Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2023, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
Reservation information (date, name and etc)/Reservation information (date, name and etc).exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Reservation information (date, name and etc)/Reservation information (date, name and etc).exe
Resource
win10v2004-20230915-en
General
-
Target
Reservation information (date, name and etc)/Reservation information (date, name and etc).exe
-
Size
92.9MB
-
MD5
9809cc75b12ebaa98003f8288978f3b3
-
SHA1
94a5a71d6548ea8aab5b03f5bc8dcd2c559ed084
-
SHA256
dd5ed75d01cbe4f1957df72a058656e7b45cb1e2e74efa6eb796fe9a7012a173
-
SHA512
6421e8cf53d93dcd48529ba7ec34a8b7cdf24d34886bee3828f12385942619e89345b205d0201faffaad60a0dd34dd9cc243230f2c4b9f5ce75bc1cb684125cf
-
SSDEEP
1572864:Th4QkjGuWsqebzyuGqNMnKuEqHhaPd5nC8DDkeZZZZZsOKa1pVeOKCr7ZPE:l43jRWshbzyuNMnlEqIPrzDkeZZZZZsR
Malware Config
Extracted
vidar
5.9
3ea14c104bd4d544fa30377b4df192a6
https://t.me/grizmons
https://steamcommunity.com/profiles/76561199557479327
http://94.228.162.50:80
-
profile_id_v2
3ea14c104bd4d544fa30377b4df192a6
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4772 created 3172 4772 Reservation information (date, name and etc).exe 45 -
Executes dropped EXE 1 IoCs
pid Process 2160 mergecap.exe -
Loads dropped DLL 12 IoCs
pid Process 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 2160 mergecap.exe 5044 explorer.exe 5044 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2160 set thread context of 1420 2160 mergecap.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1556 5044 WerFault.exe 103 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4772 Reservation information (date, name and etc).exe 4772 Reservation information (date, name and etc).exe 2160 mergecap.exe 1420 cmd.exe 1420 cmd.exe 5044 explorer.exe 5044 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2160 mergecap.exe 1420 cmd.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4772 wrote to memory of 2160 4772 Reservation information (date, name and etc).exe 91 PID 4772 wrote to memory of 2160 4772 Reservation information (date, name and etc).exe 91 PID 2160 wrote to memory of 1420 2160 mergecap.exe 95 PID 2160 wrote to memory of 1420 2160 mergecap.exe 95 PID 2160 wrote to memory of 1420 2160 mergecap.exe 95 PID 2160 wrote to memory of 1420 2160 mergecap.exe 95 PID 1420 wrote to memory of 5044 1420 cmd.exe 103 PID 1420 wrote to memory of 5044 1420 cmd.exe 103 PID 1420 wrote to memory of 5044 1420 cmd.exe 103 PID 1420 wrote to memory of 5044 1420 cmd.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\Reservation information (date, name and etc)\Reservation information (date, name and etc).exe"C:\Users\Admin\AppData\Local\Temp\Reservation information (date, name and etc)\Reservation information (date, name and etc).exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4772
-
-
C:\Users\Admin\AppData\Roaming\IcTask_v2\mergecap.exeC:\Users\Admin\AppData\Roaming\IcTask_v2\mergecap.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 14765⤵
