Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    107s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/04/2023, 03:46

General

  • Target

    4405f9b5e9321518a0b73255af4c16cd69b376348ea5cab0b157a67c7abfd65c.exe

  • Size

    1.0MB

  • MD5

    55a536ad2885e6176eacf48e1496c88f

  • SHA1

    3227347217a682bd8791ae038b30262c1cdbd3c9

  • SHA256

    4405f9b5e9321518a0b73255af4c16cd69b376348ea5cab0b157a67c7abfd65c

  • SHA512

    9ae74537c0c94a857a41f61a2ecd9be14c85e3d291a543d537628a4b0695dbcd1ee21066c4302b776ef06bc29f5fce83132de1f56ddb3f9dfa05df209c3815aa

  • SSDEEP

    24576:hyzOrKi8KgLXWyIjbgT2wjrOlnty++HHkeCuioR8RCv:U1iuWyeErCM+MkdboiRC

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4405f9b5e9321518a0b73255af4c16cd69b376348ea5cab0b157a67c7abfd65c.exe
    "C:\Users\Admin\AppData\Local\Temp\4405f9b5e9321518a0b73255af4c16cd69b376348ea5cab0b157a67c7abfd65c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGP0236.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGP0236.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zias1201.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zias1201.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3572
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it255811.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it255811.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:304
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr328294.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr328294.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3924
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2012
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp003892.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp003892.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1820
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr016842.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr016842.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:4088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 632
        3⤵
        • Program crash
        PID:1416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 708
        3⤵
        • Program crash
        PID:992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 836
        3⤵
        • Program crash
        PID:304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 856
        3⤵
        • Program crash
        PID:4732
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 892
        3⤵
        • Program crash
        PID:4692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 872
        3⤵
        • Program crash
        PID:1904
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 1136
        3⤵
        • Program crash
        PID:4180
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 1160
        3⤵
        • Program crash
        PID:3000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 1168
        3⤵
        • Program crash
        PID:4700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr016842.exe

    Filesize

    397KB

    MD5

    73322119dde2931ef4675da872b6e388

    SHA1

    666909e836d4896520d7b01669820f0e8eb103a1

    SHA256

    a79c5393e57aa37ec1e86e848e11468788a7b9e9f580b8ce551913a3add57cd3

    SHA512

    360a30c047d52828252bb6aa484a900e00f6671bd5efdc27845476701b1c9ffcdbcfc7e5b3dceac05d89b83a66273b9e5b9dbd8e982810ba94fd226af216faef

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr016842.exe

    Filesize

    397KB

    MD5

    73322119dde2931ef4675da872b6e388

    SHA1

    666909e836d4896520d7b01669820f0e8eb103a1

    SHA256

    a79c5393e57aa37ec1e86e848e11468788a7b9e9f580b8ce551913a3add57cd3

    SHA512

    360a30c047d52828252bb6aa484a900e00f6671bd5efdc27845476701b1c9ffcdbcfc7e5b3dceac05d89b83a66273b9e5b9dbd8e982810ba94fd226af216faef

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGP0236.exe

    Filesize

    723KB

    MD5

    2c99ac2b5351ae85f76a8a686c59903f

    SHA1

    b37d00433ff1c8da752f14da2c12dcdbf725c923

    SHA256

    fae702b0ee59e650d7e62f02cb6b32d273db4e78c2fb82f22035fe832cb22cce

    SHA512

    98a0c6bfcc482052703acfba5269bebf96380e3b6705ab02d8e5044eb1b53d0b6aa9b54b7ea1e48ff8f8bc61c236a0d80222fc00e7e44e24ec69019cf4675df4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGP0236.exe

    Filesize

    723KB

    MD5

    2c99ac2b5351ae85f76a8a686c59903f

    SHA1

    b37d00433ff1c8da752f14da2c12dcdbf725c923

    SHA256

    fae702b0ee59e650d7e62f02cb6b32d273db4e78c2fb82f22035fe832cb22cce

    SHA512

    98a0c6bfcc482052703acfba5269bebf96380e3b6705ab02d8e5044eb1b53d0b6aa9b54b7ea1e48ff8f8bc61c236a0d80222fc00e7e44e24ec69019cf4675df4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp003892.exe

