Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe
Resource
win7-20231215-en
General
-
Target
640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe
-
Size
4.7MB
-
MD5
64a534242627bc0dfc8bdb32f49a4d59
-
SHA1
8cec059ca3eb9b8a77775c021c155f00c9d18395
-
SHA256
640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8a
-
SHA512
b8a677769ade9740f63cb163b69bcaed61583185f9a62fb2e672123b8445c90fafbc2036bbb64f6f301390210d06dda607b12b783ba1155666043d3534405152
-
SSDEEP
98304:yXmTuJH5FPywbQ/zpgXGfVfhYB726W9B/VIPGbgKVZ1G:yXmqRPYppdfZfVIPEG
Malware Config
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
gcleaner
194.145.227.161
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
nullmixer
http://hsiens.xyz/
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
OnlyLogger payload 2 IoCs
resource yara_rule behavioral2/memory/5272-290-0x0000000001F70000-0x0000000001F9F000-memory.dmp family_onlylogger behavioral2/memory/5272-293-0x0000000000400000-0x0000000001D83000-memory.dmp family_onlylogger -
Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/2148-254-0x0000000003A90000-0x0000000003B2D000-memory.dmp family_vidar behavioral2/memory/2148-266-0x0000000000400000-0x0000000001DCC000-memory.dmp family_vidar behavioral2/memory/2148-316-0x0000000000400000-0x0000000001DCC000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x000a000000023129-57.dat aspack_v212_v242 behavioral2/files/0x00020000000228cb-53.dat aspack_v212_v242 behavioral2/files/0x00040000000227d9-51.dat aspack_v212_v242 -
resource yara_rule behavioral2/memory/5596-268-0x0000000000400000-0x000000000055D000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 27 IoCs
pid pid_target Process procid_target 1836 4028 WerFault.exe 5952 5272 WerFault.exe 43 6016 2148 WerFault.exe 6064 5272 WerFault.exe 43 5860 2148 WerFault.exe 1836 2148 WerFault.exe 5236 5272 WerFault.exe 43 220 2252 WerFault.exe 35 1808 2148 WerFault.exe 5616 5272 WerFault.exe 43 3980 2148 WerFault.exe 884 5272 WerFault.exe 43 2520 2148 WerFault.exe 3300 5272 WerFault.exe 43 5220 3628 WerFault.exe 4792 5272 WerFault.exe 43 4040 2148 WerFault.exe 5852 5272 WerFault.exe 43 5984 2148 WerFault.exe 5980 2148 WerFault.exe 3660 2148 WerFault.exe 6120 2148 WerFault.exe 4348 2148 WerFault.exe 5240 2148 WerFault.exe 100 3572 2148 WerFault.exe 100 1540 2148 WerFault.exe 100 1296 5272 WerFault.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe"C:\Users\Admin\AppData\Local\Temp\640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe"1⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\setup_install.exe"3⤵PID:4028
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun047089ae5093c14.exeSun047089ae5093c14.exe1⤵PID:2252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 3762⤵
- Program crash
PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun041024b30f4a0.exeSun041024b30f4a0.exe1⤵PID:3100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 5921⤵
- Program crash
PID:1836
-
C:\Users\Admin\AppData\Local\Temp\chrome3.exe"C:\Users\Admin\AppData\Local\Temp\chrome3.exe"1⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\PBrowFile594.exe"C:\Users\Admin\AppData\Local\Temp\PBrowFile594.exe"1⤵PID:1552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3628 -ip 36281⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\jzhang-game.exe"C:\Users\Admin\AppData\Local\Temp\jzhang-game.exe"1⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵PID:5272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 7922⤵
- Program crash
PID:5952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 8282⤵
- Program crash
PID:6064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 9402⤵
- Program crash
PID:5236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 9722⤵
- Program crash
PID:5616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 11082⤵
- Program crash
PID:884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 11162⤵
- Program crash
PID:3300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 12042⤵
- Program crash
PID:4792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 13762⤵
- Program crash
PID:5852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 12802⤵
- Program crash
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2148 -ip 21481⤵PID:5792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5272 -ip 52721⤵PID:5924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2148 -ip 21481⤵PID:5988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 8441⤵
- Program crash
PID:6016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5272 -ip 52721⤵PID:6044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2148 -ip 21481⤵PID:3660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 8241⤵
- Program crash
PID:5860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 8441⤵
- Program crash
PID:1836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5272 -ip 52721⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\CmdCalc.exe"C:\Users\Admin\AppData\Local\Temp\CmdCalc.exe"1⤵PID:5596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2252 -ip 22521⤵PID:5528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5272 -ip 52721⤵PID:3472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 8961⤵
