Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
use_7788_tо_оpen (3)/Setup.exe
Resource
win10v2004-20240419-en
General
-
Target
use_7788_tо_оpen (3)/Setup.exe
-
Size
8.5MB
-
MD5
98169506fec94c2b12ba9930ad704515
-
SHA1
bce662a9fb94551f648ba2d7e29659957fd6a428
-
SHA256
9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
-
SHA512
7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
-
SSDEEP
196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK
Malware Config
Extracted
vidar
e2fbe3ae2d0b282d162bb6c860980518
https://hypaton.xyz
https://steamcommunity.com/profiles/76561199677575543
https://t.me/snsb82
-
profile_id_v2
e2fbe3ae2d0b282d162bb6c860980518
-
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/4652-45-0x0000000000E00000-0x0000000001553000-memory.dmp family_vidar_v7 behavioral1/memory/4652-54-0x0000000000E00000-0x0000000001553000-memory.dmp family_vidar_v7 behavioral1/memory/4652-55-0x0000000000E00000-0x0000000001553000-memory.dmp family_vidar_v7 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3432 set thread context of 3676 3432 Setup.exe 87 -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32 Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ = "C:\\Windows\\System32\\mshtml.dll" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ThreadingModel = "Apartment" Setup.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2468 4652 WerFault.exe 97 -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3} Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ = "IntDitherer Class" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32 Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ = "C:\\Windows\\System32\\mshtml.dll" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ThreadingModel = "Apartment" Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3432 Setup.exe 3432 Setup.exe 3676 netsh.exe 3676 netsh.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3432 Setup.exe 3676 netsh.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3432 wrote to memory of 3676 3432 Setup.exe 87 PID 3432 wrote to memory of 3676 3432 Setup.exe 87 PID 3432 wrote to memory of 3676 3432 Setup.exe 87 PID 3432 wrote to memory of 3676 3432 Setup.exe 87 PID 3676 wrote to memory of 4652 3676 netsh.exe 97 PID 3676 wrote to memory of 4652 3676 netsh.exe 97 PID 3676 wrote to memory of 4652 3676 netsh.exe 97 PID 3676 wrote to memory of 4652 3676 netsh.exe 97 PID 3676 wrote to memory of 4652 3676 netsh.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\use_7788_tо_оpen (3)\Setup.exe"C:\Users\Admin\AppData\Local\Temp\use_7788_tо_оpen (3)\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:4652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 16724⤵
- Program crash
PID:2468
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4652 -ip 46521⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5469b0eb814d608601cdd54b4f08b0ed0
SHA122574dc7738346763b21163c4edb027490df433e
SHA2565eb30a5ada9baedd65e8903b16663165f468d964c59f7db0ad405e39f68ef7cb
SHA512ed3d07779d487aa2ae74640dfec6d444b798aa91717d95349697aff5dc73b0e38d08a89c28a2e952afc7d30d5bead8f4771244ff0cd6ca0e095a6253c7783933