- Program crash
PID:1556
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5044 -ip 50441⤵PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
893KB
MD5f5f6fd1a879dd2d0724e2d356e26fab9
SHA18501c7fcd3ee46b1b73c5885acb29374d1cbc361
SHA256aed2b4635ea158afc2303a4f9d6ff2f264dce068c3e6f1ea3fcb5065451293be
SHA51291dd8ccf269fca55801a469160d4d8a5bcfe5734fcb5d217761c6a005183f287a93e21d41d2298a0948aea1370d57561c6f57e70da639ab4a3adfea48c23a2d7
-
Filesize
809KB
MD5366fd6f3a451351b5df2d7c4ecf4c73a
SHA150db750522b9630757f91b53df377fd4ed4e2d66
SHA256ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
SHA5122de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
-
Filesize
1.1MB
MD52f2bfc6119daa63bfde98927878388e7
SHA18b2f941ea6c8a5968be871b68e6dc2fe0fce6d17
SHA2566a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0
SHA512b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d
-
Filesize
1.1MB
MD52f2bfc6119daa63bfde98927878388e7
SHA18b2f941ea6c8a5968be871b68e6dc2fe0fce6d17
SHA2566a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0
SHA512b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d
-
Filesize
1.1MB
MD52f2bfc6119daa63bfde98927878388e7
SHA18b2f941ea6c8a5968be871b68e6dc2fe0fce6d17
SHA2566a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0
SHA512b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d
-
Filesize
1.1MB
MD52f2bfc6119daa63bfde98927878388e7
SHA18b2f941ea6c8a5968be871b68e6dc2fe0fce6d17
SHA2566a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0
SHA512b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d
-
Filesize
1.1MB
MD52f2bfc6119daa63bfde98927878388e7
SHA18b2f941ea6c8a5968be871b68e6dc2fe0fce6d17
SHA2566a15b04430c503427cdd70c442389cbb66a2a0e1dd57f2d1535d3aa389df47b0
SHA512b3333d915d5b979b2683bfee3ed9beb4ec78b7ef74bede79fa1b31941ec9037f31439ca2f350d11842b021b57f708053cab5dc6c656175321e086df3760e392d
-
Filesize
46KB
MD55bdd314fb97d92743e0f84978af7197e
SHA1f7b89279588b49f4c51930cf12424f8944d31664
SHA256a72cb7f636483c65fc027d09608a4b0a681d3665fcfa93e5e8258f1c96f5cc09
SHA512d952c757913091e6b6dc71abe2c51c11a10c32ec9f3e221337ad3a584402605dca548bb088d784a176b43de7184742636e44842ae050c1fd2b4ac6fc0261e57b
-
Filesize
46KB
MD55bdd314fb97d92743e0f84978af7197e
SHA1f7b89279588b49f4c51930cf12424f8944d31664
SHA256a72cb7f636483c65fc027d09608a4b0a681d3665fcfa93e5e8258f1c96f5cc09
SHA512d952c757913091e6b6dc71abe2c51c11a10c32ec9f3e221337ad3a584402605dca548bb088d784a176b43de7184742636e44842ae050c1fd2b4ac6fc0261e57b
-
Filesize
135KB
MD57bd6d0d9a7ebd9e76d1c6f9ef7d13b81
SHA192e570a5c331c337ae42d1b5dd8f8b003e6fe320
SHA2560416287740e35886e1721cbb3379525a3850d96a5f20f330d2ee5d2b03f272c9
SHA512bd44ef64d8bd1f0fe703e6856cd881f7ff0f93238b9cbc918d145f867a562284346b3cce84dc1d2e62311139798600d9118eb70d67cad1995bdd60b87ae5b717
-
Filesize
135KB
MD57bd6d0d9a7ebd9e76d1c6f9ef7d13b81
SHA192e570a5c331c337ae42d1b5dd8f8b003e6fe320
SHA2560416287740e35886e1721cbb3379525a3850d96a5f20f330d2ee5d2b03f272c9
