Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
Filmwor.exe
Resource
win7-20240903-en
General
-
Target
Filmwor.exe
-
Size
4.9MB
-
MD5
a6974982ceb1a656f6db988828842d87
-
SHA1
9fbd537a58f1a2f9ee78b4278413ba091ca65cfa
-
SHA256
c9ed91a8bbdcccda38901f1a70590c8ecb9c813109922b3465471d678cc20868
-
SHA512
6facd84a6d4622b1c435bf9f77dd7bf4fb5fef222e97e58a62961f571654ad45c0a287195827567ffb17bf26746097577f19638286ac92af0eaf4c9398b82a83
-
SSDEEP
49152:0T8pWSX5MEq9/DD9dnEtVv2+QVGeWX0iZsml4eGMrEqAtuShOuInfmuh9cHlV/2F:0aWcHiDDjKV9e233y0ZwfK
Malware Config
Extracted
vidar
https://t.me/m08mbk
https://steamcommunity.com/profiles/76561199820567237
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Signatures
-
Vidar family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2100 set thread context of 2688 2100 Filmwor.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Filmwor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31 PID 2100 wrote to memory of 2688 2100 Filmwor.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Filmwor.exe"C:\Users\Admin\AppData\Local\Temp\Filmwor.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0b4c4192c4bef84b68df57887b9a241
SHA1a8643105972c65bb0ebd89684cb1419836851a52
SHA2567b6251f7b5145c5d0a9461558acbc509f2d56764904519d9a2e7d8ad5018fa2a
SHA512b830c48d0ee51190fbb5346f17f04dbadce99447b9c0cae8daeb25d58b5e9386bb871050837e0296a060b7ab4edc9df2fc85bf527caaf9f8bdc1fd8e1c96cb15
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\76561199820567237[1].htm
Filesize34KB
MD5a1ed953d2815802cdba4f283db0c5289
SHA131d946ec922de1b7bc85a93e082f35e8ad732600
SHA256b638ded47bcd25e3e0e7835043ababadfe8c72e041d136ce08e1c9c988475db5
SHA5127d6b7b9059fb2d4f8d7560bec1d36303ccd88976985e5de53ba8aa14cccd77bdab0925bb2a658d619555c9bbcbba3839daa56e60aad776706424170b7ccf0b66
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b