Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2023, 19:48

General

  • Target

    tmp.exe

  • Size

    175KB

  • MD5

    20b01b94fec9143a2adf624945aa41c3

  • SHA1

    3e3690bb58b1a42cea254a0eb039019c7ebbbf3f

  • SHA256

    97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9

  • SHA512

    52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

  • SSDEEP

    3072:4xqZWVba1Qhu/q55e55FQhMvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+c3:mqZ9q52Qh

Malware Config

Extracted

Family

redline

C2

66.42.108.195:40499

Attributes
  • auth_value

    f93019ca42e7f9440be3a7ee1ebc636d

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4856-133-0x0000000000D90000-0x0000000000DC2000-memory.dmp

    Filesize

    200KB

  • memory/4856-134-0x0000000005CC0000-0x00000000062D8000-memory.dmp

    Filesize

    6.1MB

  • memory/4856-135-0x0000000005830000-0x000000000593A000-memory.dmp

    Filesize

    1.0MB

  • memory/4856-136-0x0000000005760000-0x0000000005772000-memory.dmp

    Filesize

    72KB

  • memory/4856-138-0x00000000057C0000-0x00000000057FC000-memory.dmp

    Filesize

    240KB

  • memory/4856-137-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

    Filesize

    64KB

  • memory/4856-139-0x0000000005B50000-0x0000000005BE2000-memory.dmp

    Filesize

    584KB

  • memory/4856-140-0x0000000006890000-0x0000000006E34000-memory.dmp

    Filesize

    5.6MB

  • memory/4856-141-0x0000000005BF0000-0x0000000005C56000-memory.dmp

    Filesize

    408KB

  • memory/4856-142-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

    Filesize

    64KB

  • memory/4856-143-0x0000000007050000-0x00000000070C6000-memory.dmp

    Filesize

    472KB

  • memory/4856-144-0x00000000070D0000-0x0000000007120000-memory.dmp

    Filesize

    320KB

  • memory/4856-145-0x00000000073F0000-0x00000000075B2000-memory.dmp

    Filesize

    1.8MB

  • memory/4856-146-0x0000000007FB0000-0x00000000084DC000-memory.dmp

    Filesize

    5.2MB