Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

VirtualTab...up.exe

windows7-x64

7

VirtualTab...up.exe

windows10-2004-x64

8

Resubmissions

30/09/2024, 12:01

240930-n68dvaycja 8

30/09/2024, 11:54

240930-n2219stenl 8

30/09/2024, 11:44

240930-nwdfqatcjj 7

Analysis

  • max time kernel
    259s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 12:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirtualTabletServer_v3.1.3_setup.exe

  • Size

    29.4MB

  • MD5

    a8e73dd218f4e724f1ba4215d0d8e1f7

  • SHA1

    999190ea75801c292d04a16cdc91f119989fa98e

  • SHA256

    0310ad0d2c0dc62100055c5e96add680cc0426b259af77cf4e0dd80664cf48c2

  • SHA512

    fa38fd150ca9341500a316cb7adea24f74c6df30309d1766338374ce08ec6d1bbf80d6c8b1bafbe97e33e3c0395cca2ef97a141af979f56746d6d2bb30ce2a23

  • SSDEEP

    393216:8BkqKoRZ4QZ2RCV+5XPw6VBb26k1Tn/BnrBXRt1euiY6SnadV+mgG1MKcibQSIpU:qZ4Jc0X7x3yBr9RtriYdnKMiY8ubFC

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 38 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Windows\TEMP\{5A4664B5-121D-460F-87CE-E80DAC93BD52}\.cr\VirtualTabletServer_v3.1.3_setup.exe
      "C:\Windows\TEMP\{5A4664B5-121D-460F-87CE-E80DAC93BD52}\.cr\VirtualTabletServer_v3.1.3_setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\TEMP\{37C5B900-5BA5-4EBD-850D-264EB6A7F7A5}\.be\VirtualTabletServer_v3.1.3_setup.exe
        "C:\Windows\TEMP\{37C5B900-5BA5-4EBD-850D-264EB6A7F7A5}\.be\VirtualTabletServer_v3.1.3_setup.exe" -q -burn.elevated BurnPipe.{AC4E66CF-4873-44DD-A6A8-6A83DC6AB9A2} {BBE486CF-D8A8-46BF-BA63-B22F28E95DDA} 1948
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3452
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3544
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Modifies data under HKEY_USERS
    • Modifies registry class
    PID:1784
    • C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe
      "C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe" install vmulti.inf djpnewton\vmulti
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4204
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "c:\program files\virtualtablet server\drivers\vmulti.inf" "9" "4b03c492f" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "c:\program files\virtualtablet server\drivers"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1448
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{24aba415-4230-8b43-b71c-adc7782eceae} Global\{de9d4f64-c95a-964d-9971-1474f8b9dda9} C:\Windows\System32\DriverStore\Temp\{21d6da7d-b47f-374f-a740-431150b8f806}\vmulti.inf C:\Windows\System32\DriverStore\Temp\{21d6da7d-b47f-374f-a740-431150b8f806}\vmulti.cat
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        PID:968
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce884b67bbc5d:vmulti.Inst:16.53.52.383:djpnewton\vmulti," "4b03c492f" "0000000000000140"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4368
  • C:\Program Files\VirtualTablet Server\VirtualTabletServer.exe
    "C:\Program Files\VirtualTablet Server\VirtualTabletServer.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Program Files\VirtualTablet Server\adb\adb.exe
      "C:\Program Files\VirtualTablet Server\adb\adb.exe" devices
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Program Files\VirtualTablet Server\adb\adb.exe
        adb -L tcp:5037 fork-server server --reply-fd 588
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1328

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{37C5B900-5BA5-4EBD-850D-264EB6A7F7A5}\AppInstaller.msi
    Filesize

    29.5MB

    MD5

    8b8fb0b409bc8b50abd8f55c10130590

    SHA1

    40819fe7b0c258edaa8be6a65bcabdb245e7d6af

    SHA256

    ce21efe9ec03f5799de9fb2edbb75c92261176a0ff34b124dcce3750764c7470

    SHA512

    17a3007afe108720930c686d374c042c8b17e513d12e9f2c0240a96211075ad3d4b05a1696037620ea9acb55ccaa8df7cd6465bdd5979fa8119eeb7a97daf09d

    Download Submit

  • C:\Windows\System32\DriverStore\Temp\{21d6da7d-b47f-374f-a740-431150b8f806}\WdfCoInstaller01011.dll
    Filesize

    1.7MB

    MD5

    d10864c1730172780c2d4be633b9220a

    SHA1

    b85d02ba0e8de4aeded1a2f5679505cd403bd201

    SHA256

    f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2

    SHA512

    c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040

    Download Submit

  • C:\Windows\System32\DriverStore\Temp\{21d6da7d-b47f-374f-a740-431150b8f806}\vmulti.cat
    Filesize

    8KB

    MD5

    84977b85e9e1d90d5c9dc3dbca70a75b

    SHA1

    eb0b57fb397b557f2ef15893137632ebffe95fee

    SHA256

    77d6367bd52f307fdef58b7246c944423ef6c7d136676acc651d5bee0f3d7d1e

    SHA512

    5886c3570b55ebe874ce6c1cc6fc59241ae06f934ff26ad4c61a9e4d4197c4164d8ce78ea1ef7a72d37284ccbcfecd2ba35a6896dd0a34299dce95ab3b4cde27

