Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 05:17
Static task
static1
General
-
Target
718b5089505fed92d1a44dc0dbeb36dc.exe
-
Size
2.8MB
-
MD5
718b5089505fed92d1a44dc0dbeb36dc
-
SHA1
f4afe14c1b392514350f4495c44f998d3f19128f
-
SHA256
df872b0b7c336241db1a1ff9e83100d6ffb2b898a46c0c7b37a47dcbd002b056
-
SHA512
4c9d292125343b5b7edfe0051454fff957c040fd822e9b9d32f6a94d654dae778ca6fcb1e269adcb83363b3ade2893ae2ae63558f2906185ed67298c841bc807
-
SSDEEP
49152:xcBszOxu3gCpbwOXh+1b4yFjErlsV6SP5iWyZ9KFFdZyZmj9MJ0yEwJ84vLRaBtf:xSizpbwOxKb4y8sVwWyZ0aZw9zCvLUBN
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
vidar
39.7
706
https://shpak125.tumblr.com/
-
profile_id
706
Extracted
smokeloader
pub5
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/4544-110-0x0000000000400000-0x00000000004C0000-memory.dmp family_vidar behavioral2/memory/4544-109-0x0000000000790000-0x000000000082D000-memory.dmp family_vidar behavioral2/memory/4544-133-0x0000000000400000-0x00000000004C0000-memory.dmp family_vidar behavioral2/memory/4544-132-0x0000000000790000-0x000000000082D000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0006000000023223-28.dat aspack_v212_v242 behavioral2/files/0x0006000000023223-31.dat aspack_v212_v242 behavioral2/files/0x0006000000023221-42.dat aspack_v212_v242 behavioral2/files/0x000600000002321f-39.dat aspack_v212_v242 behavioral2/files/0x000600000002321e-38.dat aspack_v212_v242 behavioral2/files/0x0006000000023221-43.dat aspack_v212_v242 -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ipinfo.io 9 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2760 4080 WerFault.exe 90 -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1040 PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe"C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe"1⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS05F14757\setup_install.exe"2⤵PID:4080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe3⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_3.exesonia_3.exe4⤵PID:4544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 5243⤵
- Program crash
PID:2760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe3⤵PID:4996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe3⤵PID:4888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe3⤵PID:5008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe3⤵PID:2196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe3⤵PID:1308
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exesonia_1.exe1⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exe" -a2⤵PID:3340
-
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_5.exesonia_5.exe1⤵PID:1812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 40801⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_7.exesonia_7.exe1⤵PID:5012
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf1⤵PID:1588
-
C:\Windows\SysWOW64\cmd.execmd2⤵PID:2088
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 303⤵
- Runs ping.exe
PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.comTriste.exe.com n3⤵PID:228
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf3⤵PID:4416
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_4.exesonia_4.exe1⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_6.exesonia_6.exe1⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_2.exesonia_2.exe1⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n1⤵PID:3680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
478B
MD5b96b1288ce038869fb15d4353f760613
SHA15a6f01cb0546a6dd4ae1e90279aaa82bdd672b60
SHA2562c1458ecd2cc31a6d798a1c6396926cb99a66481832f774dbdbc19594ff9bd40
