Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 23:18

General

  • Target

    Setup.exe

  • Size

    2.0MB

  • MD5

    e3d5b216c73c93fa570be1776d81da90

  • SHA1

    dc66ddc93ed23831977a6dcf08a7b27786e0d169

  • SHA256

    b27f2ffda5054c513a5f0dc3bbdc067c78a82f2be201334703f1b45e477cd067

  • SHA512

    45a1d097a9e3f164c8b503f4aee0d3afcb747a57f0058c6f0f243f01739a7ecb5636095a72b04a38c0dd6cb0c3f8c12ccafdfd0051dc81f99911f657f9236669

  • SSDEEP

    49152:KDjlabwz9ZDjlabwz9F62WMAQaPXvvvELJ8LPel0Pk:6qwvqwhBAh/vvYJ4PLM

Malware Config

Extracted

Family

vidar

C2

https://t.me/bu77un

https://steamcommunity.com/profiles/76561199730044335

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1

Signatures

  • Detect Vidar Stealer 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pikola.exe
        pikola.exe -ppivore
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\rgawth.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\rgawth.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2832
          • C:\ProgramData\GHDHDB.exe
            C:\ProgramData\\GHDHDB.exe https://bitbucket.org/1234jhgv/jhygtfr/downloads/Update.exe
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:2804
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2728
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2712
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2924
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2612
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2724
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2756
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2640
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:1632
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:2660
            • C:\ProgramData\GHDHDB.exe
              C:\ProgramData\GHDHDB.exe
              6⤵
              • Executes dropped EXE
              PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4D1ED785E3365DE6C966A82E99CCE8EA_6BCA1153DAC084FF58DF6960444754E3

    Filesize

    471B

    MD5

    8878bd14a922a76c39f65ea2284f8bab

    SHA1

    7a1fc00ce6c2a7ca42fe7905ca95096b7269ccc4

    SHA256

    289a866027cd8e8fd7339156de48de3bfb3fd451689bed5b92414048d09f777f

    SHA512

    715c8deab58b0c47e2c2494f4302395c4a41b1bec7dd3f03bc2e6276f669ef4e1b6c16a52df18600b40490d322448918cfabb547afd0d7113cec1aef4435ff3c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

    Filesize

    1KB

    MD5

    7b707c4a05567a4921580c6b24f25c02

    SHA1

    89a4171ac74429cc72657c5cdbf5ce6c269d40d6

    SHA256

    29922ead5b9d596f415a8e550fadfc33dbf9df661fe810c4bd77f2c33d9a57c6

    SHA512

    1f21e1f73fc1d1bedbc43466a8a09327169dd786e3b42a17be52e542e2dae27363e0c6d6084f4ed8060e7e4e54c0893412ec071cd3b130fd2cbecf369e2743f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

    Filesize

    2KB

    MD5

    76e828213eed9c92948c5ba7ddf572a0

    SHA1

    21937ac4a72d85d68040c78bfd80139f5b92ca78

    SHA256

    48ec952a3c3138e07ab09990a1cde16e1955bdc2f1cd36ffbbe21af475c82941

    SHA512

    b8526b08de7d458af23e8dc0d883c69be81d698b58c32192ad9890dfa22f8cfdc4b844d75a38405061fbe57053231872327825f283efbb551239d16c36ef432c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

    Filesize

    1KB

    MD5

    805b39c993a04a90fffb1126bcefe6aa

    SHA1

    c0e2666400061ee34ac065e3b566ebcb6e76e858

    SHA256

    096a83427a82046689412043fd8ef52a88feaa3e8abcb2f32a7669e7885c899d

    SHA512

    90cfb4d4b12b1bcf7c4cef5bde9b82797feb9275165518a34700f35e6adc17c83c34450bbcc19a2bcf0702acbf6d964ce053a7037b123de0d608e1dd5eb52699

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_56B2A1FF8D0F5C5B4060FCF88A1654FE

    Filesize

    471B

    MD5

    7bedebf3bef4b851c19efcd0f32c8353

    SHA1

    4fde83c0ec957d7762f91bff764aadba9a7931c4

    SHA256

    91399805fee07d689013e97c55b4fe7a3b4a359dd4c0b734218b729c0aab912c

    SHA512

    fd5329aa0f11cdbf5431f3eb5be9f4ec30e2075d3d7e22a7c2aae902181267e2be1f1a4b54c296ace6ada432fce6a7c4998524f06943121e1bf02df7a58b89ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

