Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    07/07/2023, 20:01

General

  • Target

    61b58351b6c4f111d36c99a0b2423d39.exe

  • Size

    529KB

  • MD5

    61b58351b6c4f111d36c99a0b2423d39

  • SHA1

    2b702240763744c9e93f19905f744530d551cf3c

  • SHA256

    7f8953281cf918422ed33f6126aab3fe22a9ffe10a04a003320f348c96172cad

  • SHA512

    acad90e6dbee95ab217e9ebaabcf58cd7764590403305da89f95bccb3ce65954d94ab5847790594d606aee18e07b053187de190c27b340bdd4900dbff6b761f3

  • SSDEEP

    12288:2MgsfvmaRdnQgOtHKec+85cDJc3IhJFoQTDkgx:2Mgmvm82gGHPtACu4Dkgx

Malware Config

Extracted

Family

redline

Botnet

furod

C2

77.91.68.70:19073

Attributes
  • auth_value

    d2386245fe11799b28b4521492a5879d

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61b58351b6c4f111d36c99a0b2423d39.exe
    "C:\Users\Admin\AppData\Local\Temp\61b58351b6c4f111d36c99a0b2423d39.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2912

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe

    Filesize

    260KB

    MD5

    158369a68427f760955993a82c6cf6c1

    SHA1

    3ac577746adafbf4247ceceb2fdf79b7899857d6

    SHA256

    5a3bfd93f1a6251f884a110a582177f9238b0cf0aaebcaba59648e2e9c367cce

    SHA512

    dcff982504ba9c8d33f026bbc9deb3b1d020f0bb90144abe1cea7d1064dbf2ec8815e6d1856581af29f31090986108c67499eef31c21fcfa8a9e8b6ea58801fd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe

    Filesize

    260KB

    MD5

    158369a68427f760955993a82c6cf6c1

    SHA1

    3ac577746adafbf4247ceceb2fdf79b7899857d6

    SHA256

    5a3bfd93f1a6251f884a110a582177f9238b0cf0aaebcaba59648e2e9c367cce

    SHA512

    dcff982504ba9c8d33f026bbc9deb3b1d020f0bb90144abe1cea7d1064dbf2ec8815e6d1856581af29f31090986108c67499eef31c21fcfa8a9e8b6ea58801fd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe

    Filesize

    260KB

    MD5

    158369a68427f760955993a82c6cf6c1

    SHA1

    3ac577746adafbf4247ceceb2fdf79b7899857d6

    SHA256

    5a3bfd93f1a6251f884a110a582177f9238b0cf0aaebcaba59648e2e9c367cce

    SHA512

    dcff982504ba9c8d33f026bbc9deb3b1d020f0bb90144abe1cea7d1064dbf2ec8815e6d1856581af29f31090986108c67499eef31c21fcfa8a9e8b6ea58801fd

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe

    Filesize

    260KB

    MD5

    158369a68427f760955993a82c6cf6c1

    SHA1

    3ac577746adafbf4247ceceb2fdf79b7899857d6

    SHA256

    5a3bfd93f1a6251f884a110a582177f9238b0cf0aaebcaba59648e2e9c367cce

    SHA512

    dcff982504ba9c8d33f026bbc9deb3b1d020f0bb90144abe1cea7d1064dbf2ec8815e6d1856581af29f31090986108c67499eef31c21fcfa8a9e8b6ea58801fd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • memory/1336-54-0x0000000000260000-0x00000000002D4000-memory.dmp

    Filesize

    464KB

  • memory/1764-83-0x0000000000020000-0x000000000002A000-memory.dmp

    Filesize

    40KB

  • memory/2912-97-0x0000000000380000-0x00000000003B0000-memory.dmp

    Filesize

    192KB

  • memory/2912-101-0x0000000002170000-0x0000000002176000-memory.dmp

    Filesize

    24KB

  • memory/2912-102-0x00000000049B0000-0x00000000049F0000-memory.dmp

    Filesize

    256KB

  • memory/2912-103-0x00000000049B0000-0x00000000049F0000-memory.dmp

    Filesize

    256KB