Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
7834184542ed2a3b7c2a80493db69fa2.exe
Resource
win7-20231215-en
General
-
Target
7834184542ed2a3b7c2a80493db69fa2.exe
-
Size
3.3MB
-
MD5
7834184542ed2a3b7c2a80493db69fa2
-
SHA1
3ebafde1b3971df3baa9b1da63f69a7d6ba1ea79
-
SHA256
afa36bb91cf7dfbf9725d0e1f9a9dcb91f46d85bc34ac5be098608a64314c659
-
SHA512
6ec85c728a0eb51b9cde1881600fd7df09147ad40965fe6371f4a8314228a7e9182154927f6f11dcf5aa8f62109b26ba950bb5c3b404239fcfdb1ec2b20ffeaf
-
SSDEEP
98304:xGCvLUBsgRMOjXs7bFLAqFwYVd4mUqZfnUJjVbEQy:xvLUCgRMeEbFcbY1UJxbEv
Malware Config
Extracted
nullmixer
http://hsiens.xyz/
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/756-118-0x0000000002FD0000-0x000000000306D000-memory.dmp family_vidar behavioral2/memory/756-120-0x0000000000400000-0x0000000002D17000-memory.dmp family_vidar behavioral2/memory/756-153-0x0000000002FD0000-0x000000000306D000-memory.dmp family_vidar behavioral2/memory/756-155-0x0000000000400000-0x0000000002D17000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0006000000023209-44.dat aspack_v212_v242 behavioral2/files/0x0006000000023209-42.dat aspack_v212_v242 behavioral2/files/0x0006000000023207-40.dat aspack_v212_v242 behavioral2/files/0x0006000000023206-39.dat aspack_v212_v242 -
Program crash 11 IoCs
pid pid_target Process procid_target 936 5032 WerFault.exe 63 3796 756 WerFault.exe 82 3828 756 WerFault.exe 82 2676 756 WerFault.exe 82 3964 756 WerFault.exe 82 2892 756 WerFault.exe 82 3160 756 WerFault.exe 82 4560 756 WerFault.exe 82 2900 756 WerFault.exe 82 3504 756 WerFault.exe 82 1556 756 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\7834184542ed2a3b7c2a80493db69fa2.exe"C:\Users\Admin\AppData\Local\Temp\7834184542ed2a3b7c2a80493db69fa2.exe"1⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\setup_install.exe"2⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 5803⤵
- Program crash
PID:936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16bb1982aba86a7c9.exe3⤵PID:4928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu162dec4efa.exe3⤵PID:3992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16f6d22fa35bf3c92.exe3⤵PID:220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu161bb50d9cd.exe3⤵PID:2192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16f866d34f070.exe3⤵PID:2168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16049a953333.exe3⤵PID:464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1614722a82b27e0.exe3⤵PID:2348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16082bd37a7f9c41.exe3⤵PID:2068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵PID:2372
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu162dec4efa.exeThu162dec4efa.exe1⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16049a953333.exeThu16049a953333.exe1⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16082bd37a7f9c41.exe"C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16082bd37a7f9c41.exe" -a1⤵PID:4752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5032 -ip 50321⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu1614722a82b27e0.exeThu1614722a82b27e0.exe1⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16f866d34f070.exeThu16f866d34f070.exe1⤵PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 8362⤵
- Program crash
PID:3796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 8562⤵
- Program crash
PID:3828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 8802⤵