    Filesize

    471B

    MD5

    41256db59356030efe7922fc04460559

    SHA1

    5cf59d04f97324ded9f9b32312eb7e4a74bf4108

    SHA256

    f00323b9f74cc54bf22586ea7eb1d3d6c8d6c68908b7ad44868a5719785c2023

    SHA512

    ba9b043938da53561194afe9935fec9e7066d078391929b97835603c6bb0cb77c16a619f87af9a7077398093797bef9160361371dacd7378391f72fc537a67ff

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4D1ED785E3365DE6C966A82E99CCE8EA_6BCA1153DAC084FF58DF6960444754E3

    Filesize

    400B

    MD5

    96f9484ec16ca411d7d4189425b2ba45

    SHA1

    ad8c9e3427b1292e89f8c076ae6cea840f982601

    SHA256

    0ef9fc826eb8afd973dcde8dae5f75e680cb927ecce0b93d79dbe30b721bd3d2

    SHA512

    17ef32d0c85353274b0707b434b6f18607803465087c9d47882468804567c0387ac67c1a40fc7db4dc53bbea7e1ff885bc63594cc4b9a077d311da3456e49a01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

    Filesize

    438B

    MD5

    84baa773e7dc44cdacf4213a84a3fd69

    SHA1

    8738ed9e9933a25114a011097e4002293970193b

    SHA256

    f9104c6d2ba84f018a5c38566f674ef5a166ebfbc99bc34c45f2c68cdaae9175

    SHA512

    00394f694c01f46f9137c95a5c7177608d148cbb93ad406b112cd70763c92bc1a6e2d995071fc78dd0a3ebc92a13cc7d59c3ecd7416ffb4c0737fb0bf3b5c2e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c31649b5feb02a3c476d9c0b25bae57f

    SHA1

    a15e77e4e09ae133db7df266fb94dad14cab1c02

    SHA256

    c49f755796b9ca545b12736d83384b3a6cc7c89f7ada05349c22fd76c3a95c61

    SHA512

    9c070d5b7483e1767f3537d67a5cc2fa982256d41f4d238d822b39afc97106a3033383a11aa33091995ae01c39f3b67de32c24945d33dbafa588a05712bdb3eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bebd60bd7255299910519b8c8ff57237

    SHA1

    c5d799cb4f98912ce8ee4afa90442e6012198359

    SHA256

    d64512fd444718db4ccf67f735f28b38bb0a3ee01651a9a4a4970a49929e22c5

    SHA512

    d2be5901ba76348d33dcf765ba7d3862dbbf2c4cf7649d805119596d548ab7bf2fb28076a3a2fcf84c607a1f7b6f4b453451132ebeb737588d0db75d0c0fd273

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    565f764772c738d10af50de67450af5a

    SHA1

    9354e345b80480715bb0b345dc050077a6d55684

    SHA256

    e7a0b80446fc7212995deeb2edeb747697a3c71b9f12409d3fef20314153f2e0

    SHA512

    a79fab323fa150d7125b8750906254c2ac98b0e2f4c0d76d0af6b1e2b5703eb5504e0b00cdd68c6580aea3e454bc1b8bb6fb6b8fb311917f46e1b35b42101b39

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    49fd89291c177133bf4d862bf5adc90f

    SHA1

    b929f9bfd246c3c66733ffe0a5f07a7eba096182

    SHA256

    1021861a2d5e8b763aa6c4ffe96bac409da3e5da2d3a4c490bfdc9060ccb1970

    SHA512

    c3f8b9b2853ffaeb248784c7ee842e4c595f80ea0655c700175aee499631bc03b770c0ee927069a7f5c685883c971c751f918b9c3be68eb225b09c6f16e505c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

    Filesize

    458B

    MD5

    7b0f001ebf3a81a6e918f98f5bfabc49

    SHA1

    f66e25612f5a7dcd66f9400c1d77e55ecb9ee036

    SHA256

    9029de66357c3fe8d4f4fd5ab072099dab54b4541bd6ad48bc53f655448997bf

    SHA512

    82f353fe43ced5c8ed9034f9d8660403a5326f07c0e6c443416f98f70167d668c19491d4c349ea637825a6cb40096c6cf97828527787c8be37c9221b58a87e22

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

    Filesize

    432B

    MD5

    8909ae9bc50388bc7f7c6f89a5d94b7b

    SHA1

    4b4d4e7fdbbc351130bd506f52304fe77d7d8e5a

    SHA256

    a16894cbd71126c6b58e8b18c6bf32962b4a54f57f5c22917786a6fa60c06201

    SHA512

    b2e3f049edc177529883afeb42ac79f669b964e9d8b051c4d2ee7608e8d8f6c918aae6080e41b9cb97cc9220ef76af924ddedeb5ef4364d937b4f44ccbf8495b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_56B2A1FF8D0F5C5B4060FCF88A1654FE

