4.dll
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
lz4.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral22
Sample
offsets.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
offsets.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
topware.inject.js
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
topware.inject.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
topware.py
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
topware.py
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
xxhash.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
xxhash.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral30
Sample
zinl1.dll
Resource
win7-20240704-en
Behavioral task
behavioral31
Sample
zinl1.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
zlib1.dll
Resource
win7-20240705-en
General
-
Target
injectprint.dll
-
Size
3.9MB
-
MD5
3b4647bcb9feb591c2c05d1a606ed988
-
SHA1
b42c59f96fb069fd49009dfd94550a7764e6c97c
-
SHA256
35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
-
SHA512
00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50
-
SSDEEP
49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1448 3948 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4584 wrote to memory of 3948 4584 rundll32.exe 81 PID 4584 wrote to memory of 3948 4584 rundll32.exe 81 PID 4584 wrote to memory of 3948 4584 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\injectprint.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\injectprint.dll,#12⤵PID:3948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 6123⤵
- Program crash
PID:1448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3948 -ip 39481⤵PID:3928