Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
204s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2023, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe
Resource
win10v2004-20221111-en
General
-
Target
c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe
-
Size
766KB
-
MD5
15f580bb1bba0a2ba8e7912a71c10b7f
-
SHA1
a9b9abaaf8b91b694b23a1e3ad1e18f9342274ab
-
SHA256
c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b
-
SHA512
05b0f0b1181128f4ca6d391f2be3140e9431185e8c81ef22314247ba6645e87dd6ed3a9706b5ddaae743faf1b665e313b87c4cc72981152039f202bdb50363d4
-
SSDEEP
12288:CMray90LPkj0VGnWtYXInXytlf/S7NIThoy/n6Zv88HbhBqxYf3:YyG8wVhbniL/Syp/nivpu6f
Malware Config
Extracted
redline
crypt1
176.113.115.17:4132
-
auth_value
2e2ca7bbceaa9f98252a6f9fc0e6fa86
Extracted
redline
dunm
193.233.20.12:4132
-
auth_value
352959e3707029296ec94306d74e2334
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection snz79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" snz79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" snz79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" snz79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" snz79.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" snz79.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
pid Process 1840 vaJ51.exe 4668 vAP02.exe 4484 dIc15.exe 3992 lQw39.exe 636 nUH41.exe 4092 snz79.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" snz79.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" vAP02.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vaJ51.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vaJ51.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vAP02.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3992 set thread context of 2984 3992 lQw39.exe 87 -
Program crash 1 IoCs
pid pid_target Process procid_target 260 4484 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4484 dIc15.exe 4484 dIc15.exe 636 nUH41.exe 2984 AppLaunch.exe 636 nUH41.exe 2984 AppLaunch.exe 4092 snz79.exe 4092 snz79.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4484 dIc15.exe Token: SeDebugPrivilege 636 nUH41.exe Token: SeDebugPrivilege 2984 AppLaunch.exe Token: SeDebugPrivilege 4092 snz79.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4460 wrote to memory of 1840 4460 c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe 79 PID 4460 wrote to memory of 1840 4460 c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe 79 PID 4460 wrote to memory of 1840 4460 c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe 79 PID 1840 wrote to memory of 4668 1840 vaJ51.exe 80 PID 1840 wrote to memory of 4668 1840 vaJ51.exe 80 PID 1840 wrote to memory of 4668 1840 vaJ51.exe 80 PID 4668 wrote to memory of 4484 4668 vAP02.exe 81 PID 4668 wrote to memory of 4484 4668 vAP02.exe 81 PID 4668 wrote to memory of 4484 4668 vAP02.exe 81 PID 4668 wrote to memory of 3992 4668 vAP02.exe 85 PID 4668 wrote to memory of 3992 4668 vAP02.exe 85 PID 4668 wrote to memory of 3992 4668 vAP02.exe 85 PID 3992 wrote to memory of 2984 3992 lQw39.exe 87 PID 3992 wrote to memory of 2984 3992 lQw39.exe 87 PID 3992 wrote to memory of 2984 3992 lQw39.exe 87 PID 3992 wrote to memory of 2984 3992 lQw39.exe 87 PID 3992 wrote to memory of 2984 3992 lQw39.exe 87 PID 1840 wrote to memory of 636 1840 vaJ51.exe 88 PID 1840 wrote to memory of 636 1840 vaJ51.exe 88 PID 1840 wrote to memory of 636 1840 vaJ51.exe 88 PID 4460 wrote to memory of 4092 4460 c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe 92 PID 4460 wrote to memory of 4092 4460 c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe"C:\Users\Admin\AppData\Local\Temp\c23d9f39c0dbb02d5d6f3c437199efb94727713fd3e21e437a4540c27590574b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vaJ51.