SHA51236a72a5cac8b1aaa395d9efc2fc79b4525e408c57cebaaf2f00c1ba5b51bc08ee22e5676055cdcc961197c05e41d020c8d74b0d95426095d1a5b04fb14d3b04e
-
Filesize
7KB
MD52159edf39246faecd80a5bb1638b0212
SHA144930f0fe67b06a73c57ff56976894632890aa6b
SHA2568dec7534543bc983bcd6965539e3d26de768775ac117a108b545a5b4e3bb3614
SHA51249b34aab60b12e98da6f521adf6d4c3ced8245df327a84b8c39d096fc26916ed95ddc212fb05558cf801213e62b5c40cba6cd5cde321f4d23af8bd7e54694a33
-
Filesize
117KB
MD5d0792296bd202a5527cd006cbfaaac7f
SHA11d019787dc775a73864a9c49c6d6fb132d3180e7
SHA256d179558ac3b8c934489cab0ae993383bbbbbf4d41e669c223357e8b5b1a28bf6
SHA51295754132a3e901f90601abaf45a2fe35f80a724594f824448785a8ceaf115b10b68a665a5805b659ad72943d2c567934c1d7343a0bfc21d0ef2a352a355fe6db
-
Filesize
53KB
MD539a8e401eab4c39e8eeb2fc7428b1f44
SHA188cee795f29234fbba35868b4763f8695b8b1acf
SHA256cd523413408b0853983ec7bad1af490e820fde85c62a8b6a6d310c06dd0cbebb
SHA512fcfe5431f84a7e77faa2ef854b17c877f0f67968b9b9c8ce931031128f3ad04638e54703fdd16b3623d9f14543b3af0cda1808ef30aa9c460be40787e1c0806e
-
Filesize
69KB
MD508d2cb0d26667adb72c52b945b5bc5fa
SHA1801e093bdc0b7353a2d3cb11e984d4ca35b1b9b6
SHA256513c6d285f3efc233229878f07003ccd7a07a9df62531983945bb1680b254c8d
SHA512b957f784755f2f8129abe2784476d8db713154755766fed6b6df6538dd808c9e0d13a22a1250310494e8e9c41c6b9e61fb647c6009f51e9d5f922bf0bf9f076f
-
Filesize
112KB
MD53ba04c5932454d38a82cd2d099d16cb7
SHA191d61f75fe22a12d196b76d58cb5f5299802dcc6
SHA25677096744e15c68b2d19301db8f2761aba3c25445d4e9284ec69c3feb2349a6cf
SHA512a3bee17112dc3427631df961d4712926fb186e38242fea7f5988169ffd960b1a24229334c4bd009270619a3dab229a485f96fbe4affa000f738030cef8836781
-
Filesize
79KB
MD5459f502498a0e2d588f6313862ba5c36
SHA139356426505bd9b1db805865f0328bae719622ee
SHA2565155e2b2897084159b7047f468868acee23d83a76e663b8ef4cb62494d0d0f9e
SHA5125f7a6edd526dffeb49e4197402dddf7dbde47fb63ec38461d69b58d8fe3e5e964b16a67eaa67529c327509b8fd3b5a2039b65d4e511cbbe616bdc2e017808df5
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
87KB
MD57ef64cac44c2b7a7530511877c2ce2ac
SHA1946342327b0802e0451668b842d8aa5dd0d66d01
SHA2564e5f2cff0f9b6ec277a6a99aae7b8e53f4e2c076f712244292a3c76afc0df48a
SHA512a6d4d9588a002f39952c1dd44a3585c47df417d625bfcd49d9e2ac10de18eefdaa4ce82e9808c6529296ce1571d7d8a35af319558d1de0301cef210278c8b0bd
-
Filesize
177KB
MD57ef2efd7cbfc2f2cca9fac1e0dd55332
SHA12c52386989d5d1a38f7bb3d12cdd17ec98c10eda
SHA2561ab448584160177d1e2ae51cb7018916d378e1389500c7c3c02379d52f14ec31
SHA5121591878a6345b265635e9619cfdc9b9be787835d3ba42a3b0a96f306c9f79ae16f7688713bda52b74bdf54ca2812ad45f7468d65de5abd1fd2d55b9b204898a3
-
Filesize
434KB
MD556035affc0c490ed8e20bb1934fefe8a
SHA121e62294c929f05a555d9bc018e11f81aad231a3
SHA2561c17a0262f740725c146227f6aedb36afe201f7285a0c2fe009613ecbca10df2
SHA512ce277145bc91098be4743843db7661bf7c59f8d4608f07fd52b5e56c42b6fc28c4b5a396e696ef1c795ce1423f031f43027469ee75d9be0c350b92b19800d4bc
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
290KB
MD5b4a67b6fec9465dd0ec68dd89161871b
SHA196e7f9107283b6bb16a32cfcef54cee69f60fd12
SHA25644bca303abba91a91aae37648d0ed6de6fac5260be3e28eb1a2decd7a6f01aff
SHA512a7f6c7832537e9a693f672416cfe5e1e3de7d2fd13a6078976154f75d542fdaaf00e417e7e65b7e5609c30807ba99e969f6dbc42229c1e6e3ddbfd5aed5f2565
-
Filesize
247KB
MD56d5e0621a15761f96602ea2364452e24
SHA15256f07bf68e9a93e5f74e9665733294ac04e5e8
SHA2564a9d6ac945a91886a961b985f2cc44a685a3b873c1e5327ed600a7be70ae8fa5
SHA512208ebb50d7c1910ebe093c6ad71dcd212563b870ec444cccb5038d2315378f1d0f3c41aefa015f284ed1bf36fd50e7ab80e372d173d1f5fb626a4bd09a631257
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
149KB
