Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 14:02

General

  • Target

    97d05052725039dcb6c167a9bd7f01705560f94868d3a0af727350e79dcbd5d8.exe

  • Size

    685KB

  • MD5

    f6dee6bc2648db6e9348ecdcdb6aedc5

  • SHA1

    f8c5200fb393bd06c33ba1652da650a272698d6f

  • SHA256

    97d05052725039dcb6c167a9bd7f01705560f94868d3a0af727350e79dcbd5d8

  • SHA512

    44edc9b14facab5a5d6699c3d10570b4ccd2e117150fc617df25d3af35e7b136211d035a6852c18974b396dd889543c43cff5f735f3f3c844f8cebb03d97f82c

  • SSDEEP

    12288:cMryy90Y/MskXg/Wp/cX0N+MZD+BWO9L+POBi37BoqVEOLHhN1i/QTA2d:eyHn+DYWKpBm6qVEOnzTn

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97d05052725039dcb6c167a9bd7f01705560f94868d3a0af727350e79dcbd5d8.exe
    "C:\Users\Admin\AppData\Local\Temp\97d05052725039dcb6c167a9bd7f01705560f94868d3a0af727350e79dcbd5d8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un665842.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un665842.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6712.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6712.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1436
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1088
          4⤵
          • Program crash
          PID:2036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9009.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9009.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2312
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1864
          4⤵
          • Program crash
          PID:2140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si233057.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si233057.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:408
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1436 -ip 1436
    1⤵
      PID:3668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2312 -ip 2312
      1⤵
        PID:4016
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:3836

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si233057.exe

        Filesize

        175KB

        MD5

        c2e53da23592e8921d9efdf6c820eff5

        SHA1

        7f1863d063346821d04fba60b8daaf6fa9fb20ca

        SHA256

        5a9a6f5b18c7d23ea4f6870c758d10f163b04095414085a274d724a1790b4d60

        SHA512

        8d8b77a00feffd37f4dd49908b7706cdbe815a598fff987bdd71e5afb212fcdd957f0545f6db9a61da321cde9047a4127307aeb46560208abf4c3955bd557f4f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si233057.exe

        Filesize

        175KB

        MD5

        c2e53da23592e8921d9efdf6c820eff5

        SHA1

        7f1863d063346821d04fba60b8daaf6fa9fb20ca

        SHA256

        5a9a6f5b18c7d23ea4f6870c758d10f163b04095414085a274d724a1790b4d60

        SHA512

        8d8b77a00feffd37f4dd49908b7706cdbe815a598fff987bdd71e5afb212fcdd957f0545f6db9a61da321cde9047a4127307aeb46560208abf4c3955bd557f4f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un665842.exe

        Filesize

        543KB

        MD5

        e049d68cd142755b847c9a72c82ea362

        SHA1

        d0ff38b4c83dbcb0507f09638bf199ab28e00c8d

        SHA256

        6adec23b9a9c7cf085386ba94df37fc286905027056106f2cdca703f4ea73bdd

        SHA512

        faff59752f800d55a8a25ef7235c64b0cff32a61a9a224df8d9bb001c3b1d125e540809b5d60e973d0e2f03356366d3aca607dd3cfaa4370c259362dee761143

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un665842.exe

        Filesize

        543KB

        MD5

        e049d68cd142755b847c9a72c82ea362

        SHA1

        d0ff38b4c83dbcb0507f09638bf199ab28e00c8d

        SHA256

        6adec23b9a9c7cf085386ba94df37fc286905027056106f2cdca703f4ea73bdd

        SHA512

        faff59752f800d55a8a25ef7235c64b0cff32a61a9a224df8d9bb001c3b1d125e540809b5d60e973d0e2f03356366d3aca607dd3cfaa4370c259362dee761143

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6712.exe

        Filesize

        292KB

        MD5

        af14c1d630af001e1ec69dc3cee17a89

        SHA1

        c119e25ae39ccc06e405b08b9d7773d194037d2f

        SHA256

        65426a31e20c4230cf7a45859a8b1ced442a8831e7e49f83d6c90adba569a91b

        SHA512

        6afa259a20ceb44cf6f8f5f8f33ba1ca5a59235c1199e6262414af49a221403fd9d821f5fa28c833732a4d357510df970af1a56c8484feb52bb96885f47b5f74

