Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    104s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/04/2023, 13:38

General

  • Target

    86e04407dd16424ca4092a92bedaa961ce1cf89e05f7187794342a62bc28120a.exe

  • Size

    940KB

  • MD5

    1a2c90ff28af428fca34e56320fbec88

  • SHA1

    517bf2995c3c048fef2d91f248f3549238793a6d

  • SHA256

    86e04407dd16424ca4092a92bedaa961ce1cf89e05f7187794342a62bc28120a

  • SHA512

    7eb6a4f21a1d98c7e9347d709f67d8503f42a0d914fa603488e2fe351f5fa822573ecf350c6e931740de4cf29d2cdcc2524581d4bddb185bce42b85d91708a1c

  • SSDEEP

    24576:vylRe0mMydLygKTnBtANtJnYTmJsb08Cktv6:6reL3s0NsyybX

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diro

C2

185.161.248.90:4125

Attributes
  • auth_value

    ae95bda0dd2e95169886a3a68138568b

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86e04407dd16424ca4092a92bedaa961ce1cf89e05f7187794342a62bc28120a.exe
    "C:\Users\Admin\AppData\Local\Temp\86e04407dd16424ca4092a92bedaa961ce1cf89e05f7187794342a62bc28120a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGE7611.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGE7611.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zijZ5452.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zijZ5452.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it193709.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it193709.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4548
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr926066.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr926066.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp643776.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp643776.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr173538.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr173538.exe
      2⤵
      • Executes dropped EXE
      PID:2228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 616
        3⤵
        • Program crash
        PID:3376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 708
        3⤵
        • Program crash
        PID:4708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 836
        3⤵
        • Program crash
        PID:4548
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 640
        3⤵
        • Program crash
        PID:3944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 872
        3⤵
        • Program crash
        PID:3748
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 832
        3⤵
        • Program crash
        PID:3724
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1116
        3⤵
        • Program crash
        PID:1292
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1148
        3⤵
        • Program crash
        PID:3524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1144
        3⤵
        • Program crash
        PID:2924

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr173538.exe

    Filesize

    253KB

    MD5

    ccf548678a6b0c7fa4eb57c8c8d68d8a

    SHA1

    cee33b5a6f8d99181c7f763472e2518f690015d2

    SHA256

    56c2b6454635520e95bf5040b0bb9cfe1f6c2fb9503bd12790aacfe1250ec8fc

    SHA512

    99fe9d93284a80ea536a2456c843a165ee03123d914a9f68e066de1bb432dedb2a48f258286b27c5621e36684b10b6630b3498e110844ca238bcaf260878317b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr173538.exe

    Filesize

    253KB

    MD5

    ccf548678a6b0c7fa4eb57c8c8d68d8a

    SHA1

    cee33b5a6f8d99181c7f763472e2518f690015d2

    SHA256

    56c2b6454635520e95bf5040b0bb9cfe1f6c2fb9503bd12790aacfe1250ec8fc

    SHA512

    99fe9d93284a80ea536a2456c843a165ee03123d914a9f68e066de1bb432dedb2a48f258286b27c5621e36684b10b6630b3498e110844ca238bcaf260878317b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGE7611.exe

    Filesize

    668KB

    MD5

    9fa92165b27cc29c8c5a83ba0849e391

    SHA1

    eec5d303045d7f78788ba41ea78d3c07416f1d12

    SHA256

    93d038329083f08cf6cdf314e35b4c2bf417e16cf0fb5fd97da8ee4b9c8c8674

    SHA512

    fc8ce2c43c05006a9f38041fa5dd394ab023b76944a47f929391c54acb550b64f27b98110d45ee69ae2bd8e058d5633f64d08543be693555eec6dddce4f29d2f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGE7611.exe

    Filesize

    668KB

    MD5

    9fa92165b27cc29c8c5a83ba0849e391

    SHA1

    eec5d303045d7f78788ba41ea78d3c07416f1d12

    SHA256

    93d038329083f08cf6cdf314e35b4c2bf417e16cf0fb5fd97da8ee4b9c8c8674

    SHA512

    fc8ce2c43c05006a9f38041fa5dd394ab023b76944a47f929391c54acb550b64f27b98110d45ee69ae2bd8e058d5633f64d08543be693555eec6dddce4f29d2f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp643776.exe

    Filesize

    168KB

    MD5

    41457be49d07712ed2a33bf002fb07bf

    SHA1

    55c9d2a031c26864b82ad3693eca165f33d75ba6

    SHA256

    b56d9563eabaf1619471b1fc7af683a29225acfcd766005e4d7bbc433f7d980a

    SHA512

    2645f6607feb6de93ffe052ae2ad0df3077d73517f748d0b23a91d5a2423520df0d3c8cf42fe63aa5836a73489d73dd2e0c083ebd305cdbdf54b20c942beecf6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp643776.exe

    Filesize

    168KB

    MD5

    41457be49d07712ed2a33bf002fb07bf

    SHA1

    55c9d2a031c26864b82ad3693eca165f33d75ba6

    SHA256

    b56d9563eabaf1619471b1fc7af683a29225acfcd766005e4d7bbc433f7d980a

    SHA512

    2645f6607feb6de93ffe052ae2ad0df3077d73517f748d0b23a91d5a2423520df0d3c8cf42fe63aa5836a73489d73dd2e0c083ebd305cdbdf54b20c942beecf6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zijZ5452.exe

    Filesize

    514KB

    MD5

    fefb8eea8fcc318412bd2b352c628ab2

    SHA1

    13e42886b247971fa8c905de21073beea96cb16e

    SHA256

    6f7fa3ef58d18a4f590653a7881262d27b4f1740c89383370afedbdb18e12eb9

    SHA512

    5f9b24ee53b997406b936e4696b40dbd9fbb7d09fe400572bed4315b1c0d43bcb5d9ec297c9354f80facc554671c20b4496a82cc5fdc61f812bb2f1767856ff6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zijZ5452.exe

