Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 13:26
Behavioral task
behavioral1
Sample
90761d7a9ac41a9602b7094663921f42.exe
Resource
win7-20231215-en
General
-
Target
90761d7a9ac41a9602b7094663921f42.exe
-
Size
5.0MB
-
MD5
90761d7a9ac41a9602b7094663921f42
-
SHA1
eb2357f00f922719f261a97ca1f4350a7c3d168a
-
SHA256
29f281cac20928673a516da70a1495cf217aea2dc386d7719de2df7c2053fb9d
-
SHA512
2e5981e6a38b2b2b4f036f3056c818834160018d97a9393f7d461890fe51f0030ac2c3322c2421abc707e20ee01392bbf3058d9bba77e95ab7facfbed55cdda0
-
SSDEEP
49152:bWgm+tevgmkSG2srQHYNGFF0v9AUKoXjuqqn0F2TmoGwHP2px3V:bWgmsevgm+QQFvDXFqXRDOrV
Malware Config
Signatures
-
Detect Vidar Stealer 8 IoCs
resource yara_rule behavioral1/memory/2704-25-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-27-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-29-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-33-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-36-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-38-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-39-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral1/memory/2704-165-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 -
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2336-0-0x00000000003D0000-0x00000000008CE000-memory.dmp family_zgrat_v1 -
Loads dropped DLL 1 IoCs
pid Process 2336 90761d7a9ac41a9602b7094663921f42.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2336 set thread context of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 -
Program crash 1 IoCs
pid pid_target Process procid_target 2440 2704 WerFault.exe 27 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2336 wrote to memory of 2704 2336 90761d7a9ac41a9602b7094663921f42.exe 27 PID 2704 wrote to memory of 2440 2704 RegAsm.exe 33 PID 2704 wrote to memory of 2440 2704 RegAsm.exe 33 PID 2704 wrote to memory of 2440 2704 RegAsm.exe 33 PID 2704 wrote to memory of 2440 2704 RegAsm.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\90761d7a9ac41a9602b7094663921f42.exe"C:\Users\Admin\AppData\Local\Temp\90761d7a9ac41a9602b7094663921f42.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 14643⤵
- Program crash
PID:2440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719