Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 14:00

General

  • Target

    15cc611075b96a7c872d794175706e2b042b9edff2cd72113a3d7dd51c64b78b.exe

  • Size

    685KB

  • MD5

    f564d5c2d547f2015808864667a9e944

  • SHA1

    2a0b0621ccfe7fe86fa5e7ccf167403645063ccf

  • SHA256

    15cc611075b96a7c872d794175706e2b042b9edff2cd72113a3d7dd51c64b78b

  • SHA512

    78cfbb09e19fe7dc3fe0abb3be55169e7633136fc67ae05c972ac1170125cbe0a68436db573173fa5a08850ebfc4ac8dc798832e61ad83ab8880a95149387c92

  • SSDEEP

    12288:EMruy90tQZuTPLMM3kd+TZhJGkrB/I5zqDJrCVVrDSa1BAOqEb8hs3qTZJMTB:6y5Zu1mUZhdIzgGVrDLSOqEbB3kW

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15cc611075b96a7c872d794175706e2b042b9edff2cd72113a3d7dd51c64b78b.exe
    "C:\Users\Admin\AppData\Local\Temp\15cc611075b96a7c872d794175706e2b042b9edff2cd72113a3d7dd51c64b78b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un469637.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un469637.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4140.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4140.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 1088
          4⤵
          • Program crash
          PID:4412
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2566.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2566.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 1860
          4⤵
          • Program crash
          PID:3976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si494869.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si494869.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4856
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1980 -ip 1980
    1⤵
      PID:3420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1652 -ip 1652
      1⤵
        PID:1784

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si494869.exe

        Filesize

        175KB

        MD5

        67edd4a36304bb2729d16c1cf1a45ec0

        SHA1

        fbc570f6aac34ce9ffc8939f13d4ba73f0ce9ff4

        SHA256

        adede8f29a9a8ed0ac2f671aa2cd45a5b498c3e8805fb62914f122d774239fa2

        SHA512

        1fdccd969a44109d6cc281e9fb5dc8201aed7fa3cd24364451cbc11e3df25052d1b307b091f3a2c2c39f11ba78123253e5d80ff51a6c6aeccdcc94e96cbc0bb7

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si494869.exe

        Filesize

        175KB

        MD5

        67edd4a36304bb2729d16c1cf1a45ec0

        SHA1

        fbc570f6aac34ce9ffc8939f13d4ba73f0ce9ff4

        SHA256

        adede8f29a9a8ed0ac2f671aa2cd45a5b498c3e8805fb62914f122d774239fa2

        SHA512

        1fdccd969a44109d6cc281e9fb5dc8201aed7fa3cd24364451cbc11e3df25052d1b307b091f3a2c2c39f11ba78123253e5d80ff51a6c6aeccdcc94e96cbc0bb7

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un469637.exe

        Filesize

        543KB

        MD5

        84203cc9db4bcd6b898ffdf8ec465ac3

        SHA1

        b2fb19fb4c5f88b2db85e8bcbd522db60d779f2e

        SHA256

        723a56330b1b0d6858b857e2399e8c522386aa72dfb9f5bc8f5c337373b19209

        SHA512

        9352cfb93c6b4cb4318724d50f3493853603823fc37514a028134e5ae8b57801500385de982c37755d91289062ed50f17928e3d1628febcf9c01c1fa748a894c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un469637.exe

        Filesize

        543KB

        MD5

        84203cc9db4bcd6b898ffdf8ec465ac3

        SHA1

        b2fb19fb4c5f88b2db85e8bcbd522db60d779f2e

        SHA256

        723a56330b1b0d6858b857e2399e8c522386aa72dfb9f5bc8f5c337373b19209

        SHA512

        9352cfb93c6b4cb4318724d50f3493853603823fc37514a028134e5ae8b57801500385de982c37755d91289062ed50f17928e3d1628febcf9c01c1fa748a894c

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4140.exe

        Filesize

        292KB

        MD5

        5478471a327724eecc7fe00929af738b

        SHA1

        8517abf796b81f4e1e8f976c5683cdd8a92d3a1f

        SHA256

        76a2ef18ecf0aa8b1fe3fba630a2944787b7fbcacc54b1d5218afd801d81cefc

        SHA512

        f454ad321f5d59a6a530af8486e9fd9aa54d908e22e92671feffb80080ed13898b25ac70b41973132e32b8843e1691b1d312a0ea8607d90a02f5513188d279dc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4140.exe

