Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    296s
  • max time network
    302s
  • platform
    windows10-1703_x64
  • resource
    win10-20240319-en
  • resource tags

    arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/03/2024, 22:25

General

  • Target

    3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe

  • Size

    733KB

  • MD5

    4450052e0f522f0f247909aa59f9d1de

  • SHA1

    1887e5d76ad71521cb34af42a24d50078fa3f189

  • SHA256

    3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e

  • SHA512

    e135c7659c7e90b9f783115ab8cd474406615bce395b519d616f343749227d42742f21700eee8292e2436e085ec2488982afd4a677aea46fffc88dfe7131b18d

  • SSDEEP

    12288:vgXWEcWtmrTVenOSPAc6L+QqbEEfuo5tRoLTgk9EQie1+DrfIDtyVcOw:vgrNtspkOqQqbHuo3in59EQieM4t4c3

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test2/get.php

Attributes
  • extension

    .looy

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0858PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.6

Botnet

5739ef2bbcd39fcd59c5746bfe4238c5

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes
  • profile_id_v2

    5739ef2bbcd39fcd59c5746bfe4238c5

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Detected Djvu ransomware 17 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe
    "C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe
      "C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\d6c96218-799f-44aa-a156-17d210ef76c4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3832
      • C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe
        "C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe
          "C:\Users\Admin\AppData\Local\Temp\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1340
          • C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build2.exe
            "C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1632
            • C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build2.exe
              "C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build2.exe"
              6⤵
              • Executes dropped EXE
              PID:4300
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 2052
                7⤵
                • Program crash
                PID:4268
          • C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build3.exe
            "C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build3.exe
              "C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4664
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:440
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3376
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:2088
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4884
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4568
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1648
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:5004
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    2a789d6b366b95c47c2e68c27f863f81

    SHA1

    1b123bd94179f5b8746bc960691ddb9546855e05

    SHA256

    ba4990d90cdd27ce932e39c10e178659436aeb5a290faa47f4825da9eca6bc94

    SHA512

    027180aabc65ae3ca35f83161b11d289d87af854656483ac2cf703d94f695c4d5bce0fce1901278ab4cbfc985c9b9aa1f455c889913834c4b1734a365c7f8e3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    4d134803b71f678967c96e119a8af8cf

    SHA1

    d677d7035d5898771e398fc50736de2c4ef1a298

    SHA256

    1583fa1f0ceabef07cc979f31dc812c5a9edbf9d77edd0e86ec786766533ebfb

    SHA512

    9bb24c80b355556560912a415e5caac61f7681ead39e572b95b72f55c048d61919163fe039befce94922da585d4b6ff50c89ac6a10b5eb035e6a7069a9ceb233

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    392B

    MD5

    8f8dce82d5884bdf7ba3278a2bd08d3d

    SHA1

    8560c431469b223cee558b09709418c9f9b15f13

    SHA256

    cb339cb9d5502e731acb6bce860a808fc4fec69b3e88f83a83348ce3c4e1742b

    SHA512

    b9b61aad593c09f787031e8d412cc0f1a5c408c3c8db94f3754cfb65ab380a529ebf428e90740ba427b955058c4fedf40842f044c373e50c83ea7c5ad3e67f7a

  • C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build2.exe

    Filesize

    277KB

    MD5

    8dae8b6a6be6e3527183594d1c26a2d3

    SHA1

    b87e40cee60869a36e79c88c8a3a34baf0bc4889

    SHA256

    afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

    SHA512

    0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e

  • C:\Users\Admin\AppData\Local\6edfca0b-5e9f-4f91-8d72-ac5c86b3673d\build3.exe

    Filesize

    299KB

    MD5

    41b883a061c95e9b9cb17d4ca50de770

    SHA1

    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

    SHA256

    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

    SHA512

    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

  • C:\Users\Admin\AppData\Local\d6c96218-799f-44aa-a156-17d210ef76c4\3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e.exe

    Filesize

    733KB

    MD5

    4450052e0f522f0f247909aa59f9d1de

    SHA1

    1887e5d76ad71521cb34af42a24d50078fa3f189

    SHA256

    3246d59d984c4764869288a7216b82403f76ba960ee0bb7b7caff13ddb4b170e

    SHA512

    e135c7659c7e90b9f783115ab8cd474406615bce395b519d616f343749227d42742f21700eee8292e2436e085ec2488982afd4a677aea46fffc88dfe7131b18d

  • memory/228-2-0x00000000022B0000-0x00000000023CB000-memory.dmp

    Filesize

    1.1MB

  • memory/228-1-0x0000000000740000-0x00000000007E2000-memory.dmp

    Filesize

    648KB

  • memory/1340-37-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-36-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-24-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-22-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-72-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-23-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-38-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-29-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-30-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1340-34-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1580-17-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1580-5-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1580-6-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1580-4-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1580-3-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1632-48-0x0000000000780000-0x0000000000880000-memory.dmp

    Filesize

    1024KB

  • memory/1632-50-0x0000000002060000-0x0000000002091000-memory.dmp

    Filesize

    196KB

  • memory/1676-77-0x00000000008E0000-0x00000000008E4000-memory.dmp

    Filesize

    16KB

  • memory/1676-75-0x0000000000A80000-0x0000000000B80000-memory.dmp

    Filesize

    1024KB

  • memory/2088-125-0x0000000000990000-0x0000000000A90000-memory.dmp

    Filesize

    1024KB

  • memory/4300-53-0x0000000000400000-0x0000000000644000-memory.dmp

    Filesize

    2.3MB

  • memory/4300-63-0x0000000000400000-0x0000000000644000-memory.dmp

    Filesize

    2.3MB

  • memory/4300-54-0x0000000000400000-0x0000000000644000-memory.dmp

    Filesize

    2.3MB

  • memory/4300-49-0x0000000000400000-0x0000000000644000-memory.dmp

    Filesize

    2.3MB

  • memory/4388-103-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

    Filesize

    1024KB

  • memory/4568-152-0x00000000009C0000-0x0000000000AC0000-memory.dmp

    Filesize

    1024KB

  • memory/4612-184-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4664-80-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4664-82-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4664-76-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4664-83-0x0000000000410000-0x00000000004D5000-memory.dmp

    Filesize

    788KB

  • memory/5004-179-0x0000000000B50000-0x0000000000C50000-memory.dmp

    Filesize

    1024KB

  • memory/5104-21-0x00000000021B0000-0x000000000224F000-memory.dmp

    Filesize

    636KB