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vaJ51.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vAP02.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vAP02.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dIc15.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dIc15.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 13405⤵
- Program crash
PID:260
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lQw39.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lQw39.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nUH41.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nUH41.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz79.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz79.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4484 -ip 44841⤵PID:2444
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
661KB
MD57b3ed13b88d8616a2bcc2df1dfc2c0e1
SHA157d75f088958f1e91cc63b331f2a9af74e770835
SHA2565bb3a9c7f45c38de8f1da08a7f854524435b31f94011954de875fb73ae219a39
SHA512d2e61a39b99d25343835616c975aaed1f4b624664ce50b72e97ce9c59d92027732e497040dc86ee30a35d6e572cef8f0ad64d2343cd9419adc49801bfd21105c
-
Filesize
661KB
MD57b3ed13b88d8616a2bcc2df1dfc2c0e1
SHA157d75f088958f1e91cc63b331f2a9af74e770835
SHA2565bb3a9c7f45c38de8f1da08a7f854524435b31f94011954de875fb73ae219a39
SHA512d2e61a39b99d25343835616c975aaed1f4b624664ce50b72e97ce9c59d92027732e497040dc86ee30a35d6e572cef8f0ad64d2343cd9419adc49801bfd21105c
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
516KB
MD57cf303a9ad0cd3215fe29a832a757443
SHA1befc6b9ff02342e3fe3890069b81ec85f37372bf
SHA2567b5343b259f299af561d19829fff680ab654108af6ef863d208919f5bbcc09c8
SHA512cecb8f64ee1c871478d9e2a6b8afbfbf4d4c48344b29609fa52eaaf49da494614d34fdd4599562175bea1c6f5e316d77010dc10ab03296ec4bb874c3cbbbca94
-
Filesize
516KB
MD57cf303a9ad0cd3215fe29a832a757443
SHA1befc6b9ff02342e3fe3890069b81ec85f37372bf
SHA2567b5343b259f299af561d19829fff680ab654108af6ef863d208919f5bbcc09c8
SHA512cecb8f64ee1c871478d9e2a6b8afbfbf4d4c48344b29609fa52eaaf49da494614d34fdd4599562175bea1c6f5e316d77010dc10ab03296ec4bb874c3cbbbca94
-
Filesize
297KB
MD5828bc96964e9263ad218e73b6a1bc9f0
SHA180dc270a7d3f3a51a6355610da3de48ef01a4395
SHA2560e42850ff811159647afdbaf6d2527ce09dfff15059d5fe183bd936a565657ec
SHA512f05cb6fc745dafb039450ef9affb28ddd278f9b7f08921c6fc1cfdf57b0e4636ed872907fec74d2df7d6307e45ada47112f614dc70d2570158f270cefe8f8e74
-
Filesize
297KB
MD5828bc96964e9263ad218e73b6a1bc9f0
SHA180dc270a7d3f3a51a6355610da3de48ef01a4395
SHA2560e42850ff811159647afdbaf6d2527ce09dfff15059d5fe183bd936a565657ec
SHA512f05cb6fc745dafb039450ef9affb28ddd278f9b7f08921c6fc1cfdf57b0e4636ed872907fec74d2df7d6307e45ada47112f614dc70d2570158f270cefe8f8e74
-
Filesize
277KB
MD53bc6ecb7d1f35f3171383f88879659b7
SHA1e82887b3d6ab38ae3b8880d6c904244495dcf0cc
SHA256c95f1ca2230edb615f3365e4c3ad09e4e1940a2c554eaf27c0df2d5bc4fc1068
SHA512709eb1c1c322c70a2a377324fa1766bfff9a3e1d37db04da240aaab36317d813b6f32f5c0d0a3f8d30f196f132985fce0ec030d5783df3c7bff76a4ccfb4431c
-
Filesize
277KB
MD53bc6ecb7d1f35f3171383f88879659b7
SHA1e82887b3d6ab38ae3b8880d6c904244495dcf0cc
SHA256c95f1ca2230edb615f3365e4c3ad09e4e1940a2c554eaf27c0df2d5bc4fc1068
SHA512709eb1c1c322c70a2a377324fa1766bfff9a3e1d37db04da240aaab36317d813b6f32f5c0d0a3f8d30f196f132985fce0ec030d5783df3c7bff76a4ccfb4431c