Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/12/2024, 07:41
Static task
static1
Behavioral task
behavioral1
Sample
0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe
Resource
win10v2004-20241007-en
General
-
Target
0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe
-
Size
291KB
-
MD5
157f9789cf20e699a100419fd42c9372
-
SHA1
5f6ae38f22239a7df96cac67c486b96aa865e03d
-
SHA256
0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960
-
SHA512
fdd6816d42fba3bdf15fe76122923fc67fdfecad9c77b43f7c76c0f85232857074b11550634163b12e6e7d051dcb7c5c668e63b331b33690f75595c5add26a77
-
SSDEEP
3072:ABjvY9ERHtvTHgT3HrLhq4c55Beu+1NLL/5LSeEviYB+bfDKUEQDE+sdiPslWEZT:CvYORTHoI4+mh/avxYLaQEZXQyS
Malware Config
Signatures
-
Detect Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/3152-1-0x0000000000740000-0x0000000000766000-memory.dmp family_vidar_v7 behavioral2/memory/3152-2-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 behavioral2/memory/3152-10-0x0000000000740000-0x0000000000766000-memory.dmp family_vidar_v7 behavioral2/memory/3152-9-0x0000000000400000-0x0000000000639000-memory.dmp family_vidar_v7 -
Vidar family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4148 3152 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3088 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3152 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe 3152 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4720 3152 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe 84 PID 3152 wrote to memory of 4720 3152 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe 84 PID 3152 wrote to memory of 4720 3152 0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe 84 PID 4720 wrote to memory of 3088 4720 cmd.exe 88 PID 4720 wrote to memory of 3088 4720 cmd.exe 88 PID 4720 wrote to memory of 3088 4720 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe"C:\Users\Admin\AppData\Local\Temp\0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\0e8129471c62d891e5fcd737d6c86f60ea3aa9dad536eaa6899c124fd2913960.exe" & rd /s /q "C:\ProgramData\CBAAA1VSJEKN" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 20962⤵
- Program crash
PID:4148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3152 -ip 31521⤵PID:4988