Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 06:47

General

  • Target

    180e2b2f71e67f5adc9cb8f36f3dfa31.exe

  • Size

    754KB

  • MD5

    180e2b2f71e67f5adc9cb8f36f3dfa31

  • SHA1

    719f39ebafc712d9f5e70483e88a94a88e4cd70c

  • SHA256

    bf586230320fd2bb84f1173e01abbe304392579b55e1f321ce5f60fec7087f14

  • SHA512

    d546df5da63c42b3b38641dd24fa54c57e49866a11b80329ea177225c9d3475f919f2c866a773bae0d9a54f33ecc4a9152be27ea0babc8d972447f5f3ead6cf4

  • SSDEEP

    12288:CST5ud6X5jcadzHY3IATiMMAMhhckbEqS9ydqhiuSYmNhblzmgmj33zhn:FKCjvUslbES4iuE/lnmLNn

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test2/get.php

Attributes
  • extension

    .looy

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0858PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.4

Botnet

95002d0a9d65ffced363a8f35f42a529

C2

https://steamcommunity.com/profiles/76561199654112719

https://t.me/r2d0s

Attributes
  • profile_id_v2

    95002d0a9d65ffced363a8f35f42a529

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0

Signatures

  • Detect Vidar Stealer 6 IoCs
  • Detected Djvu ransomware 18 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe
    "C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe
      "C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\ce006514-78c3-4aa4-a826-23fbff332cff" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2804
      • C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe
        "C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe
          "C:\Users\Admin\AppData\Local\Temp\180e2b2f71e67f5adc9cb8f36f3dfa31.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4504
          • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build2.exe
            "C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2080
            • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build2.exe
              "C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build2.exe"
              6⤵
              • Executes dropped EXE
              PID:2576
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2176
                7⤵
                • Program crash
                PID:1168
          • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build3.exe
            "C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4772
            • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build3.exe
              "C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2792
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:2292
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2576 -ip 2576
    1⤵
      PID:544
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3216
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          3⤵
          • Creates scheduled task(s)
          PID:2684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      1KB

      MD5

      dba737766caa750561a7d1ef422724cb

      SHA1

      c0c4be5ea552100f6d656d3f955506756d2a6ba8

      SHA256

      5709b340759d61e0be8d4258b9ba874f6de6e02e9519e6bb5ff32cef2f4b5d16

      SHA512

      4e3304b27e1382e71f2f9a0642acba8538fa71805347c00f731e9ed7be339e1a970bc204ebadef609c8dc64ce2e9e555480b36e5dfb4a4e3ee97c687754f8bfa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

      Filesize

      724B

      MD5

      8202a1cd02e7d69597995cabbe881a12

      SHA1

      8858d9d934b7aa9330ee73de6c476acf19929ff6

      SHA256

      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

      SHA512

      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

      Filesize

      410B

      MD5

      d13c9a069e19e319aa36a68b1337573f

      SHA1

      4b7c2c02b8c39b049996b864751e9464ef6ff401

      SHA256

      3b85386d16ba2b05182b54d0ee3dcb3ade4d69ff4aafd99e0ec10638571a97bc

      SHA512

      c039068d2cea5d723a310452ad10b79a4a50124d4f23c84133b72e4c5f68469a3b9430ddb6ca1e5e5eaa381310dea274e8fae066e41a05f78cfedfaa2e418b54

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

      Filesize

      392B

      MD5

      5ef5a5fd3b797885bcf2a8974b5fd5c4

      SHA1

      d106f6ac2e10ed574a02d2a89ffc02165754814e

      SHA256

      deeab4901e63bebb7c23c53921856649cf46acc2e7400ec7b18aa84364db9033

      SHA512

      daa5419bfbb5ffd87b18dc36add66f2677759d221ca3b491e195cc30b0c621c2969ef5143cb5c3dbb4f49d2f38c9008dacea3d73080386248be16ea7896f0d24

    • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build2.exe

      Filesize

      342KB

      MD5

      26544ec9adc1864de80222fb0b38e6dc

      SHA1

      2ca52374bb468a8e2c10d39b64d1e4e9d7d0adee

      SHA256

      03b38ccf2c3145839d5ea7c5ccec609de3a67a7e435e94ca05c8c080d9df4411

      SHA512

      f7eb99db8eb4df15ac252bd4523a407b32089d22c435303499bc3813ecdf1ffbc8483417bb97e901fba3e3f36c6e9e47eb30fa78b7c461d3f78f5d5899fae730

    • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build3.exe

      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Local\102c75c6-2ca0-419b-836d-6b72f505c339\build3.exe

      Filesize

      192KB

      MD5

      5c883ef6d1ad03173f30db4fc691d0a7

      SHA1

      4007444885a94ad3092e287a196249bc6c1301ef

      SHA256

      b1e0b896d1cdbe0cfe16d1d6f604640e2b22aeb144eb411086fa31d2073f316e

      SHA512

      125b18de452ee08cc42806f15864bb5429403ca696e385d5fb32d87cde841629e12f0d64c308c8ff7444d36c5da71e75fdc66733418bc886cad6a6e9ba7eb816

    • C:\Users\Admin\AppData\Local\ce006514-78c3-4aa4-a826-23fbff332cff\180e2b2f71e67f5adc9cb8f36f3dfa31.exe

      Filesize

      754KB

      MD5

      180e2b2f71e67f5adc9cb8f36f3dfa31

      SHA1

      719f39ebafc712d9f5e70483e88a94a88e4cd70c

      SHA256

      bf586230320fd2bb84f1173e01abbe304392579b55e1f321ce5f60fec7087f14

      SHA512

      d546df5da63c42b3b38641dd24fa54c57e49866a11b80329ea177225c9d3475f919f2c866a773bae0d9a54f33ecc4a9152be27ea0babc8d972447f5f3ead6cf4

    • memory/1016-6-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1016-5-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1016-4-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1016-3-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/1016-15-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/2080-79-0x0000000002EF0000-0x0000000002F21000-memory.dmp

      Filesize

      196KB

    • memory/2080-49-0x0000000002EF0000-0x0000000002F21000-memory.dmp

      Filesize

      196KB

    • memory/2080-48-0x0000000002F30000-0x0000000003030000-memory.dmp

      Filesize

      1024KB

    • memory/2176-107-0x0000000000980000-0x0000000000A80000-memory.dmp

      Filesize

      1024KB

    • memory/2576-75-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

    • memory/2576-53-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

    • memory/2576-47-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

    • memory/2576-52-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

    • memory/2792-83-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/2792-88-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/2792-90-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/3064-18-0x0000000002240000-0x00000000022D4000-memory.dmp

      Filesize

      592KB

    • memory/3216-110-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/3372-2-0x00000000023F0000-0x000000000250B000-memory.dmp

      Filesize

      1.1MB

    • memory/3372-1-0x0000000000770000-0x0000000000807000-memory.dmp

      Filesize

      604KB

    • memory/4504-35-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-68-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-77-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-34-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-32-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-28-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-27-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-22-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-21-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4504-20-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4772-85-0x00000000009F0000-0x0000000000AF0000-memory.dmp

      Filesize

      1024KB

    • memory/4772-86-0x0000000000900000-0x0000000000904000-memory.dmp

      Filesize

      16KB