Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2023, 06:21

General

  • Target

    2059bf434bb6655185f0140c5f25facbb44c62581657e4e04acad54d9fbb2452.exe

  • Size

    286KB

  • MD5

    0bd648781ab18e4dd2afe13e73aa9d2f

  • SHA1

    555fbb36dce79245f0510bd8f96b5aee92e2b47d

  • SHA256

    2059bf434bb6655185f0140c5f25facbb44c62581657e4e04acad54d9fbb2452

  • SHA512

    a8a2adde5933cb94984198de834fff933e0d43803b55b112358736f2aee38391d225cadf97401099546b4c7496067e070eb0050426d6f2b2ade02b5d2141d8eb

  • SSDEEP

    6144:vNT1xWVXI5JGfWZOTmD6vtdHt6ZsfPIifCzjQbKLzAMS2ILTj:vNz8XIfG8A9vtNt6sfPnGJf6lj

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2059bf434bb6655185f0140c5f25facbb44c62581657e4e04acad54d9fbb2452.exe
    "C:\Users\Admin\AppData\Local\Temp\2059bf434bb6655185f0140c5f25facbb44c62581657e4e04acad54d9fbb2452.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1240
      2⤵
      • Program crash
      PID:380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1436 -ip 1436
    1⤵
      PID:4940

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1436-134-0x0000000004DC0000-0x0000000005364000-memory.dmp

      Filesize

      5.6MB

    • memory/1436-135-0x00000000021B0000-0x0000000002212000-memory.dmp

      Filesize

      392KB

    • memory/1436-137-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

      Filesize

      64KB

    • memory/1436-136-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

      Filesize

      64KB

    • memory/1436-138-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-139-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-141-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-143-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-145-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-147-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-149-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-151-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-153-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-155-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-157-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-159-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-161-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-163-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-165-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-167-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-169-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-171-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-173-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-175-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-177-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-179-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-181-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-183-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-185-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-187-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-189-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-191-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-193-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-195-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-197-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-199-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-201-0x0000000004CD0000-0x0000000004D22000-memory.dmp

      Filesize

      328KB

    • memory/1436-928-0x0000000005370000-0x0000000005988000-memory.dmp

      Filesize

      6.1MB

    • memory/1436-929-0x00000000059B0000-0x00000000059C2000-memory.dmp

      Filesize

      72KB

    • memory/1436-930-0x00000000059D0000-0x0000000005ADA000-memory.dmp

      Filesize

      1.0MB

    • memory/1436-931-0x0000000005AE0000-0x0000000005B1C000-memory.dmp

      Filesize

      240KB

    • memory/1436-932-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

      Filesize

      64KB

    • memory/1436-933-0x0000000005DF0000-0x0000000005E56000-memory.dmp

      Filesize

      408KB

    • memory/1436-934-0x00000000064C0000-0x0000000006552000-memory.dmp

      Filesize

      584KB

    • memory/1436-935-0x0000000006570000-0x00000000065E6000-memory.dmp

      Filesize

      472KB

    • memory/1436-936-0x0000000006650000-0x0000000006812000-memory.dmp

      Filesize

      1.8MB

    • memory/1436-937-0x0000000006830000-0x0000000006D5C000-memory.dmp

      Filesize

      5.2MB

    • memory/1436-938-0x0000000006E60000-0x0000000006E7E000-memory.dmp

      Filesize

      120KB