Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 14:15

General

  • Target

    712b2fa53efed85b594661ad03cc69ee6316eec44e2ce18b8d111c250bb2e084.exe

  • Size

    685KB

  • MD5

    df5ae9a6a92f280152eb2d5b2a0cd75e

  • SHA1

    22b254ec41de7f9b0fe3034b6406c68a574d5c83

  • SHA256

    712b2fa53efed85b594661ad03cc69ee6316eec44e2ce18b8d111c250bb2e084

  • SHA512

    20e9813d9cb57f7f2ab353846909d6817a506ee1829f02f3aab394544c534f098b70b6bc76709b049a8b7f422276fec8c69170fd90ca6882476084b3ad54624b

  • SSDEEP

    12288:3Mr0y90hzZ45rr1yMulkGgapMhWGAlVI8OIzTH/ceH4hlBZ3BE8WIPG:fyNlglkGga5dw8jzTrH4j3BE8WIu

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\712b2fa53efed85b594661ad03cc69ee6316eec44e2ce18b8d111c250bb2e084.exe
    "C:\Users\Admin\AppData\Local\Temp\712b2fa53efed85b594661ad03cc69ee6316eec44e2ce18b8d111c250bb2e084.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un085170.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un085170.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7010.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7010.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2268
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1088
          4⤵
          • Program crash
          PID:400
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9735.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9735.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3452
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 1720
          4⤵
          • Program crash
          PID:1896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si033252.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si033252.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4120
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2268 -ip 2268
    1⤵
      PID:3932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3452 -ip 3452
      1⤵
        PID:1272

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si033252.exe

        Filesize

        175KB

        MD5

        c87322fab50bb95eb2c5ec298c2eb80a

        SHA1

        8bfaf4b25a96661e84be527f61d2fda2ae17b91e

        SHA256

        db51e5f2645f224d28e0d9a43defe21b65de322c16b925335288b4a93e121681

        SHA512

        1001b477ea1dcc48adb681fff424cb896756600da9cac000ca492f72e7dde53f7845140824dc1aafe05d551980d6084e9882a9ddf74cb2eb5422dd57f7b5b9a8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si033252.exe

        Filesize

        175KB

        MD5

        c87322fab50bb95eb2c5ec298c2eb80a

        SHA1

        8bfaf4b25a96661e84be527f61d2fda2ae17b91e

        SHA256

        db51e5f2645f224d28e0d9a43defe21b65de322c16b925335288b4a93e121681

        SHA512

        1001b477ea1dcc48adb681fff424cb896756600da9cac000ca492f72e7dde53f7845140824dc1aafe05d551980d6084e9882a9ddf74cb2eb5422dd57f7b5b9a8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un085170.exe

        Filesize

        543KB

        MD5

        c257eeae8c3ac3571f3d420211bfcae8

        SHA1

        c7029cd989ad012a1cd2e1d9211bd1939ccf984d

        SHA256

        a292c188a1d0f2d33f467f396f3c814e74ff5a5508c1e0539697c73b3dbf5367

        SHA512

        0ef2db5ee820ae04552905247b6c7b54fd2727523cb9765076cb1fe3770e7d1823fa8c59f5d0bd0b387720fcf71865485a270e2634b85a1865563efbbe53489a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un085170.exe

        Filesize

        543KB

        MD5

        c257eeae8c3ac3571f3d420211bfcae8

        SHA1

        c7029cd989ad012a1cd2e1d9211bd1939ccf984d

        SHA256

        a292c188a1d0f2d33f467f396f3c814e74ff5a5508c1e0539697c73b3dbf5367

        SHA512

        0ef2db5ee820ae04552905247b6c7b54fd2727523cb9765076cb1fe3770e7d1823fa8c59f5d0bd0b387720fcf71865485a270e2634b85a1865563efbbe53489a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7010.exe

        Filesize

        292KB

        MD5

        7141e077be3b4f73ae4eeec26d89db83

        SHA1

        19aecc45393a3fe65add589909be42349ee0738c

        SHA256

        2b92cecf087e497f772a84d5f5fd1a284ce6a241c964c54c315ced4a973f7cd7

        SHA512

        b017dcd2e870b5078aa73c22dd3dea6e114b0cf42bd2eb2d55616ca9e9a90182708e93a77483f186ca723c7e016f73c2e1b2e53769e795a3fb46591e3d573e75

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7010.exe

        Filesize

        292KB

        MD5

        7141e077be3b4f73ae4eeec26d89db83

        SHA1

        19aecc45393a3fe65add589909be42349ee0738c

        SHA256

        2b92cecf087e497f772a84d5f5fd1a284ce6a241c964c54c315ced4a973f7cd7

        SHA512

        b017dcd2e870b5078aa73c22dd3dea6e114b0cf42bd2eb2d55616ca9e9a90182708e93a77483f186ca723c7e016f73c2e1b2e53769e795a3fb46591e3d573e75

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9735.exe

        Filesize

        350KB

        MD5

        8ba9a76f968b8a99b5b9631377f27744

        SHA1

        157da131c429b82aabbf6ea3c3de6d25cf72f761

        SHA256

        d5bc698ab7d46e9ee66a55e6671278834862737a6ec17629bc69a961ce7e6c85

        SHA512

        6442deea7bb2e9e4f9b151d1db6343e1e4170b94aa75ec8fd93e6fb68b2202d5720bd61ddf83e91f238b1fe0c8a954ab91fa3a3bf7c638b598a09433c935108f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9735.exe

        Filesize

        350KB

        MD5

        8ba9a76f968b8a99b5b9631377f27744

        SHA1

        157da131c429b82aabbf6ea3c3de6d25cf72f761

        SHA256

        d5bc698ab7d46e9ee66a55e6671278834862737a6ec17629bc69a961ce7e6c85

        SHA512

        6442deea7bb2e9e4f9b151d1db6343e1e4170b94aa75ec8fd93e6fb68b2202d5720bd61ddf83e91f238b1fe0c8a954ab91fa3a3bf7c638b598a09433c935108f

      • memory/2268-148-0x0000000004EC0000-0x0000000005464000-memory.dmp

        Filesize

        5.6MB

      • memory/2268-149-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/2268-150-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

        Filesize

        64KB

      • memory/2268-151-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

        Filesize

        64KB

      • memory/2268-152-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-153-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-155-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-157-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-159-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-161-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-163-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-165-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-167-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-169-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-171-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-173-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-175-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-179-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-177-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/2268-180-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/2268-181-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

        Filesize

        64KB

      • memory/2268-182-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

        Filesize

        64KB

      • memory/2268-184-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/3452-194-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-222-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-192-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-189-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-198-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-196-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-200-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-202-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-204-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-206-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-208-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-210-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-213-0x0000000000950000-0x000000000099B000-memory.dmp

        Filesize

        300KB

      • memory/3452-212-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-214-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-216-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-217-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-218-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-220-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-190-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-224-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-226-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/3452-1099-0x0000000005320000-0x0000000005938000-memory.dmp

        Filesize

        6.1MB

      • memory/3452-1100-0x00000000059C0000-0x0000000005ACA000-memory.dmp

        Filesize

        1.0MB

      • memory/3452-1101-0x0000000005B00000-0x0000000005B12000-memory.dmp

        Filesize

        72KB

      • memory/3452-1102-0x0000000005B20000-0x0000000005B5C000-memory.dmp

        Filesize

        240KB

      • memory/3452-1103-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-1104-0x0000000005E10000-0x0000000005EA2000-memory.dmp

        Filesize

        584KB

      • memory/3452-1105-0x0000000005EB0000-0x0000000005F16000-memory.dmp

        Filesize

        408KB

      • memory/3452-1107-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-1108-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-1109-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-1110-0x0000000006710000-0x00000000068D2000-memory.dmp

        Filesize

        1.8MB

      • memory/3452-1111-0x00000000068F0000-0x0000000006E1C000-memory.dmp

        Filesize

        5.2MB

      • memory/3452-1112-0x0000000007070000-0x00000000070E6000-memory.dmp

        Filesize

        472KB

      • memory/3452-1113-0x00000000070F0000-0x0000000007140000-memory.dmp

        Filesize

        320KB

      • memory/3452-1114-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

        Filesize

        64KB

      • memory/4120-1120-0x00000000004A0000-0x00000000004D2000-memory.dmp

        Filesize

        200KB

      • memory/4120-1121-0x0000000005110000-0x0000000005120000-memory.dmp

        Filesize

        64KB