    Filesize

    169KB

    MD5

    fd32c1ff9983eb9666877eff376f4259

    SHA1

    83268888c97eb33f0500c78f3453be42a98eec2a

    SHA256

    e2e3b8fc6256ab9e28536c728a2d9ea2f29597247931b433e252e12f81e57ddb

    SHA512

    bccae9d03db4ca4cfa0f587b71c48b7a565c6acd3f89f67d2fe2ac2367a28914fb71f8b63c28eddf6a7872bd414c326eca952163bb55d15c8613e9814b05df60

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp003892.exe

    Filesize

    169KB

    MD5

    fd32c1ff9983eb9666877eff376f4259

    SHA1

    83268888c97eb33f0500c78f3453be42a98eec2a

    SHA256

    e2e3b8fc6256ab9e28536c728a2d9ea2f29597247931b433e252e12f81e57ddb

    SHA512

    bccae9d03db4ca4cfa0f587b71c48b7a565c6acd3f89f67d2fe2ac2367a28914fb71f8b63c28eddf6a7872bd414c326eca952163bb55d15c8613e9814b05df60

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zias1201.exe

    Filesize

    569KB

    MD5

    384df28a0e7bb501d97b0047902b7e2a

    SHA1

    16b31f33d3c25f78dfb10edd1987841b70f74707

    SHA256

    9c7a8c6c619776e7fa2b5b8f0fe3d4bb1aec1e22ed5f35661193e780090625f9

    SHA512

    b0b027eb2018ffe3e6472a49cdfd85b44d6040a6109528e5bcfa61663dd7bede82550de6096300682cf9ae6177ffd1e93b151ee271666bc94534942eec703064

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zias1201.exe

    Filesize

    569KB

    MD5

    384df28a0e7bb501d97b0047902b7e2a

    SHA1

    16b31f33d3c25f78dfb10edd1987841b70f74707

    SHA256

    9c7a8c6c619776e7fa2b5b8f0fe3d4bb1aec1e22ed5f35661193e780090625f9

    SHA512

    b0b027eb2018ffe3e6472a49cdfd85b44d6040a6109528e5bcfa61663dd7bede82550de6096300682cf9ae6177ffd1e93b151ee271666bc94534942eec703064

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it255811.exe

    Filesize

    11KB

    MD5

    d40d25877fc2e532a92dec2f42cc746b

    SHA1

    a7bc67d783582d65825a6a3f9974f54e4a087ac0

    SHA256

    7ba065644bec11de641557876b2fa2f7cf2b905b5d5982b5af03b3dd5b070728

    SHA512

    0766974f5b7c2cf86d8b68daceb6bf5e0978d17d403caf682029eab87ace30d963e870fc9121022a2ebdbd2495a3dc3b2e5b96730b3d6adfe5a387198add5860

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it255811.exe

    Filesize

    11KB

    MD5

    d40d25877fc2e532a92dec2f42cc746b

    SHA1

    a7bc67d783582d65825a6a3f9974f54e4a087ac0

    SHA256

    7ba065644bec11de641557876b2fa2f7cf2b905b5d5982b5af03b3dd5b070728

    SHA512

    0766974f5b7c2cf86d8b68daceb6bf5e0978d17d403caf682029eab87ace30d963e870fc9121022a2ebdbd2495a3dc3b2e5b96730b3d6adfe5a387198add5860

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr328294.exe

    Filesize

    588KB

    MD5

    3b2561035ea462665ec96928c23f13d8

    SHA1

    4a4ccbdfd0b134e92e2d724d0246931dfd2d4718

    SHA256

    f978671bd1e58bac0c25877aeb7c11e1474c090c148055464c82f7eea5630d8a

    SHA512

    e9d84779ef06db39cebe680a258ee92af93f0d05eb7f6e88b5b427665feaed1831459571968a3960b35a52c66762f40b1fa7f0e91dbb14e95d1770358e85a361

