Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    110s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/04/2023, 03:35

General

  • Target

    f760e7df17d296c44e06b23ecbc23710bdb1eb5434186a4891e5f84fb98adb0d.exe

  • Size

    1.2MB

  • MD5

    da3079cc55822bb7cdbcbc59bc76d638

  • SHA1

    ab970c59d314c28504bb9da0f60a1f7a505f48ff

  • SHA256

    f760e7df17d296c44e06b23ecbc23710bdb1eb5434186a4891e5f84fb98adb0d

  • SHA512

    48023fdaa512f092d9206dae57ce0663a34ed91a784f91ac56da4076442f3845f5604b395160a5c20a05caf82464eced1ffcb7057f80058a1a0573fb3cd06d9f

  • SSDEEP

    24576:9ye983CiQ+88RKXN6/DlnOYUfNTsijz99YJrkAEQk:YyYQND6i1TsdJEQ

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f760e7df17d296c44e06b23ecbc23710bdb1eb5434186a4891e5f84fb98adb0d.exe
    "C:\Users\Admin\AppData\Local\Temp\f760e7df17d296c44e06b23ecbc23710bdb1eb5434186a4891e5f84fb98adb0d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un063455.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un063455.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un923715.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un923715.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3572
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr096485.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr096485.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:304
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu609140.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu609140.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2844
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768430.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768430.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3180
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si176184.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si176184.exe
      2⤵
      • Executes dropped EXE
      PID:4708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 632
        3⤵
        • Program crash
        PID:4416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 708
        3⤵
        • Program crash
        PID:2680
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 808
        3⤵
        • Program crash
        PID:3000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 856
        3⤵
        • Program crash
        PID:4712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 884
        3⤵
        • Program crash
        PID:4056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 812
        3⤵
        • Program crash
        PID:1172
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1132
        3⤵
        • Program crash
        PID:4264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1160
        3⤵
        • Program crash
        PID:4144
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1144
        3⤵
        • Program crash
        PID:4836

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si176184.exe

    Filesize

    397KB

    MD5

    73322119dde2931ef4675da872b6e388

    SHA1

    666909e836d4896520d7b01669820f0e8eb103a1

    SHA256

    a79c5393e57aa37ec1e86e848e11468788a7b9e9f580b8ce551913a3add57cd3

    SHA512

    360a30c047d52828252bb6aa484a900e00f6671bd5efdc27845476701b1c9ffcdbcfc7e5b3dceac05d89b83a66273b9e5b9dbd8e982810ba94fd226af216faef

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si176184.exe

    Filesize

    397KB

    MD5

    73322119dde2931ef4675da872b6e388

    SHA1

    666909e836d4896520d7b01669820f0e8eb103a1

    SHA256

    a79c5393e57aa37ec1e86e848e11468788a7b9e9f580b8ce551913a3add57cd3

    SHA512

    360a30c047d52828252bb6aa484a900e00f6671bd5efdc27845476701b1c9ffcdbcfc7e5b3dceac05d89b83a66273b9e5b9dbd8e982810ba94fd226af216faef

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un063455.exe

    Filesize

    865KB

    MD5

    65f2e13b0ee3e43967a11bc232468f15

    SHA1

    ed429391ed9716a0fea74446ef87c3807bf278eb

    SHA256

    dd7f9cf01dd2d880d5b002df2a1eb0888200d4ae7f36aa722811b9f2454035cd

    SHA512

    9dd97d9f192ea0576411b67cae8e0b9f7f723bcde9b5c109796fb653278f362bd6dc6f05cf703fb28ea1a1c981278ade53918317148e0913d7af6cae170fa312

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un063455.exe

    Filesize

    865KB

    MD5

    65f2e13b0ee3e43967a11bc232468f15

    SHA1

    ed429391ed9716a0fea74446ef87c3807bf278eb

    SHA256

    dd7f9cf01dd2d880d5b002df2a1eb0888200d4ae7f36aa722811b9f2454035cd

    SHA512

    9dd97d9f192ea0576411b67cae8e0b9f7f723bcde9b5c109796fb653278f362bd6dc6f05cf703fb28ea1a1c981278ade53918317148e0913d7af6cae170fa312

