Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20241010-en
General
-
Target
vbc.exe
-
Size
713KB
-
MD5
6dd65cf5c7523aff3f622e3ab7142f91
-
SHA1
e3ea22daf35fe994b0612550cfdf8009c2fee3e2
-
SHA256
3b49fb8bc04b8446394c1fd905fa6ee17155a5d34284a509765bca640cbbd37a
-
SHA512
c2d425c8e557504dadfda829fef525d0f2f6e150cbad95d6e40b0d20765d78e6ea4c114522b498effb006dc766645ba3fc82ff2b2c881807da0a497d81c0e91b
-
SSDEEP
12288:LGUUogb8YUPJh3b+vz+TA39U5LiiHdmEorzEKMK:L5UoVPJhFAtUtrdor4K
Malware Config
Extracted
xloader
2.3
24ng
thesmarterhold.com
meandondita.com
getzlppi.com
kaibosatadom.com
ibggroupkerala.com
emmymorrow.xyz
wandallia.com
jogiyoga.support
vuagiaychatt.com
jadhavconstructions.com
hypydeals.com
brightstarqr.com
unifi.group
derm-course.com
jvbcloud.com
upuwallet.com
115manhuang.com
ashleytdg.com
ptpatennis.com
noodahl.com
truelineeducation.com
donatetorondesantis.com
hfhwssc.com
nz1001.com
operationbuy.com
inanavcifitnessclub.com
vm3w5.com
justicegirlssliponslippers.com
gyzymp.com
tonailcure.icu
sunshineenergyind.com
softouchcomputer.com
righttoshoot.com
tangjiu360.com
pvfuseholder.com
caniondaronda.com
tomrings.com
zaimplusinfo58.info
joycekayiba.com
myfreezic.com
equltycol.com
migaomi.ltd
everttrend.com
jjyzscl.com
rusmumrik.com
kuchpay.com
movetoridgegate.com
alligatorjonesy.com
sanjosedroneservices.com
topjapancasinos.com
greenexpress24.com
marathonsportsmarketing.com
mucuatoi.com
2019kapas.com
kriostransportation.com
makritechina.com
stellarsoundsandevents.com
siohukimax.xyz
routrays.com
dg88544.online
balineem.com
8985525.com
ababanaeskan.com
awakenedguild.com
mercurydatas.com
Signatures
-
Xloader family
-
Xloader payload 3 IoCs
resource yara_rule behavioral1/memory/2592-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2592-16-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2824-23-0x00000000000D0000-0x00000000000F8000-memory.dmp xloader -
Deletes itself 1 IoCs
pid Process 1840 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2536 set thread context of 2592 2536 vbc.exe 34 PID 2592 set thread context of 1256 2592 vbc.exe 21 PID 2824 set thread context of 1256 2824 wuapp.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuapp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2536 vbc.exe 2536 vbc.exe 2536 vbc.exe 2536 vbc.exe 2536 vbc.exe 2536 vbc.exe 2536 vbc.exe 2536 vbc.exe 2592 vbc.exe 2592 vbc.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe 2824 wuapp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2592 vbc.exe 2592 vbc.exe 2592 vbc.exe 2824 wuapp.exe 2824 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2536 vbc.exe Token: SeDebugPrivilege 2592 vbc.exe Token: SeDebugPrivilege 2824 wuapp.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2764 2536 vbc.exe 30 PID 2536 wrote to memory of 2764 2536 vbc.exe 30 PID 2536 wrote to memory of 2764 2536 vbc.exe 30 PID 2536 wrote to memory of 2764 2536 vbc.exe 30 PID 2536 wrote to memory of 2636 2536 vbc.exe 31 PID 2536 wrote to memory of 2636 2536 vbc.exe 31 PID 2536 wrote to memory of 2636 2536 vbc.exe 31 PID 2536 wrote to memory of 2636 2536 vbc.exe 31 PID 2536 wrote to memory of 2820 2536 vbc.exe 32 PID 2536 wrote to memory of 2820 2536 vbc.exe 32 PID 2536 wrote to memory of 2820 2536 vbc.exe 32 PID 2536 wrote to memory of 2820 2536 vbc.exe 32 PID 2536 wrote to memory of 1780 2536 vbc.exe 33 PID 2536 wrote to memory of 1780 2536 vbc.exe 33 PID 2536 wrote to memory of 1780 2536 vbc.exe 33 PID 2536 wrote to memory of 1780 2536 vbc.exe 33 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 2536 wrote to memory of 2592 2536 vbc.exe 34 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 1256 wrote to memory of 2824 1256 Explorer.EXE 35 PID 2824 wrote to memory of 1840 2824 wuapp.exe 36 PID 2824 wrote to memory of 1840 2824 wuapp.exe 36 PID 2824 wrote to memory of 1840 2824 wuapp.exe 36 PID 2824 wrote to memory of 1840 2824 wuapp.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1840
-
-