Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10InstalIеr...vg.dll
windows7-x64
1InstalIеr...vg.dll
windows10-2004-x64
1InstalIеr...sg.dll
windows7-x64
1InstalIеr...sg.dll
windows10-2004-x64
1InstalIеr...kc.dll
windows7-x64
1InstalIеr...kc.dll
windows10-2004-x64
1InstalIеr...18.exe
windows7-x64
8InstalIеr...18.exe
windows10-2004-x64
10InstalIеr...ws.dll
windows7-x64
1InstalIеr...ws.dll
windows10-2004-x64
1InstalIеr...le.dll
windows7-x64
1InstalIеr...le.dll
windows10-2004-x64
1TT18.exe
windows7-x64
8TT18.exe
windows10-2004-x64
10TTDesktop18.exe
windows7-x64
8TTDesktop18.exe
windows10-2004-x64
10TikTokDesktop18.exe
windows7-x64
8TikTokDesktop18.exe
windows10-2004-x64
10adjthjawdth.exe
windows7-x64
10adjthjawdth.exe
windows10-2004-x64
10bxftjhksaef.exe
windows7-x64
10bxftjhksaef.exe
windows10-2004-x64
10cli.exe
windows7-x64
3cli.exe
windows10-2004-x64
3dujkgsf.exe
windows7-x64
3dujkgsf.exe
windows10-2004-x64
5fdaerghawd.exe
windows7-x64
7fdaerghawd.exe
windows10-2004-x64
7fkydjyhjadg.exe
windows7-x64
10fkydjyhjadg.exe
windows10-2004-x64
10fsyjawdr.exe
windows7-x64
10fsyjawdr.exe
windows10-2004-x64
10Analysis
-
max time kernel
94s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
InstalIеr-x86/Qts5Svg.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
InstalIеr-x86/Qts5Svg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
InstalIеr-x86/SbieMsg.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
InstalIеr-x86/SbieMsg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
InstalIеr-x86/SbieShelIPkc.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
InstalIеr-x86/SbieShelIPkc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
InstalIеr-x86/TTDesktop18.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
InstalIеr-x86/TTDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
InstalIеr-x86/cfg/platforms/qwindows.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
InstalIеr-x86/cfg/platforms/qwindows.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
TT18.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
TT18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
TTDesktop18.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
TTDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
TikTokDesktop18.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
TikTokDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
adjthjawdth.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
adjthjawdth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
bxftjhksaef.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
bxftjhksaef.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
cli.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
cli.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
dujkgsf.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
dujkgsf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
fdaerghawd.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
fdaerghawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
fkydjyhjadg.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
fkydjyhjadg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
fsyjawdr.exe
Resource
win7-20240903-en
General
-
Target
TT18.exe
-
Size
12KB
-
MD5
ceb5022b92f0429137dc0fb67371e901
-
SHA1
999932b537591401dfa1a74df00dae99264bd994
-
SHA256
8d2f2dce701f8dc555e74b53bfaf7a1337027adc7fadc094b2eba3bb5b688f1b
-
SHA512
a7acdf417ef81f131c050bc8bd364edddf7a2ebc446c69411d549c14ca8967af7b8c8a2d4556018f148d1b57bc985e10104cdc72e2bed518cfe3280b0254a3d8
-
SSDEEP
192:knUbCDQoJq4Hb0jPuiJddudb7Z+XX1cNIQKXy+AFtaffEOsSRMWSVP1W58:kg3MGWimFNIQKX4Fgf8OxRBSVU
Malware Config
Extracted
vidar
11.8
41d35cbb974bc2d1287dcd4381b4a2a8
https://t.me/fu4chmo
https://steamcommunity.com/profiles/76561199802540894
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Signatures
-
Detect Vidar Stealer 3 IoCs
resource yara_rule behavioral14/files/0x0011000000023c90-138.dat family_vidar_v7 behavioral14/memory/3544-145-0x0000000000EF0000-0x0000000001149000-memory.dmp family_vidar_v7 behavioral14/memory/3544-160-0x0000000000EF0000-0x0000000001149000-memory.dmp family_vidar_v7 -
Stealc family
-
Vidar family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5060 powershell.exe 2552 powershell.exe 4040 powershell.exe 5028 powershell.exe 4228 powershell.exe 4484 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TT18.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 8Z9pqUvg.exe -