- Program crash
PID:2676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 9202⤵
- Program crash
PID:3964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 10082⤵
- Program crash
PID:2892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 10602⤵
- Program crash
PID:3160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 11922⤵
- Program crash
PID:4560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 15442⤵
- Program crash
PID:2900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 15842⤵
- Program crash
PID:3504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 16082⤵
- Program crash
PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16bb1982aba86a7c9.exeThu16bb1982aba86a7c9.exe1⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16f6d22fa35bf3c92.exeThu16f6d22fa35bf3c92.exe1⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu161bb50d9cd.exeThu161bb50d9cd.exe1⤵PID:3272
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7zSC0F14977\Thu16082bd37a7f9c41.exeThu16082bd37a7f9c41.exe1⤵PID:4528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 756 -ip 7561⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 756 -ip 7561⤵PID:2908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 756 -ip 7561⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 756 -ip 7561⤵PID:516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 756 -ip 7561⤵PID:2596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 756 -ip 7561⤵PID:3268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 756 -ip 7561⤵PID:3996
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 756 -ip 7561⤵PID:2960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 756 -ip 7561⤵PID:2380
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2768
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2352
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1144
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4528
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3964
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3456
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
583KB
MD500849e5576fe1d0fbb792d9cd6350fc8
SHA11c5732c05f3838e896d389ecb0723c4f1fd06434
SHA256f478441940a2bffccd5b6ad55b9d5b02af6b256cf6803e2b7a08cbfee7da2c3b
SHA51262390bddfe82340c9470378e7cf06f6d4e879c3add274e7d6e52bbb9859f7dc91cc4fb80a68f46f5d6edc0b454f22c553f204afb13fd34291cd003cdb581aa64
-
Filesize
57KB
MD5cad36a46bed1f492463f30ae2fd1c852
SHA163d5b563da7f1218cfde27445a5ae28a7cad5c6b
SHA2568643a974d69d359895ce491b9db6251ad4b104eff366bc792d6cc39c0cc925f3
SHA512ddec7d16b8723f602ad109ddc746422e92d5a6862d09be2e198e182c668bcd8dd4e51c80847c76c9a05fc9fe2b9ac44547bc709c38e66403ccbfb7a829d75b69
-
Filesize
16KB
MD518d8add88928507eb7c46e9ad138a87f
SHA1db08fac4ce2c024a431d2d322b077232c0267b95
SHA2569e17215382f4c4fb46fac41067ad5dca4b2d70ed3b54dda859a6bc493a5dffea
SHA512912d4aa7c71ab4754f9c03e3637d2d79f1dcc1e60661f6c1d305c8b5966bf2cc8d8db2e1bc761f3b5218fe75abf54d0baa311cf9dbae231751fa19aedbe95ee9
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
172KB
MD5c6d2e2327d6c1843a7a0d9987abaeac7
SHA12b293865213fcf1af5f496efbf4c08fa19c3b7f0
SHA256b5108aef6b50159b8531add8c93fab787a7082f53932a08bc39ec4567175f3d4
SHA5125fed57a5120d0ce40e4454f876e0ca16c038b8fe97d77d76e0382f263e9629e7ed8768f7cfdbf2d5dadebe0baabc8c2b53e04b2968812faa656b865a2f5285f4
-
Filesize
8KB
MD5951aaadbe4e0e39a7ab8f703694e887c
SHA1c555b3a6701ada68cfd6d02c4bf0bc08ff73810e
SHA2565a2934ac710f5995c112da4a32fde9d3de7d9ed3ea0ac5b18a22423d280b5c6d
SHA51256a605bf8a2f2d1a5068f238578f991f44497755297a44e4fc4dad78c2c7d49e52d43979fb0f28a9af0513292da4a747beeb337edd156139a97f597ce23666d9
-
Filesize
154KB
MD5f994e0fe5d9442bb6acc18855fea2f32
SHA1dd5e4830a6c9e67f23c818baadade7ee18e0c72c
SHA2561f415ba6299b928a8c28e3223b4376f9d06673b65f0921edb23c1b63e5518bf4
SHA51238a8af841dbd97c2138c5200d656b25b5eed8738049a7c92f745a810bb15f21f8d3d50c68fe18a9562bb7b0cb81da1d71310c7513eb9de9a7c2f63fb8e9f51c3
-
Filesize
8KB
MD5de595e972bd04cf93648de130f5fb50d
SHA14c05d7c87aa6f95a95709e633f97c715962a52c4
SHA256ed6d502c7c263fd9bd28324f68b287aea158203d0c5154ca07a9bcd059aa2980
SHA5121f4b6c60c78fe9e4a616d6d1a71a9870905ef1aadebd26cf35eac87e10be79db5f7cecdef9d835639b50f7394b6fce9285ff39a8d239768532ba7ed6c7cfdb99
-
Filesize
345KB
MD5a20e9fc9fd2c8204b2246732f6ec1de9
SHA1d0b59aa558b54917ff088b5f2a3042315aab5e75
SHA25666c90cc80209c278a11651e6277780c954b7e71c0d7f49aa633dfe47462a5540
SHA512fe09b6cf2f43ae069368dbf31e0c59fb7b6515559d9c09d62b5707cd17534528ab416b844fa74922461d2d70a5d60f2e20c2a689ca16ceeaa1a9dd60c9a3eecd
-
Filesize
460KB
MD5eca53b96f326c1afb865f94ff66b14d9
SHA1318ee21c54a82bc66092d5048c1313b13ba8866d
SHA256fb1b3db5774ad6bbe132987a64858a9f42ac43ff170677ec046c09ad7bba0223
SHA512120d26422556f68d54e801853f1ce181b902c68dbf188cccab97c5b41769a1442a053feec6cedcec9a296bcea163275e1aff18a03820e2711d3491be31339948
-
Filesize
539KB
MD5d30d99330222962fa2f7ee2c86f355af
SHA1bdbc5a0470895e902818d6ac77e41be428ce8cd4
SHA256d8537fa57074a4298ac02f9522c002b4de219a9db3d7bf0e19e87664ec207f74
SHA512e10c0e869afd4beee78582f401c54ce67fa7bd17f9d38741f7a7c620fed6363aebf330050ffa70b89a9717729eaf29fe106940fc558c8631039edfcf1f82d50b
-
Filesize
305KB
MD50770de2d5a43b479c902827d6cf5bc7c
SHA10659162e61cb5551b384bad473a3041a489cb834
SHA256c1fdbfa8c8c8ce8d57aea7b3cc89250f04e76d75169fce9e5debe8748a639c5c
SHA5126f4808301566c7ec233f1e4e9a52e801b8c885f08da6f0fc80475b0a87b1fb5f7bc6065ccc315c2b39132c18298675d50d39bc5dff6479af96f267e2d1bb4e7b
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
175KB
MD57bd5838f8091724e66aef80dd230b139
SHA1b735f61a6afbb4ed8e03472cbd2f069fbca7f829
SHA2562e443b9270c0843fcc94d6b2f8675ab2daedc0b8ce2374a394296814cbee3a16
SHA512d66a1dee693de6b504d13b1b93ab0bd53f6c5f2cf0a6702aedc3cb58d27c4ee286869ce201296fc8aedbea3a7cae5e01e090933555da3e30597cef24bff97830
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
253KB
MD505a0a7373582510bae11b8f73655d006
SHA1064e6f651c412677a5d1fdbfdaab5665e78ce3b3
SHA25674ce7f9f571b1baeb194258ba9b2dafa32418ac600abf112698429915e476159
SHA512aa5093651f2f00fd7f8514314e0d3e2e2a4c421d33c0c396215fd567ec538b2225ee40cd67e300d9a5e54564d24acbb2ef4b9a8b38a76aaf8b0176c571130675
-
Filesize
196KB
MD51a6e915fff51f9dc648727821d398787
SHA1acbbc208aeb603349a256738351f4f74ac5b6365
SHA256140f9f2e7d9711c9f9f2a468ec8d5a0149bfbee61d7247f6bc9a68f61b46ce9f
SHA51285756d93346ee0eace4b5a6f895cda29f9fddad7c0b13aa12d4243b85398bf3b2c327b7d540868f34dab6f93025038ef2111a931fa578503b55dc69f3f1f76b1
-
Filesize
793KB
MD5dc03a9f7cba10e221d129b5191d3178c
SHA1703fe2da9537e017c7000a6bf0661f05f27ff1af
SHA256e7cc9f1edca9054634afa8a3264644ffd4024ec3d3559bc4d9a127fb8e6ba470
SHA512e992221e80d8c36440f458126198dadfeab81dbcfa7be0d4b67d52add57155282835ed3ce1e9d8d82bf6650a6afbcaeaa8d6fb6fd1e80d9b3126ad2eb30283ee
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82