SHA512bd44ef64d8bd1f0fe703e6856cd881f7ff0f93238b9cbc918d145f867a562284346b3cce84dc1d2e62311139798600d9118eb70d67cad1995bdd60b87ae5b717
-
Filesize
56KB
MD50a8bc2c0ae8ba47c3397b1c1a1fb18d0
SHA122b7cc6c10ce9a4417a0bc65663385160a480b7d
SHA256bdda1fef013640dfd7980481963bc837c556e6342d7184dd6f4c5454122bc9f2
SHA5122c1ee3593b124db4a0c96dfdd44ba599f365bd19bbd7638220cb9cd91d487dbfdd531c28782849342225b3461982cfd34fb29ec8a8e0bb65f308b99937288f68
-
Filesize
56KB
MD50a8bc2c0ae8ba47c3397b1c1a1fb18d0
SHA122b7cc6c10ce9a4417a0bc65663385160a480b7d
SHA256bdda1fef013640dfd7980481963bc837c556e6342d7184dd6f4c5454122bc9f2
SHA5122c1ee3593b124db4a0c96dfdd44ba599f365bd19bbd7638220cb9cd91d487dbfdd531c28782849342225b3461982cfd34fb29ec8a8e0bb65f308b99937288f68
-
Filesize
39KB
MD523ba27d352305f29d201ac5e43fc4583
SHA17c7720604bb82351dfba857837d64b360cd715b2
SHA256ac7a321a7b00b4adb5863b9a7e91e69afe9ce1953317234a2bd1bee97de744da
SHA5124c96ea8b6e21415f8004bc1ce037e406f3086991e9d401d14986602905616a6ad962fa71673f914327cae6a4f8381365330a94467e0d5be1d287f2bea175b599
-
Filesize
39KB
MD523ba27d352305f29d201ac5e43fc4583
SHA17c7720604bb82351dfba857837d64b360cd715b2
SHA256ac7a321a7b00b4adb5863b9a7e91e69afe9ce1953317234a2bd1bee97de744da
SHA5124c96ea8b6e21415f8004bc1ce037e406f3086991e9d401d14986602905616a6ad962fa71673f914327cae6a4f8381365330a94467e0d5be1d287f2bea175b599
-
Filesize
809KB
MD5366fd6f3a451351b5df2d7c4ecf4c73a
SHA150db750522b9630757f91b53df377fd4ed4e2d66
SHA256ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
SHA5122de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
-
Filesize
820KB
MD515c6784bdaa973bad5e17ed0861a88a4
SHA198e2c8c58a44f4cfb587663b92180c8316fc1c03
SHA2567a6a08f9bad430b868321b5a5b89605c6d37d119696449f8018985c77d7bace8
SHA512bb16aa70368b8bfe4dc33df7648dad2fc4ffae0c37560fd0684ccb17ac6b6cf1c481732870c3bb19fd13b25e97e7220d1e36b6819af2cad8fc71fd104f3caa52
-
Filesize
427KB
MD5d5d9b110f735c7789fdc453e1574a1ca
SHA1f5d4791322e590d3d3d1ac3fd2d8d3eca093e1d6
SHA256657c215af84f023ab69878ffddcb12ec15d177a84ec2820992f1821639ed2063
SHA51212901c75cc065863f5ecc5137157415f281adc0bfe31f63bfeb4541d6a352f78ee1d80b3b5f6b0d58a215ee81a2cafcd6a1a2553605d339880163ee3fff03a2c
-
Filesize
427KB
MD5d5d9b110f735c7789fdc453e1574a1ca
SHA1f5d4791322e590d3d3d1ac3fd2d8d3eca093e1d6
SHA256657c215af84f023ab69878ffddcb12ec15d177a84ec2820992f1821639ed2063
SHA51212901c75cc065863f5ecc5137157415f281adc0bfe31f63bfeb4541d6a352f78ee1d80b3b5f6b0d58a215ee81a2cafcd6a1a2553605d339880163ee3fff03a2c
-
Filesize
75KB
MD5baa55c842556eda179ff7a363303e179
SHA11764945d5ec4b156629a354fb8f261aa3d9bc3b4
SHA2568296b847f9aaef1ebc0296cf83c1db5b29d17aced1335ee16968d332cbf4854a
SHA512901e9bd28afef9378aa764068281544efe941597bd1f86b6b8f7903e069092489012f86bc7d60cc41ac9276458ced49f6ad04505b791d73ee7080a30d1aaecf5
-
Filesize
75KB
MD5baa55c842556eda179ff7a363303e179
SHA11764945d5ec4b156629a354fb8f261aa3d9bc3b4
SHA2568296b847f9aaef1ebc0296cf83c1db5b29d17aced1335ee16968d332cbf4854a
SHA512901e9bd28afef9378aa764068281544efe941597bd1f86b6b8f7903e069092489012f86bc7d60cc41ac9276458ced49f6ad04505b791d73ee7080a30d1aaecf5