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr328294.exe

    Filesize

    588KB

    MD5

    3b2561035ea462665ec96928c23f13d8

    SHA1

    4a4ccbdfd0b134e92e2d724d0246931dfd2d4718

    SHA256

    f978671bd1e58bac0c25877aeb7c11e1474c090c148055464c82f7eea5630d8a

    SHA512

    e9d84779ef06db39cebe680a258ee92af93f0d05eb7f6e88b5b427665feaed1831459571968a3960b35a52c66762f40b1fa7f0e91dbb14e95d1770358e85a361

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/304-142-0x00000000007E0000-0x00000000007EA000-memory.dmp

    Filesize

    40KB

  • memory/1820-2327-0x000000000BDC0000-0x000000000BF82000-memory.dmp

    Filesize

    1.8MB

  • memory/1820-2325-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/1820-2312-0x00000000006E0000-0x0000000000710000-memory.dmp

    Filesize

    192KB

  • memory/1820-2313-0x0000000002880000-0x0000000002886000-memory.dmp

    Filesize

    24KB

  • memory/1820-2315-0x000000000A4E0000-0x000000000A5EA000-memory.dmp

    Filesize

    1.0MB

  • memory/1820-2320-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/2012-2323-0x0000000004EA0000-0x0000000004F06000-memory.dmp

    Filesize

    408KB

  • memory/2012-2318-0x0000000004C80000-0x0000000004CCB000-memory.dmp

    Filesize

    300KB

  • memory/2012-2317-0x0000000004B00000-0x0000000004B3E000-memory.dmp

    Filesize

    248KB

  • memory/2012-2316-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

    Filesize

    72KB

  • memory/2012-2319-0x00000000021E0000-0x00000000021F0000-memory.dmp

    Filesize

    64KB

  • memory/2012-2314-0x0000000005070000-0x0000000005676000-memory.dmp

    Filesize

    6.0MB

  • memory/2012-2321-0x0000000004E20000-0x0000000004E96000-memory.dmp

    Filesize

    472KB

  • memory/2012-2322-0x0000000004F40000-0x0000000004FD2000-memory.dmp

    Filesize

    584KB

  • memory/2012-2311-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/2012-2324-0x00000000021E0000-0x00000000021F0000-memory.dmp

    Filesize

    64KB

  • memory/2012-2326-0x0000000005C90000-0x0000000005CE0000-memory.dmp

    Filesize

    320KB

  • memory/2012-2307-0x0000000000190000-0x00000000001BE000-memory.dmp

    Filesize

    184KB

  • memory/2012-2328-0x0000000007310000-0x000000000783C000-memory.dmp

    Filesize

    5.2MB

  • memory/3924-160-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-182-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-194-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-196-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-198-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-200-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-202-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-204-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-206-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-208-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-210-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-214-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-216-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-212-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-218-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-2297-0x0000000004F20000-0x0000000004F52000-memory.dmp

    Filesize

    200KB

  • memory/3924-2300-0x0000000004F60000-0x0000000004F70000-memory.dmp

    Filesize

    64KB

  • memory/3924-190-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-188-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-186-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-184-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-192-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-180-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-178-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-176-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-174-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-172-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-170-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-168-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-166-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-164-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-162-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-158-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-156-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-155-0x0000000002820000-0x0000000002880000-memory.dmp

    Filesize

    384KB

  • memory/3924-154-0x0000000004F60000-0x0000000004F70000-memory.dmp

    Filesize

    64KB

  • memory/3924-153-0x0000000004F60000-0x0000000004F70000-memory.dmp

    Filesize

    64KB

  • memory/3924-152-0x0000000004F60000-0x0000000004F70000-memory.dmp

    Filesize

    64KB

  • memory/3924-151-0x0000000002820000-0x0000000002886000-memory.dmp

    Filesize

    408KB

  • memory/3924-150-0x0000000005070000-0x000000000556E000-memory.dmp

    Filesize

    5.0MB

  • memory/3924-149-0x0000000002700000-0x0000000002768000-memory.dmp

    Filesize

    416KB

  • memory/3924-148-0x00000000009B0000-0x0000000000A0B000-memory.dmp

    Filesize

    364KB

  • memory/4088-2335-0x0000000000B30000-0x0000000000B6B000-memory.dmp

    Filesize

    236KB