MD59c42062a5c40ae976700dd7583c45508
SHA1534fe6221debf96a3443c1cfbfa083b83aca0c2f
SHA2564f3cec8d0f2918bcbbb0e9607f71b528f1d3ad39e0bdbab67ce4af1d89e4e5f8
SHA512463834892734fd8d76b7c9ee63714eb45f6253c1f10505c63fc9897f934c02fe94c14b5b59030517a21f38b7ede16ff100937459bf133bc93ece780eddb3c795
-
Filesize
317KB
MD5b428de5cabd26eb0172e0b62a2dbdbf9
SHA1c5536d8dd412d21f3bb133080b4a07c3bed47694
SHA2566b5c2a9df24511f0d3d94ad6b9632496a6ef4ab623c5e4ef9496765d7ecaf456
SHA51204b9a5bff30e5422f1976d558343a5fa64aee2d93d44f0ab36330f1bce246dd1c4458d52f001d9ebf4d229688f6e2613e8297fbd87e4381914dfb0b044c10506
-
Filesize
51KB
MD54950a478f7536fb3c7a8bc19e0943a86
SHA1d6577c107accba2cd6079ed39cfdde6c230c7223
SHA256cb5139aee40487de0c198826a8ffe762fe3015c5513827459fff84c013db7042
SHA5121fa5284c873475e9aad423115c550d7059545ee1316ba0c0dfed1982d9d2ca185d9f8593333adc823b7cecb9b4c2aab53c099fd7d6ca4a741765fdd2abd04186
-
Filesize
242KB
MD5562bc0e336fd6097e0c7d4361606f491
SHA11bab08ba3a65dd38490611cd24f818af1725cb4a
SHA256962c791b532b209b48265e99ca678b6a125c41be5f1b5870da4fbd95a4fce705
SHA512c35de0f85cd77261b38affe3db53d0c08cf241292eb5fbf416618f56b0fc19369674adf20ee46da47e3c2ee10ba67b1e2bdb2b2e90f7f7a28ce47105e0b59134
-
Filesize
117KB
MD57dd2640ec31132a5496cad4094d5077f
SHA176aa4cdafa07236e3869192d3a253d29e77644ba
SHA25662a55fe169c776651d2c4061597373cc19a9fd89660eb1c6d0a17c0231cb7e18
SHA51283b35f90d02055c738670c7216ef68d6a2abbcb767be034a52df789063eb8771babd1720e47963be05d4b099f73696a5ebda2b170acfa386ed402160d8685095
-
Filesize
85KB
MD57bc11a96437ad6c113c2e180d934606f
SHA1d4659cea7618e273aecebff9b47c4a7fe378b25d
SHA256f43b3477ec51b668730c855523f910e659b7ff15fe800727c47368a41de6588b
SHA512961dd2af9df29c6cdf7fb5c18f644726399ea44aded7837adb5518dd3294f9b5c1bd076737daaa4e5a033a299606b620bc1e6715d185f837171ada7a8feefc8f
-
Filesize
309KB
MD56fb155ae5481a3f897faa60d4de66bf9
SHA1213b33d6efc50746526c0af2edca9fef981334a6
SHA25648923cc30082ac5c4ec2ff1d999464af898fa5e3e15044e21ed8ca2e240c1029
SHA512abdfedcc23ffd8d26b61390e1fd34568a6e0013f1b26caa517ed03458dd6824ec9bd03a9ab011c19e6d7235f58771383b8c5b01e3d3497577d3a0a1f13bd5953
-
Filesize
76KB
MD54691dc7af6d92d63c101746980419198
SHA1aac94b8f5fa01bd1b88b1672a07f037fc47ba5a6
SHA2562c274726a1f8908205b0800e878f58b411063bd6b9e37a72be4073524df1ee01
SHA512cd50a1d0689ab7e446fc0f0578ae82d5e7c1f9538d53ffcd89d6ebc0e2215ae1312121fc4a7694ec321b1ef9df1c2be79612df67b2b7ec63e6e710e2f3c79b68
-
Filesize
342KB
MD572094f09bcf5b945d445ab01b4468476
SHA1c4cecbeb2ed05db3086b66b95c50d3f73bb78426
SHA2566353943593e2feaf8fd0013e930a6197caf4dc240c20abab89266dc8fa6cfa00
SHA5127af85cd8f1162e7c37568da9e736d7dccd0d3f67c44713c2953e5709346df07571f7d1059c1336f6f58ff2579e9208442174798f15fbccecd0fb9f5e982e899d
-
Filesize
63KB
MD521fb1bb5a1a708a252db1429e106fe27
SHA1c897302071cfb5edaec046473326bd704a7de552
SHA256a7567f8fbd8055ca2b0a57acc6431ceedc4cc9f04c51861beaf13c6c646b6004
SHA5129bc2c125d85708f12ccafc5dd9d76def41a3b78ac131285e30f36ba832dd86aca54bba123888d02e36947d231b07b0111e235eb995366a46edf0788c3dfa0df9
-
Filesize
200KB
MD5f18b00637d6ca1b055fd248e1e65479c
SHA1e5f2a7c663c3fa2fedcd7a9d3f9282c8c39e80f9
SHA25651d8a60d5f05f2c0ca012ca79e28995476fcbef648fa5bd171eb967cab2705d7
SHA512297e48ea42846270369cf3845326319a437b641d86a81d6c5b044947c43d73f0049b8ed3201938596a85b97a181fb0605dcc91ceaa65529bb90e6b7f525fea7e
-
Filesize
30KB
MD55349331dde95489cf756cf445ea721a0
SHA13f3bffdbb2d00376a712ff7b500f9d7cf700b556
SHA256f17fc98af0fcf7f28c7d2df49f7ce8252253bcfa47a605c7fa772d2b4392b655
SHA512ff1aca5b78c518ee143b1ac535694d8f87cb8601c3c1129845605b6f3a6853621c4a1ad280d1cb3cfaa78cbf79d52b86b4a0eb6324825b20965cffe9247df4e6