Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2023, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe
Resource
win10v2004-20230220-en
General
-
Target
4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe
-
Size
473KB
-
MD5
53034a726f8eda04a0a7e8e4ab0cbb2b
-
SHA1
fd2c47d7f99b5f32518b2f29e27f7410c3313bdd
-
SHA256
4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0
-
SHA512
efa469c2cdf72f57167490317ec4e09e8acdaee997468e843302a70c2e5511ef1b7098133d14a01fe008eb6a06f27d4da4532596b692e5764536fa77fbd7ea38
-
SSDEEP
6144:Y7r6OgqBI0xD99qHyVKxJGJeIB184PUThU0NwjJFJdhaVc5mz0k:Y7OOgqBtTcygIWTm3JXyc5mz0k
Malware Config
Extracted
vidar
3.6
78489afd9d9a4747beb445e5fb5b9c96
https://steamcommunity.com/profiles/76561199499188534
https://t.me/nutalse
-
profile_id_v2
78489afd9d9a4747beb445e5fb5b9c96
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
Extracted
laplas
http://89.23.97.128
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 20461402376215021028.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 20461402376215021028.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 20461402376215021028.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ntlhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe -
Executes dropped EXE 2 IoCs
pid Process 4548 20461402376215021028.exe 2428 ntlhost.exe -
Loads dropped DLL 2 IoCs
pid Process 1232 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe 1232 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 20461402376215021028.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 20461402376215021028.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntlhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4548 20461402376215021028.exe 2428 ntlhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 52 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1232 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe 1232 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1232 wrote to memory of 4548 1232 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe 90 PID 1232 wrote to memory of 4548 1232 4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe 90 PID 4548 wrote to memory of 2428 4548 20461402376215021028.exe 92 PID 4548 wrote to memory of 2428 4548 20461402376215021028.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe"C:\Users\Admin\AppData\Local\Temp\4b7e84a26c4405d2a704a3d881a0699f631dd59788f0a13f18cd7eecb9edf1a0.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\ProgramData\20461402376215021028.exe"C:\ProgramData\20461402376215021028.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2428
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5f5548281bcdcec5c1d151d3417412042
SHA1be6d9b40b6ede0f3c5582b8f48bde7f44f2ed792
SHA2563469724e57612ca20c888a5a86719c3e4b6fe71f2cfcfecff2fb3950fd0a32ac
SHA512387d864aca4be8691c20b0ec4b11906491cdb7b0fc435f59699c0596a47ad086d711ed97c47a611b58adf1096203ab7a488e26c307d885e566f56db6dcecab4c
-
Filesize
3.5MB
MD5f5548281bcdcec5c1d151d3417412042
SHA1be6d9b40b6ede0f3c5582b8f48bde7f44f2ed792
SHA2563469724e57612ca20c888a5a86719c3e4b6fe71f2cfcfecff2fb3950fd0a32ac
SHA512387d864aca4be8691c20b0ec4b11906491cdb7b0fc435f59699c0596a47ad086d711ed97c47a611b58adf1096203ab7a488e26c307d885e566f56db6dcecab4c
-
Filesize
3.5MB
MD5f5548281bcdcec5c1d151d3417412042
SHA1be6d9b40b6ede0f3c5582b8f48bde7f44f2ed792
SHA2563469724e57612ca20c888a5a86719c3e4b6fe71f2cfcfecff2fb3950fd0a32ac
SHA512387d864aca4be8691c20b0ec4b11906491cdb7b0fc435f59699c0596a47ad086d711ed97c47a611b58adf1096203ab7a488e26c307d885e566f56db6dcecab4c
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
219.1MB
MD5dbae8f53460195fc9d2001f60acb0fa7
SHA19ffe705b85c5900eedf0ef53057d943b533328ef
SHA256395981469dabe1ddc95ccf2396d9bb0cc0a3044eef85c39fce3ba7607e3ac4dd
SHA51214c7565a06b21304d74c20b943a721a859c64c02232a27c779510565e15a77fc2c17a0284b350b979ca1fbcf50635e843356be14ec07e84a117a91d728caa0e9
-
Filesize
226.2MB
MD511516f2250aff002bcabfa93ed7a9988
SHA18e444de346fe296ddfce9b886527a9ab5b56856f
SHA256e26882019e6aae1ea0e4a705be314b64770d93be6266903fd10cd40b731c8ec7
SHA512304bf9833d345f6033e75e27a8ef6386420c907c03ce41249169274165a4c45868a2b40e144e5f2033f769175145a6d18409e2c7dff934a3d1672d7b5c910be0