    Filesize

    418B

    MD5

    86b3f61a90e3a8fb2b04cb1eae7289ab

    SHA1

    0ce8a9d8686b5aca83c26a6cae509a98d662cf48

    SHA256

    007dc8fa33e68583f4b125c43f293807ec1e63073e41d838ba86f4af94830a59

    SHA512

    0a9dfda5fa767e72db7c2526f8a2b9cd0e901aca6ebaf53854a02444c33bb3482352e86a8671679a0b0d05de2f83a822413e6d2202188fec210e11e0cac1697b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

    Filesize

    400B

    MD5

    bae3c2e651e0379e8f08b3675e40af1b

    SHA1

    ce0ccb413aae1e4b572e5e0eebd4cc38b0f64e68

    SHA256

    2a3363ff1e33e2984166a01e0853f76ec4817769c177f569314853a49891c7a3

    SHA512

    00ec6711e53d3b255888af465aa8c380467b8fc374a68e96856194395f74e576530b0b7a886e3209e081d474880f9b451f98f2c12a684dcfb2a9bb63c22a2894

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YW15VCHK\Update[1].exe

    Filesize

    6.1MB

    MD5

    6044436058d895c5f11bd69742675411

    SHA1

    d55350aa01ca32a5d5f015d892eeae3edc81189c

    SHA256

    564570e26c2e8682c181ffbba655590a5cce262ffa6ab73467dff64e9a65904c

    SHA512

    a88d7f47aa96209aacfb3ef1d9421ffb3542b44e49cf89f0c63ec1c311039f756a2e4df4ddbe3678995d07600de7eaff8219a9b07d02433a89bfc9a302d941c5

  • C:\Users\Admin\AppData\Local\Temp\CabB76F.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

    Filesize

    36B

    MD5

    57763e1c0b9a681adcbeabb751ef4ca5

    SHA1

    0173fdd3469f7e580719bf69e6f62f9616a36b06

    SHA256

    25135d26bc14f31825318db6d3f68e2abf826a6a76ac4d3647291045e6198610

    SHA512

    7dd34652b07235e31aa13beef7292da56851007a051d805ff9f378d998d3d5fe489fedc93cac28a3d242f6416c2026d3bcdd6d257963ab65a64edd30ebb87260

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pikola.exe

    Filesize

    1.6MB

    MD5

    ad70fa49c2c2231a2675f50ec84839a4

    SHA1

    bf06da874316e2d3a94f645736b985b6c4826325

    SHA256

    5e18f14a182675b8353f0b85c4aa003ea02e9f737274a55795c01a08d5d738e6

    SHA512

    6ea0c9935e67656ab86240030cef2a538fb3b719264bd75ab364b3b828ab0c46022019af62661e85d278a3b8af789b1da22641c99e45ea011fa2e8bbe6118186

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\rgawth.exe

    Filesize

    1.1MB

    MD5

    5bd956880091b64c30ecc00ba5b61ebd

    SHA1

    19efa2cc8399c6add9f0a30e1fb51535623e50a6

    SHA256

    04bd08936aaeb8ccef9552f8050c7f10f30690a4929bf10cb343b6cde614f5ca

    SHA512

    231d2bffb276b37a9660d6499cce85565b1a5891cec163a1959fa25970a0629ca3de02bf290ee4f9e28c2e503e5df2d5aaf9fa180c661403e8e7991f21df407c

  • C:\Users\Admin\AppData\Local\Temp\TarB782.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \ProgramData\GHDHDB.exe

    Filesize

    6KB

    MD5

    2890a00ef6943ed98e2b7c6e3e49ae1c

    SHA1

    9072a751e68fe39222aebc87ffb898a423310ce9

    SHA256

    0ab41930f0a18d7629031bf5cd9a8c7090c13983c1d7567b9018185f0fa18f0d

    SHA512

    dd01c349264e431f3ec900e05062fa4300a4f8a9219edf4f7f8014a92dadd4aae0f05cc4a103f30bdd4d9915460edb03769ffdff0c9e290acd4c89b3a16542fe

  • memory/2832-35-0x00000000012D0000-0x000000000187D000-memory.dmp

    Filesize

    5.7MB

  • memory/2832-205-0x000000003A920000-0x000000003AB7F000-memory.dmp

    Filesize

    2.4MB

  • memory/2832-414-0x00000000012D0000-0x000000000187D000-memory.dmp

    Filesize

    5.7MB

  • memory/2832-352-0x00000000012D0000-0x000000000187D000-memory.dmp

    Filesize

    5.7MB

  • memory/2832-642-0x00000000012D0000-0x000000000187D000-memory.dmp

    Filesize

    5.7MB