Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2025, 05:41

General

  • Target

    JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe

  • Size

    766KB

  • MD5

    50ae704cafeba5b700d5fbb6dc68f262

  • SHA1

    4fde265276a804e09a9888de211f070c41146ca3

  • SHA256

    81136dca1d7943435b75e587b5d5855a83dd2a58e639c059aed0fe15e3f49b2d

  • SHA512

    2d5ff42ae151412e17fdf0217ca6b23632a10c62857ae81baf76ed8855f447ac21313c135f6c2f69952e9f3524e20398fcb2e6e4db9ef00b06d35e6355cee4b1

  • SSDEEP

    12288:DlA/9z2Jtv21nf3ELaUqjXn3YLkkmO8tXsOhdY5fhbJJ5X+ZwAieDqjdROcuFAqL:DOzQ81/oaUQXnoLkk81i5f7fwqjPOcs

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

865

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    865

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Vidar Stealer 5 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 1616
      2⤵
      • Program crash
      PID:2592
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1052 -ip 1052
    1⤵
      PID:4940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1052-1-0x0000000000900000-0x0000000000A00000-memory.dmp

      Filesize

      1024KB

    • memory/1052-2-0x0000000000D60000-0x0000000000E36000-memory.dmp

      Filesize

      856KB

    • memory/1052-3-0x0000000000400000-0x00000000004D9000-memory.dmp

      Filesize

      868KB

    • memory/1052-11-0x0000000000D60000-0x0000000000E36000-memory.dmp

      Filesize

      856KB

    • memory/1052-12-0x0000000000400000-0x00000000004D9000-memory.dmp

      Filesize

      868KB

    • memory/1052-10-0x0000000000400000-0x00000000008EE000-memory.dmp

      Filesize

      4.9MB