Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
!!Full_SeTup_2024_As_p@ssKey/Setup.exe
Resource
win10v2004-20240419-en
General
-
Target
!!Full_SeTup_2024_As_p@ssKey/Setup.exe
-
Size
8.5MB
-
MD5
98169506fec94c2b12ba9930ad704515
-
SHA1
bce662a9fb94551f648ba2d7e29659957fd6a428
-
SHA256
9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
-
SHA512
7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
-
SSDEEP
196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK
Malware Config
Extracted
vidar
84499a356d0590b54b39de776246dd47
https://hypaton.xyz
https://steamcommunity.com/profiles/76561199677575543
https://t.me/snsb82
-
profile_id_v2
84499a356d0590b54b39de776246dd47
-
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/4108-45-0x0000000000C80000-0x00000000013D2000-memory.dmp family_vidar_v7 behavioral1/memory/4108-54-0x0000000000C80000-0x00000000013D2000-memory.dmp family_vidar_v7 behavioral1/memory/4108-55-0x0000000000C80000-0x00000000013D2000-memory.dmp family_vidar_v7 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4304 set thread context of 3352 4304 Setup.exe 85 -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ThreadingModel = "Both" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32 Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll" Setup.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1448 4108 WerFault.exe 96 -
Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3} Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ShellFolder Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ShellFolder\Attributes = "4034920525" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ShellFolder\FolderValueFlags = "41" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ShellFolder\SortOrderIndex = "0" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\DescriptionID = "3" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\DefaultIcon\ = "%SystemRoot%\\system32\\imageres.dll,-184" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32\ThreadingModel = "Both" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\Instance Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\Instance\InitPropertyBag\TargetKnownFolder = "{7d83ee9b-2244-4e70-b1f5-5393042af1e4}" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\DefaultIcon Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InProcServer32 Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\Instance\InitPropertyBag Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\System.IsPinnedToNameSpaceTree = "1" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\Instance\InitPropertyBag\Attributes = "17" Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4304 Setup.exe 4304 Setup.exe 3352 netsh.exe 3352 netsh.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4304 Setup.exe 3352 netsh.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4304 wrote to memory of 3352 4304 Setup.exe 85 PID 4304 wrote to memory of 3352 4304 Setup.exe 85 PID 4304 wrote to memory of 3352 4304 Setup.exe 85 PID 4304 wrote to memory of 3352 4304 Setup.exe 85 PID 3352 wrote to memory of 4108 3352 netsh.exe 96 PID 3352 wrote to memory of 4108 3352 netsh.exe 96 PID 3352 wrote to memory of 4108 3352 netsh.exe 96 PID 3352 wrote to memory of 4108 3352 netsh.exe 96 PID 3352 wrote to memory of 4108 3352 netsh.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\!!Full_SeTup_2024_As_p@ssKey\Setup.exe"C:\Users\Admin\AppData\Local\Temp\!!Full_SeTup_2024_As_p@ssKey\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 18724⤵
- Program crash
PID:1448
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4108 -ip 41081⤵PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c8d938e753d505767f114a5523bc9bf2
SHA1354f3d0d0c916be2f6a463b63901a67a5acb4c82
SHA2563b9cfc3dfa185acde675ec8594e4495a4015c65a274413a67a91482deaeb0489
SHA5128675851b1246a6c037e073cc33505dfcfed2891fcd1b803037f14412cbc9b495e3e36d8ab94cc84c2eb619d6ed8645629883719f997953120fa6f96578769a20