        Filesize

        292KB

        MD5

        5478471a327724eecc7fe00929af738b

        SHA1

        8517abf796b81f4e1e8f976c5683cdd8a92d3a1f

        SHA256

        76a2ef18ecf0aa8b1fe3fba630a2944787b7fbcacc54b1d5218afd801d81cefc

        SHA512

        f454ad321f5d59a6a530af8486e9fd9aa54d908e22e92671feffb80080ed13898b25ac70b41973132e32b8843e1691b1d312a0ea8607d90a02f5513188d279dc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2566.exe

        Filesize

        350KB

        MD5

        045d7f50a4063a97be4c5bb92c1ede0e

        SHA1

        b2632b46a974df4701132e72fd00c2e8bc238222

        SHA256

        dffdcf4a631de8cbdb889bb987d47740f12d6aa55dfc8928298565392fdf94da

        SHA512

        e81162018c3071c3c31f4be375b9f989a95075f359b59ffe2def62ca0de790880dace24c1d980ec09dd347f44deec2aefe8939b6272eb969deba629f18214239

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2566.exe

        Filesize

        350KB

        MD5

        045d7f50a4063a97be4c5bb92c1ede0e

        SHA1

        b2632b46a974df4701132e72fd00c2e8bc238222

        SHA256

        dffdcf4a631de8cbdb889bb987d47740f12d6aa55dfc8928298565392fdf94da

        SHA512

        e81162018c3071c3c31f4be375b9f989a95075f359b59ffe2def62ca0de790880dace24c1d980ec09dd347f44deec2aefe8939b6272eb969deba629f18214239

      • memory/1652-227-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-1102-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/1652-1115-0x0000000007DA0000-0x00000000082CC000-memory.dmp

        Filesize

        5.2MB

      • memory/1652-1114-0x0000000007BC0000-0x0000000007D82000-memory.dmp

        Filesize

        1.8MB

      • memory/1652-1113-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-1112-0x0000000007B60000-0x0000000007BB0000-memory.dmp

        Filesize

        320KB

      • memory/1652-1111-0x0000000007AD0000-0x0000000007B46000-memory.dmp

        Filesize

        472KB

      • memory/1652-1110-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-1109-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-1108-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-1106-0x0000000006620000-0x00000000066B2000-memory.dmp

        Filesize

        584KB

      • memory/1652-1105-0x0000000005F50000-0x0000000005FB6000-memory.dmp

        Filesize

        408KB

      • memory/1652-1104-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-1103-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/1652-1101-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/1652-1100-0x0000000005460000-0x0000000005A78000-memory.dmp

        Filesize

        6.1MB

      • memory/1652-225-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-222-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-223-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-219-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-220-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-218-0x0000000004C20000-0x0000000004C30000-memory.dmp

        Filesize

        64KB

      • memory/1652-190-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-191-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-193-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-195-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-197-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-199-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-201-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-203-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-205-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-207-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-209-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-211-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-213-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1652-217-0x0000000000750000-0x000000000079B000-memory.dmp

        Filesize

        300KB

      • memory/1652-215-0x0000000004BE0000-0x0000000004C1E000-memory.dmp

        Filesize

        248KB

      • memory/1980-175-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/1980-149-0x0000000004FE0000-0x0000000005584000-memory.dmp

        Filesize

        5.6MB

      • memory/1980-185-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/1980-184-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/1980-183-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/1980-182-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/1980-150-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-180-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/1980-179-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-155-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-177-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-176-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/1980-153-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-151-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-163-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-169-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-167-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-165-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-171-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-161-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-159-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-157-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-173-0x00000000026A0000-0x00000000026B2000-memory.dmp

        Filesize

        72KB

      • memory/1980-148-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/4856-1121-0x00000000003D0000-0x0000000000402000-memory.dmp

        Filesize

        200KB

      • memory/4856-1122-0x0000000004F50000-0x0000000004F60000-memory.dmp

        Filesize

        64KB