Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 02:34

General

  • Target

    0x000900000001230c-1037.exe

  • Size

    175KB

  • MD5

    0596fc839ec43e12f42258b1f56f0356

  • SHA1

    ed331a7745c14dc5791fc62cb3c3d6499976e850

  • SHA256

    9db73bac85af3c7a5679b5d8c18cbb42b321e3846e5d47f7f8079eb766f900ef

  • SHA512

    be899677fa2d2caaf94bfbf15f5f9a97ffcb1bf6e55433b3d5824f65ffba34b120aaeac620b7a7ce9e27256972914b036d3ef7a93e78cf041358e776abcc68d9

  • SSDEEP

    3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh

Malware Config

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes
  • auth_value

    e795368557f02e28e8aef6bcb279a3b0

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000900000001230c-1037.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000900000001230c-1037.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2448

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2448-133-0x0000000000B60000-0x0000000000B92000-memory.dmp

    Filesize

    200KB

  • memory/2448-134-0x0000000005AA0000-0x00000000060B8000-memory.dmp

    Filesize

    6.1MB

  • memory/2448-135-0x00000000055E0000-0x00000000056EA000-memory.dmp

    Filesize

    1.0MB

  • memory/2448-136-0x0000000005510000-0x0000000005522000-memory.dmp

    Filesize

    72KB

  • memory/2448-137-0x0000000005570000-0x00000000055AC000-memory.dmp

    Filesize

    240KB

  • memory/2448-138-0x0000000005870000-0x0000000005880000-memory.dmp

    Filesize

    64KB

  • memory/2448-139-0x0000000005920000-0x00000000059B2000-memory.dmp

    Filesize

    584KB

  • memory/2448-140-0x0000000006670000-0x0000000006C14000-memory.dmp

    Filesize

    5.6MB

  • memory/2448-141-0x00000000059C0000-0x0000000005A26000-memory.dmp

    Filesize

    408KB

  • memory/2448-142-0x0000000006DF0000-0x0000000006FB2000-memory.dmp

    Filesize

    1.8MB

  • memory/2448-143-0x00000000074F0000-0x0000000007A1C000-memory.dmp

    Filesize

    5.2MB

  • memory/2448-144-0x0000000005870000-0x0000000005880000-memory.dmp

    Filesize

    64KB

  • memory/2448-145-0x0000000006CA0000-0x0000000006D16000-memory.dmp

    Filesize

    472KB

  • memory/2448-146-0x0000000006D20000-0x0000000006D70000-memory.dmp

    Filesize

    320KB