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6712.exe

        Filesize

        292KB

        MD5

        af14c1d630af001e1ec69dc3cee17a89

        SHA1

        c119e25ae39ccc06e405b08b9d7773d194037d2f

        SHA256

        65426a31e20c4230cf7a45859a8b1ced442a8831e7e49f83d6c90adba569a91b

        SHA512

        6afa259a20ceb44cf6f8f5f8f33ba1ca5a59235c1199e6262414af49a221403fd9d821f5fa28c833732a4d357510df970af1a56c8484feb52bb96885f47b5f74

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9009.exe

        Filesize

        350KB

        MD5

        46a7b6ebd9497df800e44a7c09f1523e

        SHA1

        a2d813476473d95d850cf604f4c96779f12a65ff

        SHA256

        13d3c0cea99ddb98279ff1c2079ab7d5384c299d459b395d9c999f4a9cbe4711

        SHA512

        54367e90d9eff1740731bbecfb4755eccefe2de70f8cd27b6222762cdc1ae603b5b1fbfe7d7a6cb207f7bc71eee26f4820fb574d3e16c17424e21f020f887566

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9009.exe

        Filesize

        350KB

        MD5

        46a7b6ebd9497df800e44a7c09f1523e

        SHA1

        a2d813476473d95d850cf604f4c96779f12a65ff

        SHA256

        13d3c0cea99ddb98279ff1c2079ab7d5384c299d459b395d9c999f4a9cbe4711

        SHA512

        54367e90d9eff1740731bbecfb4755eccefe2de70f8cd27b6222762cdc1ae603b5b1fbfe7d7a6cb207f7bc71eee26f4820fb574d3e16c17424e21f020f887566

      • memory/408-1122-0x0000000005610000-0x0000000005620000-memory.dmp

        Filesize

        64KB

      • memory/408-1121-0x0000000000CC0000-0x0000000000CF2000-memory.dmp

        Filesize

        200KB

      • memory/1436-156-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-170-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-152-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/1436-151-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/1436-154-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-153-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-149-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/1436-158-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-160-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-162-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-164-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-166-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-168-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-150-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/1436-172-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-174-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-176-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-178-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-180-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/1436-181-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/1436-182-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/1436-183-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/1436-184-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/1436-186-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/1436-148-0x0000000004EA0000-0x0000000005444000-memory.dmp

        Filesize

        5.6MB

      • memory/2312-192-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-475-0x0000000000800000-0x000000000084B000-memory.dmp

        Filesize

        300KB

      • memory/2312-196-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-198-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-200-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-202-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-204-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-206-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-208-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-210-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-212-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-214-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-216-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-218-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-220-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-222-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-224-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-194-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-477-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB

      • memory/2312-478-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB

      • memory/2312-480-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB

      • memory/2312-1101-0x0000000005320000-0x0000000005938000-memory.dmp

        Filesize

        6.1MB

      • memory/2312-1102-0x00000000059C0000-0x0000000005ACA000-memory.dmp

        Filesize

        1.0MB

      • memory/2312-1103-0x0000000005B00000-0x0000000005B12000-memory.dmp

        Filesize

        72KB

      • memory/2312-1104-0x0000000005B20000-0x0000000005B5C000-memory.dmp

        Filesize

        240KB

      • memory/2312-1105-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB

      • memory/2312-1106-0x0000000005E10000-0x0000000005EA2000-memory.dmp

        Filesize

        584KB

      • memory/2312-1107-0x0000000005EB0000-0x0000000005F16000-memory.dmp

        Filesize

        408KB

      • memory/2312-1109-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB

      • memory/2312-1110-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB

      • memory/2312-1111-0x00000000066D0000-0x0000000006746000-memory.dmp

        Filesize

        472KB

      • memory/2312-1112-0x0000000006750000-0x00000000067A0000-memory.dmp

        Filesize

        320KB

      • memory/2312-191-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

        Filesize

        248KB

      • memory/2312-1113-0x00000000067C0000-0x0000000006982000-memory.dmp

        Filesize

        1.8MB

      • memory/2312-1114-0x0000000006990000-0x0000000006EBC000-memory.dmp

        Filesize

        5.2MB

      • memory/2312-1115-0x0000000004D60000-0x0000000004D70000-memory.dmp

        Filesize

        64KB