Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbDlwT0ZwMlp4QnotOHRmZ1M4VzBQSVE1dnBBd3xBQ3Jtc0trNlNUVUFpcnNFZUloaWdXU0FwRjB6bFh0M3plVm9zWGpZbnV6V2trQlpNYXBVMUxTSE9Pb3QyWGdubERldTB5WU9VdTJCN2ZNTzNNVERtTHNzejVCVmtYVVBsM2tBMGpyanM2QkZ4V29hdlpGZHJYZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles
-
Sample
241011-qc7xbsyepm
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbDlwT0ZwMlp4QnotOHRmZ1M4VzBQSVE1dnBBd3xBQ3Jtc0trNlNUVUFpcnNFZUloaWdXU0FwRjB6bFh0M3plVm9zWGpZbnV6V2trQlpNYXBVMUxTSE9Pb3QyWGdubERldTB5WU9VdTJCN2ZNTzNNVERtTHNzejVCVmtYVVBsM2tBMGpyanM2QkZ4V29hdlpGZHJYZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles
Resource
win10v2004-20241007-en
Malware Config
Extracted
vidar
11.1
467d1313a0fbcd97b65a6f1d261c288f
https://steamcommunity.com/profiles/76561199786602107
https://t.me/lpnjoke
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Targets
-
-
Target
https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbDlwT0ZwMlp4QnotOHRmZ1M4VzBQSVE1dnBBd3xBQ3Jtc0trNlNUVUFpcnNFZUloaWdXU0FwRjB6bFh0M3plVm9zWGpZbnV6V2trQlpNYXBVMUxTSE9Pb3QyWGdubERldTB5WU9VdTJCN2ZNTzNNVERtTHNzejVCVmtYVVBsM2tBMGpyanM2QkZ4V29hdlpGZHJYZw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv6itahr4p07b1%2FFiles
-
Detect Vidar Stealer
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1