Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3XSpammer-I...er.exe
windows7-x64
7XSpammer-I...er.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
5XSpammer.exe
windows7-x64
7XSpammer.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/de.ps1
windows7-x64
3locales/de.ps1
windows10-2004-x64
3resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3Analysis
-
max time kernel
83s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
XSpammer-Installer.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
XSpammer-Installer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
XSpammer.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
XSpammer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
locales/de.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
locales/de.ps1
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/elevate.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240729-en
windows7-x64
General
-
Target
XSpammer.exe
-
Size
146.9MB
-
MD5
7569248ecf733ad0b28439ee7783b1b0
-
SHA1
1a3a9a152ec58b1f53ffa81a7a259b3182acf91a
-
SHA256
21d536c74d4417accc6ee65840baf21cf9f8f7742fe5416b04706a32ba434c17
-
SHA512
6ab9d276b83c927edc0313c0cde243150e82aab2f3049a15da95bd45431c34a3089cbe27bedd4fb0a4447b1a82d58e088fc258672a5a013eedd7e1e84a22bc01
-
SSDEEP
1572864:RE8jO4LIZ4K5Mgpj7/bX+P3IcYpXmISltpcRP78TEGj5ULWw:fBB+kYL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation XSpammer.exe Key value queried \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation XSpammer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2700 XSpammer.exe 2700 XSpammer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe Token: SeShutdownPrivilege 2004 XSpammer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2376 2004 XSpammer.exe 30 PID 2004 wrote to memory of 2780 2004 XSpammer.exe 31 PID 2004 wrote to memory of 2780 2004 XSpammer.exe 31 PID 2004 wrote to memory of 2780 2004 XSpammer.exe 31 PID 2004 wrote to memory of 2700 2004 XSpammer.exe 32 PID 2004 wrote to memory of 2700 2004 XSpammer.exe 32 PID 2004 wrote to memory of 2700 2004 XSpammer.exe 32 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33 PID 2004 wrote to memory of 1856 2004 XSpammer.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"C:\Users\Admin\AppData\Local\Temp\XSpammer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1012 --field-trial-handle=1100,i,18032967844947211619,1026083050447756529,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"C:\Users\Admin\AppData\Local\Temp\XSpammer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes --mojo-platform-channel-handle=1236 --field-trial-handle=1100,i,18032967844947211619,1026083050447756529,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"C:\Users\Admin\AppData\Local\Temp\XSpammer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=app --fetch-schemes=app --service-worker-schemes=app --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1532 --field-trial-handle=1100,i,18032967844947211619,1026083050447756529,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"C:\Users\Admin\AppData\Local\Temp\XSpammer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\xspammer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1400 --field-trial-handle=1100,i,18032967844947211619,1026083050447756529,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23