- Program crash
PID:1808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2148 -ip 21481⤵PID:4416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2148 -ip 21481⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 10401⤵
- Program crash
PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5272 -ip 52721⤵PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2148 -ip 21481⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 10841⤵
- Program crash
PID:2520
-
C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"1⤵PID:5448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5272 -ip 52721⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 14961⤵
- Program crash
PID:5220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5272 -ip 52721⤵PID:4176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2148 -ip 21481⤵PID:5760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 14921⤵
- Program crash
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun0473a3260232e1c.exeSun0473a3260232e1c.exe2⤵PID:3544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5272 -ip 52721⤵PID:5832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2148 -ip 21481⤵PID:5880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 15201⤵
- Program crash
PID:5984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2148 -ip 21481⤵PID:5992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 17801⤵
- Program crash
PID:5980
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"1⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"1⤵PID:3532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2148 -ip 21481⤵PID:2976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 15641⤵
- Program crash
PID:3660
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun04f8c94eea9cb9.exeSun04f8c94eea9cb9.exe1⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2148 -ip 21481⤵PID:3436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 15161⤵
- Program crash
PID:6120
-
C:\Users\Admin\AppData\Local\Temp\is-G6LFD.tmp\Sun04637c853e.tmp"C:\Users\Admin\AppData\Local\Temp\is-G6LFD.tmp\Sun04637c853e.tmp" /SL5="$501F6,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun04637c853e.exe"1⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun04dac6d7a0.exeSun04dac6d7a0.exe1⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun043e60205beb4f.exeSun043e60205beb4f.exe1⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2148 -ip 21481⤵PID:5940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 17401⤵
- Program crash
PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4028 -ip 40281⤵PID:3980
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun043bec3ec581a9.exeSun043bec3ec581a9.exe1⤵PID:2148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 15162⤵
- Program crash
PID:5240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 15842⤵
- Program crash
PID:3572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 10282⤵
- Program crash
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun045118d0261f811cc.exeSun045118d0261f811cc.exe1⤵PID:3416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2148 -ip 21481⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\7zSC3E54777\Sun04637c853e.exeSun04637c853e.exe1⤵PID:3420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2148 -ip 21481⤵PID:5332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun04f8c94eea9cb9.exe1⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun04dac6d7a0.exe1⤵PID:1612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun0473a3260232e1c.exe1⤵PID:4040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun043e60205beb4f.exe1⤵PID:2656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun04637c853e.exe1⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun043bec3ec581a9.exe1⤵PID:1448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun041024b30f4a0.exe1⤵PID:4864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun047089ae5093c14.exe1⤵PID:4732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun045118d0261f811cc.exe1⤵PID:2824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵PID:944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5272 -ip 52721⤵PID:5980
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:668
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
2.1MB
MD56fcbdf089f6e1a022c5f9f502bc13f9d
SHA18a7ad450e6b460077938e865639be2b5270a3a12
SHA256c7bcd2cda5301ca683dc039092337fc0bfdf30abc43b1ea3af4b9063c8acc0c0
SHA512810c432f4504f96a3817aa86b99f1a3cf11fe1a17ca25a117999b21b5815fbde810afd6eb99e620ce009e0e65b844c1b40978f8654b73e06828bcb2f104c222b
-
Filesize
92KB
MD5d772d6902200f5d4599a9b27d0d8f9e6
SHA1564eefb3fabe655b2fb51f492959b158cb20e12d
SHA2567bf11639663306b53a7fe0e3826d12f03e1dda7b1fb3abaa758e3281d35f8e17
SHA5126682d79a013129aceba9cde75a82f0444a28d30bfbd1c4656d7e3774b469283027a780362657c908c991f9b5939db32792e6713a323667ab763a95b3f3e23d36
-
Filesize
1.1MB
MD50b0f9e49243e86bbabe15be6b005e868
SHA1738a38a38e469d7f046d1ed2a414043eb1870b23
SHA2565e7538fe27e9d43c1852e64999ad5fc05f55053350b24ebad10e20e7ad67d22b
SHA512206a7f18fc235b6ebef9d2a09b6d8cae61b2015e99d0643efcde6debba0f5853fa0ab6900aba0dc5c1ffb95d773912c3cd6b4d79c2865b083d18664c52d0c3d9