Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/07/2023, 15:00

General

  • Target

    d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe

  • Size

    389KB

  • MD5

    a7b11d69d97cc765f11a42cd44464f05

  • SHA1

    5a8f7af21f617e81d3d2f47b76ced3d7edb15681

  • SHA256

    d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77

  • SHA512

    436e936007def7fb84ed60d0258feb9c053479891d19eb640357ff3853c9987d757b153d26ab8d326776def54c274a8dff24af44da85e44a644aaae5b0607bc0

  • SSDEEP

    6144:Kgy+bnr+5p0yN90QEB9k3vBt6mHDQvgB4ikaVIIhX3dMfiHwG6iE0WCzIb0p:EMr5y90Jkfv6mHEvo4ikh8nUij6iPgm

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes
  • auth_value

    6da71218d8a9738ea3a9a78b5677589b

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe
    "C:\Users\Admin\AppData\Local\Temp\d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4328
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe
        3⤵
        • Executes dropped EXE
        PID:384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe

    Filesize

    206KB

    MD5

    abef71969f621b096119dde240a98be9

    SHA1

    df40430ba952d5adfad043a7f50b4acd19604440

    SHA256

    917d34dd1e19da9b4f421bdbd3c2122f70c923353b827ace159d30a2a9315d54

    SHA512

    92cddb5de433d023c4c660adffd2095371eb35169e9a9959b11f8f2071d1807815f51f18019c21feb16e5f1bb251d08bec4cb8029b41614bc3469ae85ce443d2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe

    Filesize

    206KB

    MD5

    abef71969f621b096119dde240a98be9

    SHA1

    df40430ba952d5adfad043a7f50b4acd19604440

    SHA256

    917d34dd1e19da9b4f421bdbd3c2122f70c923353b827ace159d30a2a9315d54

    SHA512

    92cddb5de433d023c4c660adffd2095371eb35169e9a9959b11f8f2071d1807815f51f18019c21feb16e5f1bb251d08bec4cb8029b41614bc3469ae85ce443d2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe

    Filesize

    15KB

    MD5

    707032d7184f6c1e6a9c408374f3952f

    SHA1

    28e1a736574d68b027a1e11d489497dbf8e621d8

    SHA256

    c88a1a24b0e9b2922d01334680defb263bfa6d8d9ae9d838cc0fdf48307b5934

    SHA512

    9a973496d9faa8e014f9664ccda114fe9b0b8f60987ee3cd5fdfb732ff07614a2c113b8cab734cc3393d1fa359b7fc6b0b7327985c9fbe5c8c5f24d9fdeb02f5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe

    Filesize

    15KB

    MD5

    707032d7184f6c1e6a9c408374f3952f

    SHA1

    28e1a736574d68b027a1e11d489497dbf8e621d8

    SHA256

    c88a1a24b0e9b2922d01334680defb263bfa6d8d9ae9d838cc0fdf48307b5934

    SHA512

    9a973496d9faa8e014f9664ccda114fe9b0b8f60987ee3cd5fdfb732ff07614a2c113b8cab734cc3393d1fa359b7fc6b0b7327985c9fbe5c8c5f24d9fdeb02f5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe

    Filesize

    174KB

    MD5

    30bafade03d77b96bddc0e3eaffe81b9

    SHA1

    9fb93ef406f4f424baa8c8507c0a37da10b3c8ed

    SHA256

    4eda8ad90040a90c9b8ac30a2b0d43df6026c9630b466777b51234764379c8ca

    SHA512

    27c76dda83ae53c9d5f03e6573176ea976c61ff40c3d5cbf5dab61802c44864e444cd9df5e6a5cb18d437d229a3a84361907b5d31c152d21e827fe13d68b0427

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe

    Filesize

    174KB

    MD5

    30bafade03d77b96bddc0e3eaffe81b9

    SHA1

    9fb93ef406f4f424baa8c8507c0a37da10b3c8ed

    SHA256

    4eda8ad90040a90c9b8ac30a2b0d43df6026c9630b466777b51234764379c8ca

    SHA512

    27c76dda83ae53c9d5f03e6573176ea976c61ff40c3d5cbf5dab61802c44864e444cd9df5e6a5cb18d437d229a3a84361907b5d31c152d21e827fe13d68b0427

  • memory/384-141-0x000000000B330000-0x000000000B936000-memory.dmp

    Filesize

    6.0MB

  • memory/384-138-0x0000000000FE0000-0x0000000001010000-memory.dmp

    Filesize

    192KB

  • memory/384-139-0x00000000736B0000-0x0000000073D9E000-memory.dmp

    Filesize

    6.9MB

  • memory/384-140-0x00000000018F0000-0x00000000018F6000-memory.dmp

    Filesize

    24KB

  • memory/384-142-0x000000000AE30000-0x000000000AF3A000-memory.dmp

    Filesize

    1.0MB

  • memory/384-143-0x000000000AD20000-0x000000000AD32000-memory.dmp

    Filesize

    72KB

  • memory/384-144-0x000000000AD80000-0x000000000ADBE000-memory.dmp

    Filesize

    248KB

  • memory/384-145-0x000000000ADD0000-0x000000000AE1B000-memory.dmp

    Filesize

    300KB

  • memory/384-146-0x00000000736B0000-0x0000000073D9E000-memory.dmp

    Filesize

    6.9MB

  • memory/4328-134-0x00007FF8EBA70000-0x00007FF8EC45C000-memory.dmp

    Filesize

    9.9MB

  • memory/4328-132-0x00007FF8EBA70000-0x00007FF8EC45C000-memory.dmp

    Filesize

    9.9MB

  • memory/4328-131-0x0000000000090000-0x000000000009A000-memory.dmp

    Filesize

    40KB