Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10bin/antvms.dll
windows7-x64
1bin/antvms.dll
windows10-2004-x64
1bin/debug/AnyDesk.exe
windows7-x64
5bin/debug/AnyDesk.exe
windows10-2004-x64
5bin/debug/...in.exe
windows7-x64
10bin/debug/...in.exe
windows10-2004-x64
10bin/releas...se.exe
windows7-x64
10bin/releas...se.exe
windows10-2004-x64
10bin/traffi...or.dll
windows7-x64
1bin/traffi...or.dll
windows10-2004-x64
1bin/xfcmain.dll
windows7-x64
1bin/xfcmain.dll
windows10-2004-x64
1bin/xfcstart.dll
windows7-x64
1bin/xfcstart.dll
windows10-2004-x64
1debugger.exe
windows7-x64
10debugger.exe
windows10-2004-x64
10execution.dll
windows7-x64
1execution.dll
windows10-2004-x64
1injectprint.dll
windows10-2004-x64
3lz4.dll
windows7-x64
1lz4.dll
windows10-2004-x64
1offsets.dll
windows7-x64
1offsets.dll
windows10-2004-x64
1topware.inject.js
windows7-x64
3topware.inject.js
windows10-2004-x64
3topware.py
windows7-x64
3topware.py
windows10-2004-x64
3xxhash.dll
windows7-x64
1xxhash.dll
windows10-2004-x64
1zinl1.dll
windows7-x64
1zinl1.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
1Analysis
-
max time kernel
31s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 03:20
Behavioral task
behavioral1
Sample
bin/antvms.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bin/antvms.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
bin/debug/AnyDesk.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
bin/debug/AnyDesk.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
bin/debug/debug.main.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
bin/debug/debug.main.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
bin/release/release.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
bin/release/release.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
bin/trafficencryptor.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
bin/trafficencryptor.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
bin/xfcmain.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
bin/xfcmain.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
bin/xfcstart.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
bin/xfcstart.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
debugger.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
debugger.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
execution.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
execution.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
injectprint.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
lz4.dll
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
lz4.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral22
Sample
offsets.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
offsets.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
topware.inject.js
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
topware.inject.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
topware.py
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
topware.py
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
xxhash.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
xxhash.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral30
Sample
zinl1.dll
Resource
win7-20240704-en
Behavioral task
behavioral31
Sample
zinl1.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
zlib1.dll
Resource
win7-20240705-en
General
-
Target
bin/release/release.exe
-
Size
64KB
-
MD5
36969de6b4bf8de24684de1bb71f624f
-
SHA1
0327d7d9d7f739e4b09bab680249ed997a281c9b
-
SHA256
57035572212814c4666994f1a0d2b6955b0951a8f1e9e1686dead895de5f64cf
-
SHA512
cd8eae1b19c8ae9a2d22b999e85e86625a1e74630e6f3155ff63965b8f116e62f79dcc23b88c92f51fa42ee26f7bd87cad22a21f32f16306890576e309dfe548
-
SSDEEP
1536:TTodvW06WoBsscJSbigiYUVkaNW6PmqCO26erLq:UenWissBbigHmkaRmHO26erLq
Malware Config
Extracted
xworm
79.110.49.233:4444
-
Install_directory
%AppData%
-
install_file
VSREDIST.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral7/memory/2152-1-0x00000000008F0000-0x0000000000906000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2860 powershell.exe 1240 powershell.exe 2120 powershell.exe 2748 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VSREDIST.lnk release.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VSREDIST.lnk release.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\VSREDIST = "C:\\Users\\Admin\\AppData\\Roaming\\VSREDIST.exe" release.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1240 powershell.exe 2120 powershell.exe 2748 powershell.exe 2860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2152 release.exe Token: SeDebugPrivilege 1240 powershell.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2152 release.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1240 2152 release.exe 30 PID 2152 wrote to memory of 1240 2152 release.exe 30 PID 2152 wrote to memory of 1240 2152 release.exe 30 PID 2152 wrote to memory of 2120 2152 release.exe 32 PID 2152 wrote to memory of 2120 2152 release.exe 32 PID 2152 wrote to memory of 2120 2152 release.exe 32 PID 2152 wrote to memory of 2748 2152 release.exe 34 PID 2152 wrote to memory of 2748 2152 release.exe 34 PID 2152 wrote to memory of 2748 2152 release.exe 34 PID 2152 wrote to memory of 2860 2152 release.exe 36 PID 2152 wrote to memory of 2860 2152 release.exe 36 PID 2152 wrote to memory of 2860 2152 release.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\release\release.exe"C:\Users\Admin\AppData\Local\Temp\bin\release\release.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bin\release\release.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'release.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\VSREDIST.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VSREDIST.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD54bb8e6a9041a5a35707b32195c935003
SHA155fb4bee4193015810010a3e7e4693b86262c10b
SHA256743a5ee714e67b479384e90a84e797f398e7c3c0047661e71f54fea3b17e801e
SHA512aa47bdc47ff38afca940e633b3d15286a78753f5d18bb928c48622eb31482d880a1f9c53ef1b1091b0a53a751e9632ddcc63b842e1475b703884be6ceafd9fbe