    Filesize

    514KB

    MD5

    fefb8eea8fcc318412bd2b352c628ab2

    SHA1

    13e42886b247971fa8c905de21073beea96cb16e

    SHA256

    6f7fa3ef58d18a4f590653a7881262d27b4f1740c89383370afedbdb18e12eb9

    SHA512

    5f9b24ee53b997406b936e4696b40dbd9fbb7d09fe400572bed4315b1c0d43bcb5d9ec297c9354f80facc554671c20b4496a82cc5fdc61f812bb2f1767856ff6

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it193709.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it193709.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr926066.exe

    Filesize

    445KB

    MD5

    c1fdb8ffc5a520015259bcc8d882b0ba

    SHA1

    3b51ea868e204ba0da769c5d68d9bcc7b0006f11

    SHA256

    f218c3c3eb1e01f61820801b605df21d1368cc23a9d2f211161ec9d02d8da562

    SHA512

    8886ffc8ae8f0136253a746957f5998c14dbeaa5911e7f61b8a41680497cd16dcbffae9735cf57b83bb962104a0194e6ed877ccab40ea48e3251a2e201d1f1dc

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr926066.exe

    Filesize

    445KB

    MD5

    c1fdb8ffc5a520015259bcc8d882b0ba

    SHA1

    3b51ea868e204ba0da769c5d68d9bcc7b0006f11

    SHA256

    f218c3c3eb1e01f61820801b605df21d1368cc23a9d2f211161ec9d02d8da562

    SHA512

    8886ffc8ae8f0136253a746957f5998c14dbeaa5911e7f61b8a41680497cd16dcbffae9735cf57b83bb962104a0194e6ed877ccab40ea48e3251a2e201d1f1dc

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/312-2316-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

    Filesize

    72KB

  • memory/312-2326-0x00000000061D0000-0x0000000006220000-memory.dmp

    Filesize

    320KB

  • memory/312-2307-0x00000000005E0000-0x000000000060E000-memory.dmp

    Filesize

    184KB

  • memory/312-2311-0x00000000027B0000-0x00000000027B6000-memory.dmp

    Filesize

    24KB

  • memory/312-2327-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/312-2314-0x0000000005550000-0x0000000005B56000-memory.dmp

    Filesize

    6.0MB

  • memory/312-2315-0x0000000005050000-0x000000000515A000-memory.dmp

    Filesize

    1.0MB

  • memory/312-2319-0x0000000004E30000-0x0000000004E40000-memory.dmp

    Filesize

    64KB

  • memory/312-2318-0x0000000004FC0000-0x000000000500B000-memory.dmp

    Filesize

    300KB

  • memory/1864-2317-0x0000000004DE0000-0x0000000004E1E000-memory.dmp

    Filesize

    248KB

  • memory/1864-2324-0x0000000006370000-0x0000000006532000-memory.dmp

    Filesize

    1.8MB

  • memory/1864-2320-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/1864-2325-0x00000000082F0000-0x000000000881C000-memory.dmp

    Filesize

    5.2MB

  • memory/1864-2313-0x00000000028E0000-0x00000000028E6000-memory.dmp

    Filesize

    24KB

  • memory/1864-2321-0x0000000005210000-0x0000000005286000-memory.dmp

    Filesize

    472KB

  • memory/1864-2322-0x0000000005330000-0x00000000053C2000-memory.dmp

    Filesize

    584KB

  • memory/1864-2312-0x0000000000580000-0x00000000005B0000-memory.dmp

    Filesize

    192KB

  • memory/1864-2328-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/1864-2323-0x0000000005290000-0x00000000052F6000-memory.dmp

    Filesize

    408KB

  • memory/2228-2335-0x0000000000580000-0x00000000005BB000-memory.dmp

    Filesize

    236KB

  • memory/4152-159-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-181-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-193-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-195-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-197-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-199-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-201-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-203-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-205-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-207-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-209-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-211-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-213-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-215-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-217-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-2298-0x0000000002520000-0x0000000002552000-memory.dmp

    Filesize

    200KB

  • memory/4152-2300-0x0000000004C00000-0x0000000004C10000-memory.dmp

    Filesize

    64KB

  • memory/4152-189-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-187-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-185-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-183-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-191-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-179-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-177-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-175-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-173-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-171-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-169-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-167-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-165-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-163-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-161-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-157-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-156-0x0000000004B20000-0x0000000004B80000-memory.dmp

    Filesize

    384KB

  • memory/4152-155-0x0000000004C00000-0x0000000004C10000-memory.dmp

    Filesize

    64KB

  • memory/4152-154-0x0000000004C00000-0x0000000004C10000-memory.dmp

    Filesize

    64KB

  • memory/4152-153-0x0000000004C00000-0x0000000004C10000-memory.dmp

    Filesize

    64KB

  • memory/4152-152-0x0000000000610000-0x000000000066B000-memory.dmp

    Filesize

    364KB

  • memory/4152-151-0x0000000004B20000-0x0000000004B86000-memory.dmp

    Filesize

    408KB

  • memory/4152-150-0x0000000004D10000-0x000000000520E000-memory.dmp

    Filesize

    5.0MB

  • memory/4152-149-0x0000000002560000-0x00000000025C8000-memory.dmp

    Filesize

    416KB

  • memory/4548-144-0x00000000011D0000-0x0000000001259000-memory.dmp

    Filesize

    548KB

  • memory/4548-142-0x0000000000D30000-0x0000000000D3A000-memory.dmp

    Filesize

    40KB