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768430.exe

    Filesize

    169KB

    MD5

    71f9e4774fc3869cf4c53fa9c370af65

    SHA1

    24fc0601f560a24f7fd7c04b58981c96a2a7fa9f

    SHA256

    6a551787a1ebbf37e3499fc1b11afc3e5d3c95b75e825160f3d021f0e3ad904c

    SHA512

    3c06dec3ca99ec9b7eb38de5cc74a0547fcc3181672ea90102d72a0bbe4a655b3e0e32981a5c5fb52afc7fff5d27a634b488b4c9e2bd6715a8cefb0fbefad8bb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk768430.exe

    Filesize

    169KB

    MD5

    71f9e4774fc3869cf4c53fa9c370af65

    SHA1

    24fc0601f560a24f7fd7c04b58981c96a2a7fa9f

    SHA256

    6a551787a1ebbf37e3499fc1b11afc3e5d3c95b75e825160f3d021f0e3ad904c

    SHA512

    3c06dec3ca99ec9b7eb38de5cc74a0547fcc3181672ea90102d72a0bbe4a655b3e0e32981a5c5fb52afc7fff5d27a634b488b4c9e2bd6715a8cefb0fbefad8bb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un923715.exe

    Filesize

    711KB

    MD5

    ae325126b1fdd68cd7ed4245c65ae29b

    SHA1

    4bb73e3c14cbfb97da6bd718b9379c57194374f3

    SHA256

    e2748b5d6a8c853db739aeb32484f47a7ae4e881a0a99dd2e33d5019d713ba1f

    SHA512

    fd417e75103f3e22d980377f2ff78ada1e79598cdb2e1c5c7ba07e5327deb8f2337754dcb18f0ef5c58cac797f267d08367ebb0744fbaa055e26f93f336c0a3b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un923715.exe

    Filesize

    711KB

    MD5

    ae325126b1fdd68cd7ed4245c65ae29b

    SHA1

    4bb73e3c14cbfb97da6bd718b9379c57194374f3

    SHA256

    e2748b5d6a8c853db739aeb32484f47a7ae4e881a0a99dd2e33d5019d713ba1f

    SHA512

    fd417e75103f3e22d980377f2ff78ada1e79598cdb2e1c5c7ba07e5327deb8f2337754dcb18f0ef5c58cac797f267d08367ebb0744fbaa055e26f93f336c0a3b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr096485.exe

    Filesize

    405KB

    MD5

    fda00e7c37049d9c7a4f3acc0ae159f8

    SHA1

    3c70835a75d5665d6c3f5ed079bcc28d34afb845

    SHA256

    12b425c97090f2b23ab064c8b1c631cf17e8eba5a1195a2a8eeddc36f4a4a97f

    SHA512

    80f0a24a645904338dfa29a372dd5a336a1f3a539fcc5868c4a7eac70628e7993ccb7189c498e0055bdc112d56c37e5ac50ca4218a3d8de31e8651dc39be585d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr096485.exe

    Filesize

    405KB

    MD5

    fda00e7c37049d9c7a4f3acc0ae159f8

    SHA1

    3c70835a75d5665d6c3f5ed079bcc28d34afb845

    SHA256

    12b425c97090f2b23ab064c8b1c631cf17e8eba5a1195a2a8eeddc36f4a4a97f

    SHA512

    80f0a24a645904338dfa29a372dd5a336a1f3a539fcc5868c4a7eac70628e7993ccb7189c498e0055bdc112d56c37e5ac50ca4218a3d8de31e8651dc39be585d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu609140.exe

    Filesize

    588KB

    MD5

    21546331b147aaee970fd4af71d1f9fe

    SHA1

    ccc6dd9581f70052833df7d89368ae0d1a8b6298

    SHA256

    23a0d729e44ed3989a9c0907bea9fd6da09eeee46aba6a31b42d7e934fa2e702

    SHA512

    a0f92281fa66769c45faf713512852086ede5541bb4bcaa8eeee19b17335a1be70c1de771523f71b2f0ba7216e4e8fa01b7672be7f00f9ac7382b4b39394429b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu609140.exe

    Filesize

    588KB

    MD5

    21546331b147aaee970fd4af71d1f9fe

    SHA1

    ccc6dd9581f70052833df7d89368ae0d1a8b6298

    SHA256

    23a0d729e44ed3989a9c0907bea9fd6da09eeee46aba6a31b42d7e934fa2e702

    SHA512

    a0f92281fa66769c45faf713512852086ede5541bb4bcaa8eeee19b17335a1be70c1de771523f71b2f0ba7216e4e8fa01b7672be7f00f9ac7382b4b39394429b

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/304-165-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-181-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

