Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Usar tu ma... 4.rar
windows10-2004-x64
3Carpetas d...os.txt
windows10-2004-x64
1Carpetas d...on.zip
windows10-2004-x64
1VDX.exe
windows10-2004-x64
4VDX_x64.exe
windows10-2004-x64
4Carpetas d....0.zip
windows10-2004-x64
1ViGEmBusDr...us.inf
windows10-2004-x64
1ViGEmBusDr...us.sys
windows10-2004-x64
1ViGEmBusDr...09.dll
windows10-2004-x64
1ViGEmBusDr...us.cat
windows10-2004-x64
8ViGEmBusDr...us.inf
windows10-2004-x64
1ViGEmBusDr...us.sys
windows10-2004-x64
1ViGEmBusDr...09.dll
windows10-2004-x64
3ViGEmBusDr...us.cat
windows10-2004-x64
8Carpetas d...ce.exe
windows10-2004-x64
4Carpetas d...64.exe
windows10-2004-x64
4Carpetas d...on.rar
windows10-2004-x64
3devcon.exe
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-es -
resource tags
arch:x64arch:x86image:win10v2004-20240730-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
02/08/2024, 09:40
Behavioral task
behavioral1
Sample
Usar tu mando Generico como si fuera uno de playstation 4.rar
Resource
win10v2004-20240730-es
Behavioral task
behavioral2
Sample
Carpetas de Archivos/Comandos.txt
Resource
win10v2004-20240730-es
Behavioral task
behavioral3
Sample
Carpetas de Archivos/VDX_v1.14.3.0_x64_x86_GPDWinEdition.zip
Resource
win10v2004-20240730-es
Behavioral task
behavioral4
Sample
VDX.exe
Resource
win10v2004-20240730-es
Behavioral task
behavioral5
Sample
VDX_x64.exe
Resource
win10v2004-20240730-es
Behavioral task
behavioral6
Sample
Carpetas de Archivos/ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0.zip
Resource
win10v2004-20240730-es
Behavioral task
behavioral7
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.inf
Resource
win10v2004-20240730-es
Behavioral task
behavioral8
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/ViGEmBus.sys
Resource
win10v2004-20240730-es
Behavioral task
behavioral9
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/WdfCoinstaller01009.dll
Resource
win10v2004-20240730-es
Behavioral task
behavioral10
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x64/vigembus.cat
Resource
win10v2004-20240730-es
Behavioral task
behavioral11
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.inf
Resource
win10v2004-20240730-es
Behavioral task
behavioral12
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/ViGEmBus.sys
Resource
win10v2004-20240730-es
Behavioral task
behavioral13
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/WdfCoinstaller01009.dll
Resource
win10v2004-20240730-es
Behavioral task
behavioral14
Sample
ViGEmBusDriver_signed_Win7-10_x86_x64_v1.13.0.0/drivers/x86/vigembus.cat
Resource
win10v2004-20240730-es
Behavioral task
behavioral15
Sample
Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe
Resource
win10v2004-20240730-es
Behavioral task
behavioral16
Sample
Carpetas de Archivos/X360CE - 64 Bits/x360ce_x64.exe
Resource
win10v2004-20240730-es
Behavioral task
behavioral17
Sample
Carpetas de Archivos/devcon.rar
Resource
win10v2004-20240730-es
Behavioral task
behavioral18
Sample
devcon.exe
Resource
win10v2004-20240730-es
General
-
Target
Carpetas de Archivos/X360CE - 32 Bits/x360ce.exe
-
Size
2.8MB
-
MD5
04ae76f89c99b8a225771f3702b1c858
-
SHA1
aff34cd0c77243e54b57ed2a55213159effb1f0e
-
SHA256
f54deb01f98614fd94eb2954e0c909b2518370d4286767cd265f77f6588bff9b
-
SHA512
985dad2372edf283e5c8068ee5c315b0e31f03bfe909a773cab31ceb1064308148f299008db488984853ca46fafdfe15abd1b2624ead8942425eb027737869e9
-
SSDEEP
49152:ol7PbfJJb4/WGhvbBJJb4/WGmJJb4/WGi0wr+CTZtvwZOP7UCqEJJK4//Gz:oVPXbbGNRbbGubbGiBr+AK+Gz
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\msmouse.PNF x360ce.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x360ce.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3324 x360ce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Carpetas de Archivos\X360CE - 32 Bits\x360ce.exe"C:\Users\Admin\AppData\Local\Temp\Carpetas de Archivos\X360CE - 32 Bits\x360ce.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD510106fc49ece765081804cc86bccd18c
SHA1c454289db14253dad1d4c8f98e3c1a181371dc4c
SHA2563b325f7d97f2539098d2fea20c00041bed180e7c07535719d7fceff9f143c507
SHA51227b06c7977593760be0a1d6746c5b32e9ba1e6821762a375ed7cb06e63779d6b1c0e926bf7ac86e62fa98910726d562e3e9f16fb0a33ad1a6c229de463ecbc6c
-
Filesize
3KB
MD5b86d5b106b820aeb166064596d59cd9f
SHA1e48794c4cb7c747fe6db582f92f28916e6a64f57
SHA25655d62e89ed05b7f80e46a3be1675d0301c433457ad1937d663d7b179b21f086c
SHA512fc2266d3e938d3d6ff4fca084d1a867d94c066fb5272a0962f175fcb8f1d82a4519acf98630749cb86d8905eeaba7adb1353c07c8af601b669ff3414f32b7a38
-
Filesize
3KB
MD59d95c2944332e77e938407f0405a1b93
SHA1bf3cc8693d4fdfdfac938a48a815f529c10cc802
SHA2565dd60642175a715d20e4cbafb8753caa28f56c2b8c9b8f52d521b49f26403800
SHA512bc57f9f7da976fce3729e8344ce9c4609f1581c7e116e95976121fee9ae974e3cb3fdf7628baf80e2a6ff84678bb5593e485cdf140dbe58080b1da42736af1cc
-
Filesize
4KB
MD531fa3c91e4bb2ed35c2346f97a2b0fa6
SHA126e142133feddb53dffae0ab3c99627b1b9fd877
SHA256c5170c1da3f8d045fff8af365398ed8971e44e4ed1d87842892cdf7db57eb491
SHA512cf59dbd5f2c92a3e4ae08257fbff83d3742845ddfecfd6ee8e04d9b4980e023498d66e58109b40985687812c2632a503b1b23d9bd201af1e92f4ae344afc932f
-
Filesize
7KB
MD5731a9ac2472927cb646020fceb60dd1e
SHA1d72b257e7ac58a087af61617172537d99039cc41
SHA25661cd4ab29fe20736567a7181d34655e914647bdd68adb46bf6a6e0518f444ea6
SHA51220ca0041aec2f51c9f73981a373ae45352145aed7b8fdc73b7b9f5936865f0451b802a42a050a76ffb4b1a80f920fce0b1b0af9360feceb19ef40c010de08a86
-
Filesize
622B
MD5a79dd6e14c82c7d3cbcd6b4daa4835f1
SHA199e46fa0409c68868634ce9bb216fc693b04b8f2
SHA256ca2de5084d95bfe56b3b93642ba54562aa455201066d0f99169a0c21f84e136b
SHA5126e46659708a0138772ee0094082104a2132bc9ca18872780b14066c1e65c34928463dd71628938ae535c5d3f3dd8147ea05e2ced2e9aea50300dcb6e604ff846
-
Filesize
966B
MD5d9282ce0a9d0c4dbeac6dc7de1f10693
SHA1b794bebbb58e701a6648a83b23a3106e577eaaa5
SHA256e396670f35f5efcd611283652db2b3b1b3ba75168d6ca6c63b135dc06e71dfff
SHA5120de0bd50717962d91aa57d2478fc5c6c6b531c0be29c92f963dde555dd16246e1b2ce183f187c3f7f8986729af1935a9b82a6f073b54d6ddfc5c511db42f4b19
-
Filesize
1KB
MD577adb9aaeae7b9fbb06010f34b244a9f
SHA1b395c4c506c821f0db0dd66ff2ab0faf63211617
SHA256a4c69d734c9d1c845f88e30c4b1fa08b6c4164da53fbffdaa9da5a3b8cfb4c6f
SHA5127dba7656957ba375ce95f8a67cd15f10052a078bc669625e0d73bc40dbb4b82785e431e6886a69a72823d9d150d7a4a763c904301791941f28e6917fa3c67a7c
-
Filesize
123KB
MD55236623449893c0e1e98fc95f067fcff
SHA150b4f1e2340b7c7ad065b2111fc075b2cafe6231
SHA256301f0d831d95bb5c3b5c57f8a92a35211531b410fcf2bd08927a286b867142a3
SHA5129b94bddcb5e64bbf3649567f16a828588423873b60858d45c40155f36cc7f95d205f4e9b6cdc8ac2852240fdb6a67d0940c60e4f103cecbf118eae1438019c0c