Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10bin/antvms.dll
windows7-x64
1bin/antvms.dll
windows10-2004-x64
1bin/debug/AnyDesk.exe
windows7-x64
5bin/debug/AnyDesk.exe
windows10-2004-x64
5bin/debug/...in.exe
windows7-x64
10bin/debug/...in.exe
windows10-2004-x64
10bin/releas...se.exe
windows7-x64
10bin/releas...se.exe
windows10-2004-x64
10bin/traffi...or.dll
windows7-x64
1bin/traffi...or.dll
windows10-2004-x64
1bin/xfcmain.dll
windows7-x64
1bin/xfcmain.dll
windows10-2004-x64
1bin/xfcstart.dll
windows7-x64
1bin/xfcstart.dll
windows10-2004-x64
1debugger.exe
windows7-x64
10debugger.exe
windows10-2004-x64
10execution.dll
windows7-x64
1execution.dll
windows10-2004-x64
1injectprint.dll
windows10-2004-x64
3lz4.dll
windows7-x64
1lz4.dll
windows10-2004-x64
1offsets.dll
windows7-x64
1offsets.dll
windows10-2004-x64
1topware.inject.js
windows7-x64
3topware.inject.js
windows10-2004-x64
3topware.py
windows7-x64
3topware.py
windows10-2004-x64
3xxhash.dll
windows7-x64
1xxhash.dll
windows10-2004-x64
1zinl1.dll
windows7-x64
1zinl1.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
1Analysis
-
max time kernel
124s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 03:20
Behavioral task
behavioral1
Sample
bin/antvms.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bin/antvms.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
bin/debug/AnyDesk.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
bin/debug/AnyDesk.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
bin/debug/debug.main.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
bin/debug/debug.main.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
bin/release/release.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
bin/release/release.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
bin/trafficencryptor.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
bin/trafficencryptor.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
bin/xfcmain.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
bin/xfcmain.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
bin/xfcstart.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
bin/xfcstart.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
debugger.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
debugger.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
execution.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
execution.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
injectprint.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
lz4.dll
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
lz4.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral22
Sample
offsets.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
offsets.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
topware.inject.js
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
topware.inject.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
topware.py
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
topware.py
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
xxhash.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
xxhash.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral30
Sample
zinl1.dll
Resource
win7-20240704-en
Behavioral task
behavioral31
Sample
zinl1.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
zlib1.dll
Resource
win7-20240705-en
General
-
Target
bin/debug/debug.main.exe
-
Size
64KB
-
MD5
36969de6b4bf8de24684de1bb71f624f
-
SHA1
0327d7d9d7f739e4b09bab680249ed997a281c9b
-
SHA256
57035572212814c4666994f1a0d2b6955b0951a8f1e9e1686dead895de5f64cf
-
SHA512
cd8eae1b19c8ae9a2d22b999e85e86625a1e74630e6f3155ff63965b8f116e62f79dcc23b88c92f51fa42ee26f7bd87cad22a21f32f16306890576e309dfe548
-
SSDEEP
1536:TTodvW06WoBsscJSbigiYUVkaNW6PmqCO26erLq:UenWissBbigHmkaRmHO26erLq
Malware Config
Extracted
xworm
79.110.49.233:4444
-
Install_directory
%AppData%
-
install_file
VSREDIST.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral6/memory/1692-1-0x0000000000930000-0x0000000000946000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 620 powershell.exe 3880 powershell.exe 5088 powershell.exe 1600 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation debug.main.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VSREDIST.lnk debug.main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VSREDIST.lnk debug.main.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VSREDIST = "C:\\Users\\Admin\\AppData\\Roaming\\VSREDIST.exe" debug.main.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5088 powershell.exe 5088 powershell.exe 5088 powershell.exe 1600 powershell.exe 1600 powershell.exe 1600 powershell.exe 620 powershell.exe 620 powershell.exe 620 powershell.exe 3880 powershell.exe 3880 powershell.exe 3880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1692 debug.main.exe Token: SeDebugPrivilege 5088 powershell.exe Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 620 powershell.exe Token: SeDebugPrivilege 3880 powershell.exe Token: SeDebugPrivilege 1692 debug.main.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1692 wrote to memory of 5088 1692 debug.main.exe 93 PID 1692 wrote to memory of 5088 1692 debug.main.exe 93 PID 1692 wrote to memory of 1600 1692 debug.main.exe 95 PID 1692 wrote to memory of 1600 1692 debug.main.exe 95 PID 1692 wrote to memory of 620 1692 debug.main.exe 97 PID 1692 wrote to memory of 620 1692 debug.main.exe 97 PID 1692 wrote to memory of 3880 1692 debug.main.exe 99 PID 1692 wrote to memory of 3880 1692 debug.main.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\debug\debug.main.exe"C:\Users\Admin\AppData\Local\Temp\bin\debug\debug.main.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bin\debug\debug.main.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'debug.main.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\VSREDIST.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VSREDIST.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3896,i,5028538196072658126,13960315633709835247,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:81⤵PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5a9293ef980c925abe33d940554ed8575
SHA19b6d85f2595f7fd4923f52b21ab7607279066969
SHA2568313a191aa9d11cce868d95ac9a9b1609275bfe93131fcb6e547b985b0242fbe
SHA5122003d90bb2bc89378ccaeb9c5edf76b2dfd93c80369d063e56141abb8d7fea6acee6a103874ab227bc1548437269c8e4ee5174bf482ecf3d66c38f3e0ba35d85
-
Filesize
944B
MD507a771c4f31f62b2d04e2befaa36dce7
SHA1662952ede6c1acbb575e8149a5ac2f08edade811
SHA256a2df2570980e1123d9af8e12a27a82d3a4d332f0e7dd44e4e225743207c099b3
SHA5129e339a2d0bfaf5bbe5252f69061652c5880fe1233930830ca7190a65516366e05129907b1656a6790c0093ad82ac73ddee6738d0b78ecb1e3d888f467b889fe9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82