Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2023, 13:16

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe

  • Size

    15.3MB

  • MD5

    ef9428407424cc578442727f6fe3bc5e

  • SHA1

    ba6599fbc6a77b1973b1e1b58e2a9cb0655467c0

  • SHA256

    5a4da54758f9a1a86f382cc9808e3f8e925376693555e9f834807ca352ca761c

  • SHA512

    c3a2a5ee6cd269fc86a49e8c5759e24074df0321a1e40c3eff2bedabaec074c253d9a43dfe4a0bfad03f50c8a5c0b70a8151826e77877d26b4e090bcb798e8e6

  • SSDEEP

    393216:CaFCt7regPFRhBfvhIq4zvAkXxj5dbwUWs6QxF6iu:RFcTP7LidzIwHTWlQxoz

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1004
    • C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe
      "C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3420
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce3639758,0x7ffce3639768,0x7ffce3639778
          4⤵
            PID:4332
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:2
            4⤵
              PID:4284
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
              4⤵
                PID:3340
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
                4⤵
                  PID:3392
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:1
                  4⤵
                    PID:2848
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:1
                    4⤵
                      PID:824
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:1
                      4⤵
                        PID:5216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
                        4⤵
                          PID:5248
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=1884,i,9065089257531103492,6225508319937683288,131072 /prefetch:8
                          4⤵
                            PID:5368
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                          3⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:2264
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce34f46f8,0x7ffce34f4708,0x7ffce34f4718
                            4⤵
                              PID:1636
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1524
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
                              4⤵
                                PID:2008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
                                4⤵
                                  PID:2688
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                                  4⤵
                                    PID:2436
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13662402396061750596,11109330212072216188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                                    4⤵
                                      PID:1228
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:2564
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4976
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:5164

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      84df16093540d8d88a327b849dd35f8c

                                      SHA1

                                      c6207d32a8e44863142213697984de5e238ce644

                                      SHA256

                                      220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

                                      SHA512

                                      3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      22663c19d825e1a1223480b84769be14

                                      SHA1

                                      b46ed533a7cd8368af4ba4b757ad6c478e48cc5c

                                      SHA256

                                      7e327c2d62ae264902924c5db403012c56f26ede1e9ce65053aa17c4014bb6c7

                                      SHA512

                                      fe80b4ff6828f20086305773509f456476ea0ff6d07d1c14721d2d3de09c6cfddf8558fb40de602d3e0405631664e8761daf0d41d5bb8171495ba0d0e39f22c9

                                    • C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe

                                      Filesize

                                      14.9MB

                                      MD5

                                      ce79be6531d3f05b0f3dfabb846acb71

                                      SHA1

                                      218e07e6a6f89c46015883a0e385576a834e776e

                                      SHA256

                                      51ce4a95c911798a4d7a0cd7b16a68509d4b171cf3e4b8281cd46517d1f2e61c

                                      SHA512

                                      d27795741e6eb565a4fd132c0695ae5163f64adfb875451023f5ee880af5ea5082744137240a3d324dd6041753bf1198ffc328eb75f0283d3f4d19790a4e68a1

                                    • C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe

                                      Filesize

                                      14.9MB

                                      MD5

                                      ce79be6531d3f05b0f3dfabb846acb71

                                      SHA1

                                      218e07e6a6f89c46015883a0e385576a834e776e

                                      SHA256

                                      51ce4a95c911798a4d7a0cd7b16a68509d4b171cf3e4b8281cd46517d1f2e61c

                                      SHA512

                                      d27795741e6eb565a4fd132c0695ae5163f64adfb875451023f5ee880af5ea5082744137240a3d324dd6041753bf1198ffc328eb75f0283d3f4d19790a4e68a1

                                    • C:\Users\Admin\AppData\Local\Temp\OpenAndClose.exe

                                      Filesize

                                      14.9MB

                                      MD5

                                      ce79be6531d3f05b0f3dfabb846acb71

                                      SHA1

                                      218e07e6a6f89c46015883a0e385576a834e776e

                                      SHA256

                                      51ce4a95c911798a4d7a0cd7b16a68509d4b171cf3e4b8281cd46517d1f2e61c

                                      SHA512

                                      d27795741e6eb565a4fd132c0695ae5163f64adfb875451023f5ee880af5ea5082744137240a3d324dd6041753bf1198ffc328eb75f0283d3f4d19790a4e68a1

                                    • memory/1004-9-0x0000000007470000-0x000000000747A000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/1004-37-0x0000000008F40000-0x0000000008F5E000-memory.dmp

                                      Filesize

                                      120KB

                                    • memory/1004-88-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/1004-10-0x00000000083A0000-0x00000000089B8000-memory.dmp

                                      Filesize

                                      6.1MB

                                    • memory/1004-11-0x0000000007540000-0x0000000007552000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/1004-12-0x0000000007670000-0x000000000777A000-memory.dmp

                                      Filesize

                                      1.0MB

                                    • memory/1004-14-0x00000000075A0000-0x00000000075DC000-memory.dmp

                                      Filesize

                                      240KB

                                    • memory/1004-7-0x00000000072C0000-0x0000000007352000-memory.dmp

                                      Filesize

                                      584KB

                                    • memory/1004-16-0x00000000075E0000-0x000000000762C000-memory.dmp

                                      Filesize

                                      304KB

                                    • memory/1004-6-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/1004-5-0x0000000000310000-0x000000000036A000-memory.dmp

                                      Filesize

                                      360KB

                                    • memory/1004-75-0x0000000004EA0000-0x0000000004EF0000-memory.dmp

                                      Filesize

                                      320KB

                                    • memory/1004-8-0x00000000074A0000-0x00000000074B0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1004-34-0x0000000009730000-0x0000000009C5C000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/1004-29-0x0000000007E80000-0x0000000007EE6000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/1004-31-0x0000000008DE0000-0x0000000008E56000-memory.dmp

                                      Filesize

                                      472KB

                                    • memory/1004-33-0x0000000009030000-0x00000000091F2000-memory.dmp

                                      Filesize

                                      1.8MB

                                    • memory/2920-3-0x0000000006590000-0x00000000065A0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2920-2-0x0000000006A10000-0x0000000006FB4000-memory.dmp

                                      Filesize

                                      5.6MB

                                    • memory/2920-1-0x0000000000C00000-0x0000000001B4A000-memory.dmp

                                      Filesize

                                      15.3MB

                                    • memory/2920-27-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2920-0-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2968-32-0x0000000005A70000-0x0000000005A80000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2968-28-0x00000000002C0000-0x00000000011A8000-memory.dmp

                                      Filesize

                                      14.9MB

                                    • memory/2968-26-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2968-86-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB