Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
Installer_pswd_12345.rar
Resource
win10v2004-20231215-en
windows10-2004-x64
17 signatures
300 seconds
General
-
Target
Installer_pswd_12345.rar
-
Size
23.9MB
-
MD5
e8f8dfddd6c02017cc81f9d63c8f7ec3
-
SHA1
bc536f36dbcc2c26b2cc8d00d5ed4a9620136c39
-
SHA256
7e98e12c73ba2b3cc31c1d6b3b507e434b5a52fd85c9bcf190c684bd706e281a
-
SHA512
8ae8fa85823744a19e9dcf7c7326abca219e25c95d009e1ae2cb0135f6568c05aa21baf16dad3771cd4d124771f498e2d351d9ba6d168f3b089d809f75ce146d
-
SSDEEP
393216:w8HVqwk8k0hhbYjMd6Nm2uWpFmKwKpB6pHpuQv7erFJksa93F7nQJ6TdcLjIPN3i:bVc8k0UjxNm0CkBuJuQaJVulcoPhi5MA
Score
10/10
Malware Config
Extracted
Family
vidar
Version
7.6
Botnet
8fc1cae2d848b9f26e1bb4d2655aff86
C2
https://t.me/tvrugrats
https://steamcommunity.com/profiles/76561199627279110
Attributes
-
profile_id_v2
8fc1cae2d848b9f26e1bb4d2655aff86
Signatures
-
Detect Vidar Stealer 6 IoCs
resource yara_rule behavioral1/memory/2220-559-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/2220-563-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/2220-565-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/2220-568-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/4624-586-0x0000000005B60000-0x0000000005C60000-memory.dmp family_vidar_v7 behavioral1/memory/2356-590-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 -
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/files/0x0006000000023217-4.dat net_reactor behavioral1/memory/4588-13-0x0000000000010000-0x0000000000420000-memory.dmp net_reactor -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 4588 Installer.exe 4624 Installer.exe -
Loads dropped DLL 2 IoCs
pid Process 4588 Installer.exe 4624 Installer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4588 set thread context of 2220 4588 Installer.exe 100 PID 4624 set thread context of 2356 4624 Installer.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 4296 2220 WerFault.exe 100 3332 4624 WerFault.exe 104 716 2356 WerFault.exe 105 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 7zFM.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 3000 7zFM.exe 3000 7zFM.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 3000 7zFM.exe 3000 7zFM.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3000 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3000 7zFM.exe Token: 35 3000 7zFM.exe Token: SeSecurityPrivilege 3000 7zFM.exe Token: SeDebugPrivilege 4040 taskmgr.exe Token: SeSystemProfilePrivilege 4040 taskmgr.exe Token: SeCreateGlobalPrivilege 4040 taskmgr.exe Token: SeSecurityPrivilege 3000 7zFM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3000 7zFM.exe 3000 7zFM.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 3000 7zFM.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4948 wrote to memory of 3000 4948 cmd.exe 86 PID 4948 wrote to memory of 3000 4948 cmd.exe 86 PID 3000 wrote to memory of 4588 3000 7zFM.exe 94 PID 3000 wrote to memory of 4588 3000 7zFM.exe 94 PID 3000 wrote to memory of 4588 3000 7zFM.exe 94 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4588 wrote to memory of 2220 4588 Installer.exe 100 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105 PID 4624 wrote to memory of 2356 4624 Installer.exe 105
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Installer_pswd_12345.rar1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Installer_pswd_12345.rar"2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7zO8BBC2977\Installer.exe"C:\Users\Admin\AppData\Local\Temp\7zO8BBC2977\Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe4⤵PID:2220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 22125⤵
- Program crash
PID:4296
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2220 -ip 22201⤵PID:2640
-
C:\Users\Admin\Desktop\Installer.exe"C:\Users\Admin\Desktop\Installer.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 20443⤵
- Program crash
PID:716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 9762⤵
- Program crash
PID:3332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4624 -ip 46241⤵PID:3636
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2356 -ip 23561⤵PID:3796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
Filesize
4.1MB
MD5592979cd96d6fd6e8eb5c1052e17da40
SHA1f8595fe8c43f53fcef96c7d0c7052acd6911c8c6
SHA2564d78e8f9f29a96570957acee0c5504ec9c67b97a04892b72ebb31830155b8a81
SHA5128afcdb9b9ccb6ab7472fc8c900234c575e79a00dfdc22ac499badc7e6b415021ba5e95999ad2c3171fa301cfd27d861ad0a2663d9287d0f1be7ed1db6fb2127f
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719