Executes dropped EXE 1 IoCs
pid Process 3544 8Z9pqUvg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 15 raw.githubusercontent.com 16 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TT18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8Z9pqUvg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8Z9pqUvg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8Z9pqUvg.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1920 timeout.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 5060 powershell.exe 5060 powershell.exe 2552 powershell.exe 2552 powershell.exe 4040 powershell.exe 4040 powershell.exe 5028 powershell.exe 5028 powershell.exe 4228 powershell.exe 4228 powershell.exe 4484 powershell.exe 4484 powershell.exe 3212 TT18.exe 3544 8Z9pqUvg.exe 3544 8Z9pqUvg.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3212 TT18.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 4040 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 4228 powershell.exe Token: SeDebugPrivilege 4484 powershell.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3212 wrote to memory of 5060 3212 TT18.exe 82 PID 3212 wrote to memory of 5060 3212 TT18.exe 82 PID 3212 wrote to memory of 5060 3212 TT18.exe 82 PID 5060 wrote to memory of 2552 5060 powershell.exe 85 PID 5060 wrote to memory of 2552 5060 powershell.exe 85 PID 5060 wrote to memory of 2552 5060 powershell.exe 85 PID 3212 wrote to memory of 4040 3212 TT18.exe 86 PID 3212 wrote to memory of 4040 3212 TT18.exe 86 PID 3212 wrote to memory of 4040 3212 TT18.exe 86 PID 4040 wrote to memory of 5028 4040 powershell.exe 88 PID 4040 wrote to memory of 5028 4040 powershell.exe 88 PID 4040 wrote to memory of 5028 4040 powershell.exe 88 PID 3212 wrote to memory of 4228 3212 TT18.exe 89 PID 3212 wrote to memory of 4228 3212 TT18.exe 89 PID 3212 wrote to memory of 4228 3212 TT18.exe 89 PID 4228 wrote to memory of 4484 4228 powershell.exe 91 PID 4228 wrote to memory of 4484 4228 powershell.exe 91 PID 4228 wrote to memory of 4484 4228 powershell.exe 91 PID 3212 wrote to memory of 3544 3212 TT18.exe 93 PID 3212 wrote to memory of 3544 3212 TT18.exe 93 PID 3212 wrote to memory of 3544 3212 TT18.exe 93 PID 3544 wrote to memory of 5112 3544 8Z9pqUvg.exe 109 PID 3544 wrote to memory of 5112 3544 8Z9pqUvg.exe 109 PID 3544 wrote to memory of 5112 3544 8Z9pqUvg.exe 109 PID 5112 wrote to memory of 1920 5112 cmd.exe 112 PID 5112 wrote to memory of 1920 5112 cmd.exe 112 PID 5112 wrote to memory of 1920 5112 cmd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT18.exe"C:\Users\Admin\AppData\Local\Temp\TT18.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\jQWJFzBAwS'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\jQWJFzBAwS3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
-
C:\jQWJFzBAwS\8Z9pqUvg.exe"C:\jQWJFzBAwS\8Z9pqUvg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\jQWJFzBAwS\8Z9pqUvg.exe" & rd /s /q "C:\ProgramData\EGIJEBGDAFHI" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1920
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
11KB
MD5278ee3b98704c589e023ca610be650b4
SHA1995b1e2b7b95152e87acbada24347b3ac2f2fc9a
SHA2563128e326f9311956d96d0c41392d37e854f6908c89dd1a425e02648a4e1a9f94
SHA5121d1c0be05e81f18a59f56cd356808bf1e3acb5736359f72c42b9663fd8c0addcba5abdb26d0017708fbba51b8e904a281a7d8badd22198be9c2e4449d2d82cb0
-
Filesize
11KB
MD5e10c1dd465b7282af536431e957198b5
SHA12e2af8eae8c7a1d2c4a27cb81b1c32c0316092fb
SHA2562c0da1d3e8dc86352b8d440a247d5480d835d5b523f0f9509138b143596fee8a
SHA512f170617cd93817691ff57809f47c4b129fbcde7b63a8c7f20b928589dab7748b0ea44cea7b0be0c92eb987a942222a4e3aad21663030bcb8e125df3e9a362dfa
-
Filesize
11KB
MD57c7d5387cae6da56e5d9c6f956350dd1
SHA193b715ccc3ae767cde649a5eae904ac2090a5149
SHA256e1af56d1e911cd70315e25af99a6c6481d8e15e91afa0bd6b1916c1c5cc35b65
SHA512bdb42c0fc5c25328dfc7a2e3a305188586faaad36b289e1fd44d497664c1b159305f228f077f71cbf2c4815acb9824ec3e4b73922a31e4524f1053f375286535
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
275KB
MD50a7b3454fdad8431bd3523648c915665
SHA1800a97a7c1a92a92cac76afc1fe5349895ee5287
SHA256baf217d7bb8f3a86856def6891638318a94ed5d7082149d4dd4cb755d90d86ce
SHA512020e45eaeee083d6739155d9a821ab54dd07f1320b8efb73871ee5d29188122fdbb7d39b34a8b3694a8b0c08ae1801ec370e40ff8d837c9190a72905f26baff9