    Filesize

    64KB

  • memory/304-155-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-157-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-159-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-161-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-163-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-151-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-167-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-169-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-171-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-173-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-175-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-177-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-178-0x0000000000400000-0x000000000080A000-memory.dmp

    Filesize

    4.0MB

  • memory/304-179-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

    Filesize

    64KB

  • memory/304-180-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

    Filesize

    64KB

  • memory/304-146-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

    Filesize

    64KB

  • memory/304-183-0x0000000000400000-0x000000000080A000-memory.dmp

    Filesize

    4.0MB

  • memory/304-150-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/304-149-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

    Filesize

    64KB

  • memory/304-143-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/304-144-0x0000000002490000-0x00000000024AA000-memory.dmp

    Filesize

    104KB

  • memory/304-147-0x0000000002790000-0x00000000027A8000-memory.dmp

    Filesize

    96KB

  • memory/304-148-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

    Filesize

    64KB

  • memory/304-145-0x0000000004FD0000-0x00000000054CE000-memory.dmp

    Filesize

    5.0MB

  • memory/304-153-0x0000000002790000-0x00000000027A2000-memory.dmp

    Filesize

    72KB

  • memory/2844-2358-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

    Filesize

    64KB

  • memory/2844-2360-0x00000000058D0000-0x0000000005962000-memory.dmp

    Filesize

    584KB

  • memory/2844-2348-0x0000000004B50000-0x0000000004B56000-memory.dmp

    Filesize

    24KB

  • memory/2844-2362-0x00000000067E0000-0x00000000069A2000-memory.dmp

    Filesize

    1.8MB

  • memory/2844-2363-0x0000000008560000-0x0000000008A8C000-memory.dmp

    Filesize

    5.2MB

  • memory/2844-2345-0x00000000003A0000-0x00000000003CE000-memory.dmp

    Filesize

    184KB

  • memory/2844-2365-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

    Filesize

    64KB

  • memory/3180-2352-0x000000000AAB0000-0x000000000B0B6000-memory.dmp

    Filesize

    6.0MB

  • memory/3180-2359-0x000000000A870000-0x000000000A8E6000-memory.dmp

    Filesize

    472KB

  • memory/3180-2366-0x000000000BC40000-0x000000000BC90000-memory.dmp

    Filesize

    320KB

  • memory/3180-2364-0x0000000005110000-0x0000000005120000-memory.dmp

    Filesize

    64KB

  • memory/3180-2361-0x000000000AA30000-0x000000000AA96000-memory.dmp

    Filesize

    408KB

  • memory/3180-2357-0x0000000005110000-0x0000000005120000-memory.dmp

    Filesize

    64KB

  • memory/3180-2356-0x000000000A6D0000-0x000000000A71B000-memory.dmp

    Filesize

    300KB

  • memory/3180-2355-0x000000000A550000-0x000000000A58E000-memory.dmp

    Filesize

    248KB

  • memory/3180-2354-0x000000000A4F0000-0x000000000A502000-memory.dmp

    Filesize

    72KB

  • memory/3180-2353-0x000000000A5C0000-0x000000000A6CA000-memory.dmp

    Filesize

    1.0MB

  • memory/3180-2351-0x00000000027F0000-0x00000000027F6000-memory.dmp

    Filesize

    24KB

  • memory/3180-2350-0x00000000007C0000-0x00000000007F0000-memory.dmp

    Filesize

    192KB

  • memory/4708-2373-0x0000000002440000-0x000000000247B000-memory.dmp

    Filesize

    236KB

  • memory/4752-221-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-214-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB

  • memory/4752-207-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-205-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-203-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-201-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-2336-0x0000000005630000-0x0000000005662000-memory.dmp

    Filesize

    200KB

  • memory/4752-227-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-199-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-225-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-223-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-2338-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB

  • memory/4752-209-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-213-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-193-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-210-0x00000000009B0000-0x0000000000A0B000-memory.dmp

    Filesize

    364KB

  • memory/4752-195-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-219-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-197-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-191-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-216-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB

  • memory/4752-190-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-217-0x00000000028E0000-0x0000000002940000-memory.dmp

    Filesize

    384KB

  • memory/4752-189-0x00000000028E0000-0x0000000002946000-memory.dmp

    Filesize

    408KB

  • memory/4752-188-0x0000000002760000-0x00000000027C8000-memory.dmp

    Filesize

    416KB

  • memory/4752-212-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB