Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
02/04/2023, 17:28 UTC
General
-
Target
0c143c819ee626f1eddd1f1123ee50959e1018f09f0520bb306dad4fa385e654.exe
-
Size
536KB
-
MD5
dd517fb70791391913f071f9f367ed03
-
SHA1
64ef403426038958ee2ccf519efecf17836d4799
-
SHA256
0c143c819ee626f1eddd1f1123ee50959e1018f09f0520bb306dad4fa385e654
-
SHA512
e8faef5a2bacdb72302b9b57e50bbeb92db4c6646068f128d09bfecf31ddbbc9c1b5b767052d678784454e3440a03fd935d386d002b585fd99c3e0fd32daa3c8
-
SSDEEP
6144:Kry+bnr+Fp0yN90QEsJwNPjOh+Pqnl+mu6cm+EnF0doaE29Ohsb8NswO2kaeX/6p:5MrZy90djbIzmL9DANRz9GyGMdUrAOO
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c143c819ee626f1eddd1f1123ee50959e1018f09f0520bb306dad4fa385e654.exe"C:\Users\Admin\AppData\Local\Temp\0c143c819ee626f1eddd1f1123ee50959e1018f09f0520bb306dad4fa385e654.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziik2448.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziik2448.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr453833.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr453833.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku776257.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku776257.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 13284⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr254724.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr254724.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 556 -ip 5561⤵
Network
-
DNS232.168.11.51.in-addr.arpaRemote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse -
DNS71.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS133.211.185.52.in-addr.arpaRemote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS145.115.113.176.in-addr.arpaRemote address:8.8.8.8:53Request145.115.113.176.in-addr.arpaIN PTRResponse
-
DNS2.77.109.52.in-addr.arpaRemote address:8.8.8.8:53Request2.77.109.52.in-addr.arpaIN PTRResponse
-
117.18.232.240:80
-
176.113.115.145:4125 -
176.113.115.145:4125
-
52.182.143.208:443
-
117.18.232.240:80
-
117.18.232.240:80
-
173.223.113.164:443 -
173.223.113.131:80
-
8.8.8.8:53232.168.11.51.in-addr.arpadns
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:5371.159.190.20.in-addr.arpadns
DNS Request
71.159.190.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53133.211.185.52.in-addr.arpadns
DNS Request
133.211.185.52.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53145.115.113.176.in-addr.arpadns
DNS Request
145.115.113.176.in-addr.arpa
-
8.8.8.8:532.77.109.52.in-addr.arpadns
DNS Request
2.77.109.52.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5480a16635cd91aeeb7660139fe35eebb
SHA1a387b08a45904b86f81a8b94c251f2ef50e9dd21
SHA256a138a5669d5fad2449b2b0dcc79e66961b0d129fe2f861d7e9ebc08844c784b7
SHA512f6e2cd3f1c0f4945b79248f06126f0e1002cfbbeba5e595739aec1027b510e1e9f038da4f8b8d41aed77ea77946f59b5ee3182457526d20b31542ebc2e4c4767
-
Filesize
175KB
MD5480a16635cd91aeeb7660139fe35eebb
SHA1a387b08a45904b86f81a8b94c251f2ef50e9dd21
SHA256a138a5669d5fad2449b2b0dcc79e66961b0d129fe2f861d7e9ebc08844c784b7
SHA512f6e2cd3f1c0f4945b79248f06126f0e1002cfbbeba5e595739aec1027b510e1e9f038da4f8b8d41aed77ea77946f59b5ee3182457526d20b31542ebc2e4c4767
-
Filesize
394KB
MD554745737678657b7e761db79b876bea1
SHA1fbd741f6637925c852a8e8c52c0092197da442d1
SHA256655ea96e9be1fa521e32c1ad21b7982f860dd5fa1bd5a529e658c2ec311fa6ac
SHA5126dd56eec0d7931053a84b9cd56c8aabf0ce997c571426890069c0ca42a87c4503ac24ec4b2ac3479fb6035274dffb5300197cbc020f4134766b7476fa8f53c5f
-
Filesize
394KB
MD554745737678657b7e761db79b876bea1
SHA1fbd741f6637925c852a8e8c52c0092197da442d1
SHA256655ea96e9be1fa521e32c1ad21b7982f860dd5fa1bd5a529e658c2ec311fa6ac
SHA5126dd56eec0d7931053a84b9cd56c8aabf0ce997c571426890069c0ca42a87c4503ac24ec4b2ac3479fb6035274dffb5300197cbc020f4134766b7476fa8f53c5f
-
Filesize
13KB
MD5c966c8b55b260dfdb3a4738d1099cd68
SHA192e22b5a11edb4034fc086cce18171ebe40905e7
SHA256d6fde8a730932bbb4eabe230c48ad62033dd95cf03194e2876b3369ac53ab7c9
SHA512a9bdeb275c357fa5fc680f056bb16a093e67d905105a4c1acdf76abc55bc29cef5373a462a9cd02747e8fa669b59dd6bc82eae077f2cd8def1519b8aef95d7c4
-
Filesize
13KB
MD5c966c8b55b260dfdb3a4738d1099cd68
SHA192e22b5a11edb4034fc086cce18171ebe40905e7
SHA256d6fde8a730932bbb4eabe230c48ad62033dd95cf03194e2876b3369ac53ab7c9
SHA512a9bdeb275c357fa5fc680f056bb16a093e67d905105a4c1acdf76abc55bc29cef5373a462a9cd02747e8fa669b59dd6bc82eae077f2cd8def1519b8aef95d7c4
-
Filesize
353KB
MD528c7e291e5985b356a7333e926193f1f
SHA197856059f3bd9db78d1edff05da18be3961ad596
SHA256d1cba10b9bf7faed28c9693eeaedef881569414537733215076a483fa402871b
SHA512e79d785fb93d85ad01175a7309c43a2c5294d5402bad36e5ef9758d4b2c03af6a616271b689b2049695a24a846a00158d2172c55787f5dd2b5b7bc8b0a751de3
-
Filesize
353KB
MD528c7e291e5985b356a7333e926193f1f
SHA197856059f3bd9db78d1edff05da18be3961ad596
SHA256d1cba10b9bf7faed28c9693eeaedef881569414537733215076a483fa402871b
SHA512e79d785fb93d85ad01175a7309c43a2c5294d5402bad36e5ef9758d4b2c03af6a616271b689b2049695a24a846a00158d2172c55787f5dd2b5b7bc8b0a751de3
-
Filesize
5.6MB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
40KB