    Download Submit

  • C:\Windows\System32\DriverStore\Temp\{21d6da7d-b47f-374f-a740-431150b8f806}\vmulti.inf
    Filesize

    2KB

    MD5

    72f61f9b84dd54dc761d9a40c49ffdc3

    SHA1

    d97de8e3b2b7722009933fbf64a9376243bf7f22

    SHA256

    a752ed816ab1259da2e3c9a1ccfd55af86b11c1638b7f8ed76b4c8749bccb07d

    SHA512

    ca52bf508a445e4f1ebb8c8429db07f7aaf17b8445fe02604d6512e9daaf6aaceee713c7194891729d121291e140b6b93e8517cfe9c6e29ac34a34dc7b5f223b

    Download Submit

  • C:\Windows\System32\DriverStore\Temp\{21d6da7d-b47f-374f-a740-431150b8f806}\vmulti.sys
    Filesize

    9KB

    MD5

    73f306df9e8525b23600b6f00cd41392

    SHA1

    4a5c5fc5da4857bbe0a2e9fe3ed41516b85ccba5

    SHA256

    73902926ef3ce9c8f6b337284c90956e2e4717309f8aef4d0c7ba0394eab3664

    SHA512

    a0018cef5bf77290a4b69a51939deab4a0f685a849b07b769d9fea43ebd9bb5eeffd7d8b8a7042d4436fe5ba6439e8ba8d33dd55d4257d15c19e3eb6f2aa8049

    Download Submit

  • C:\Windows\TEMP\{5A4664B5-121D-460F-87CE-E80DAC93BD52}\.cr\VirtualTabletServer_v3.1.3_setup.exe
    Filesize

    1.3MB

    MD5

    69a542c2422f4f539ac40ce9397c9935

    SHA1

    5d58ec90b036e9945bdff1bf4fbb52a92ede0e00

    SHA256

    253bf36a09e7f5c4bc7d5dfade9e3f544b9a6e352b917bc3929c49024bdf9dd2

    SHA512

    2e4023ad4faa30677d231432864d9205ee5fd9634803bedb08dca51bf86e95255d172c5f296072ff908349032f593abe3a659813ffa5543dc5b212b747921131

    Download Submit

  • C:\Windows\Temp\{37C5B900-5BA5-4EBD-850D-264EB6A7F7A5}\.ba\logo.png
    Filesize

    4KB

    MD5

    c4b419eb2db55b63793791f008996449

    SHA1

    8e3e3fd449dafe6231bfd2ca5a511e8a3a497b92

    SHA256

    05a28f83ccdd456177a35213a83a1d78a1fd563fa88eb4dd17f612fc32b92437

    SHA512

    0fe00d342f15ba5ed1636f56e5e20a936f5abe99d1ffae517922dbfdd6a662117f6d67ae801bc9a7058af5219daf5537fe7c324cd429e9a89fc1779c38f0c8e0

    Download Submit

  • C:\Windows\Temp\{37C5B900-5BA5-4EBD-850D-264EB6A7F7A5}\.ba\wixstdba.dll
    Filesize

    366KB

    MD5

    ae30aef6b62a24b80c560773264c7f47

    SHA1

    fc1befa879bc5c1d43440830c7155f51103d7a59

    SHA256

    64ae3ecfb170f00f83e7ca4dee61a23023d48b22b79d0a28f13c52c133172cca

    SHA512

    994e3052a30e91f6731a0bae3bd20395dd648cfa9bfcb4283c4c7bb4539161e3c8cb67f355cfef5c2172cb0c7692f8acfbdca1cb185ab20148120c67d89dd53c

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.7MB

    MD5

    8a58cb45df11a323e985dd09f54de52e

    SHA1

    31eea179b1941a7d88714e8532099dcfab748b55

    SHA256

    610345cef2dfd8935fcfefd9b89ada90f59654cd66584de1660481b82beac131

    SHA512

    3e6bbbd4ea7b7716aa69f962addf2087a239fe8cfc5114d7939d7ad595e6c53651ea00ac0f509876d0f37816d051244e4fa870fa7f6597254f94b0b266d675f5

    Download Submit

  • \??\Volume{83bffa96-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1d6016d2-b9bf-4d8d-8b18-876e6f78f9d5}_OnDiskSnapshotProp
    Filesize

    6KB

    MD5

    7586c01bdf43c4e35c8e664878ad3ead

    SHA1

    50f110b54545974d3255aa27fec12859df7f60c5

    SHA256

    6ccc6c941a9f4fc38e72435a9abe24f4d85a1d580837b286b26287f909e34119

    SHA512

    4dd3949bd6bc5ac735d739ddf563aa6be26403d0218e86352cb5f59f9724bba302b932912dc5e62e3321c14fd24a656db0bace6031ed24e7461cbb685b706fdb

    Download Submit

  • memory/2788-141-0x00007FF6D5200000-0x00007FF6D5321000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/5032-148-0x000002C752450000-0x000002C752451000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5032-149-0x000002C756120000-0x000002C7566A5000-memory.dmp

    Filesize

    5.5MB

    Download

  • memory/5032-152-0x000002C752460000-0x000002C752461000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5032-150-0x000002C756120000-0x000002C7566A5000-memory.dmp

    Filesize

    5.5MB

    Download

  • memory/5032-151-0x000002C756120000-0x000002C7566A5000-memory.dmp

    Filesize

    5.5MB

    Download