Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    297s
  • max time network
    257s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 22:28

General

  • Target

    3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe

  • Size

    731KB

  • MD5

    78dfee0a26911ec18d9cae49bcb4c6c0

  • SHA1

    ccd3e0a8dd4626ce87554a2b8fc30659d51e5978

  • SHA256

    3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94

  • SHA512

    174e2144fa1b659ba5683b9b791d094f687a55dca8569c8d0f4aba8c367d99ab320393493733fd18d8f58d950f6e4f7ee158e4b25c0b1a8906575d7c850b0017

  • SSDEEP

    12288:D1Ckm1tt+G2M+yG+Hl1jhGBz/qLn4FL+TOV8Rub2zY33OY8uRreHic3k:BCJtX2/0rhSz/0XUPnOTYrcikk

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199662282318

https://t.me/t8jmhl

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Detected Djvu ransomware 17 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe
    "C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe
      "C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\0a91cea9-4971-42ae-b878-098b448ee0d3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3724
      • C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe
        "C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe
          "C:\Users\Admin\AppData\Local\Temp\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build2.exe
            "C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4908
            • C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build2.exe
              "C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build2.exe"
              6⤵
              • Executes dropped EXE
              PID:2440
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 1864
                7⤵
                • Program crash
                PID:2500
          • C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build3.exe
            "C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4212
            • C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build3.exe
              "C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1884
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:2736
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:5084
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4248
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:3468
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4644
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1384
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:2588
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    3ec812af46b0f111e99b54b129eb94f9

    SHA1

    103c4720315078aadb6d63111eec900a8652fc9c

    SHA256

    64d459714f98144b7a04079efbd965519d8b0bd3ed0021832e3683e79bcd41c6

    SHA512

    1fc8bac653f8f2daaa92014daa05a31cc02abac666c485318b76b379c53f47ddb79ee3495697716a1838b85766b5d71138bc6438844c661792064c22a68b2abc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    0aadce550a862bddbb99248ff0033e67

    SHA1

    e502bc5b090474343621754770af216543b665b0

    SHA256

    7fa9456cc37624b3b9f2bb5dc3c3f005ec3d0cf171b85cb800e17433fcb2c53c

    SHA512

    ab9b8ec2628b02c9922eae2d40b3cd6b81d47a70c9be6d04d2ceedcfde7154582368b327f1fda8ffed27aa0b3d4c2e80038af3f7d02b1cf7720c1e2874c2067b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    392B

    MD5

    6fe9f45f538999c04c09a155a892e09a

    SHA1

    20ee8bd0e96ffe577640c30d6aaa642f1cd91fd4

    SHA256

    d9a966999d8e8a6a179e5671b6702679cb2eb5ecce7637ae060a728ce60fabc2

    SHA512

    62ae32972f9c36cb0ae9bc7f029c359f5469ad0aa1ba73946148b9691c50442af289c347623a4921877fe11e4f58bd83dcffabd9ed6a768847165c06de6ce38f

  • C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build2.exe

    Filesize

    318KB

    MD5

    4fbdcb0ee049b71cb8b9a68bf69f9e0e

    SHA1

    7e36a91700e0a7a8b3a3319cc4b93a1656447096

    SHA256

    31084adb877ef9bcf2143fa2d60ce8860d15af325424b709ad115febe8b96e81

    SHA512

    19aeff14cc2d1c60e99228b089f8c76ed5d7c7ed95ef3adb639b899c258c4cb17982d6de4294506c53dedbbf771f9f26e99094d22d1d05542d3cf86a6b24d283

  • C:\Users\Admin\AppData\Local\0060b85a-6baf-4c98-80d2-18cf7d66b35e\build3.exe

    Filesize

    299KB

    MD5

    41b883a061c95e9b9cb17d4ca50de770

    SHA1

    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

    SHA256

    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

    SHA512

    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

  • C:\Users\Admin\AppData\Local\0a91cea9-4971-42ae-b878-098b448ee0d3\3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94.exe

    Filesize

    731KB

    MD5

    78dfee0a26911ec18d9cae49bcb4c6c0

    SHA1

    ccd3e0a8dd4626ce87554a2b8fc30659d51e5978

    SHA256

    3414774186b164063e7f83a550f360bd034ab85c94917aec2e325e3c23b38f94

    SHA512

    174e2144fa1b659ba5683b9b791d094f687a55dca8569c8d0f4aba8c367d99ab320393493733fd18d8f58d950f6e4f7ee158e4b25c0b1a8906575d7c850b0017

  • memory/880-97-0x00000000008BA000-0x00000000008CA000-memory.dmp

    Filesize

    64KB

  • memory/1168-20-0x0000000002270000-0x0000000002311000-memory.dmp

    Filesize

    644KB

  • memory/1384-160-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1884-66-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1884-71-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1884-73-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1884-74-0x0000000000410000-0x00000000004D5000-memory.dmp

    Filesize

    788KB

  • memory/2028-35-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-50-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-27-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-28-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-32-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-34-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-19-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-58-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-21-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2028-22-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2272-1-0x0000000000690000-0x0000000000729000-memory.dmp

    Filesize

    612KB

  • memory/2272-2-0x00000000022A0000-0x00000000023BB000-memory.dmp

    Filesize

    1.1MB

  • memory/2440-49-0x0000000000400000-0x0000000000648000-memory.dmp

    Filesize

    2.3MB

  • memory/2440-51-0x0000000000400000-0x0000000000648000-memory.dmp

    Filesize

    2.3MB

  • memory/2440-44-0x0000000000400000-0x0000000000648000-memory.dmp

    Filesize

    2.3MB

  • memory/2440-62-0x0000000000400000-0x0000000000648000-memory.dmp

    Filesize

    2.3MB

  • memory/2528-179-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2588-178-0x0000000000960000-0x0000000000A60000-memory.dmp

    Filesize

    1024KB

  • memory/4176-4-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4176-15-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4176-6-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4176-5-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4176-3-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4212-69-0x00000000001F0000-0x00000000001F4000-memory.dmp

    Filesize

    16KB

  • memory/4212-67-0x0000000000860000-0x0000000000960000-memory.dmp

    Filesize

    1024KB

  • memory/4248-120-0x0000000000880000-0x0000000000980000-memory.dmp

    Filesize

    1024KB

  • memory/4644-151-0x00000000009C0000-0x0000000000AC0000-memory.dmp

    Filesize

    1024KB

  • memory/4908-47-0x00000000024B0000-0x00000000024E5000-memory.dmp

    Filesize

    212KB

  • memory/4908-45-0x0000000000900000-0x0000000000A00000-memory.dmp

    Filesize

    1024KB