Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 18:42

General

  • Target

    123.exe

  • Size

    667KB

  • MD5

    343d4defc4481746b24e7c2921c4f548

  • SHA1

    47616a15b6fecfdb7ba8a5a3d01277c1b148d530

  • SHA256

    e07aa8e347888a9fa3c9a21614e799a72c12f84507a1f567331edfed03e79d23

  • SHA512

    72aa1600efe604f85072b467acbb0cb7684874d3c7483147a72eb01968ef044030c7033d3fcc522c36bab4f7994703c57e0bb1811526c60a18c24a0d8012754b

  • SSDEEP

    6144:IHejFCzqQIfr3Q8kM30Wl2sFqtcwD0NRhf7i8jFfcasWh:IHejFIqQ6D6M30WllotcwSf7i8j5c7W

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 3144
      2⤵
      • Program crash
      PID:4472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 908 -ip 908
    1⤵
      PID:3196

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/908-0-0x000000007504E000-0x000000007504F000-memory.dmp

      Filesize

      4KB

    • memory/908-1-0x0000000000680000-0x000000000072C000-memory.dmp

      Filesize

      688KB

    • memory/908-2-0x0000000075040000-0x00000000757F0000-memory.dmp

      Filesize

      7.7MB

    • memory/908-3-0x0000000005060000-0x000000000507E000-memory.dmp

      Filesize

      120KB

    • memory/908-4-0x00000000058C0000-0x0000000005E64000-memory.dmp

      Filesize

      5.6MB

    • memory/908-5-0x00000000053F0000-0x0000000005482000-memory.dmp

      Filesize

      584KB

    • memory/908-6-0x0000000005580000-0x000000000558A000-memory.dmp

      Filesize

      40KB

    • memory/908-7-0x0000000008720000-0x0000000008D38000-memory.dmp

      Filesize

      6.1MB

    • memory/908-8-0x0000000008130000-0x000000000823A000-memory.dmp

      Filesize

      1.0MB

    • memory/908-9-0x0000000008070000-0x0000000008082000-memory.dmp

      Filesize

      72KB

    • memory/908-10-0x00000000080D0000-0x000000000810C000-memory.dmp

      Filesize

      240KB

    • memory/908-11-0x0000000008240000-0x000000000828C000-memory.dmp

      Filesize

      304KB

    • memory/908-14-0x00000000094F0000-0x0000000009556000-memory.dmp

      Filesize

      408KB

    • memory/908-15-0x00000000097F0000-0x0000000009866000-memory.dmp

      Filesize

      472KB

    • memory/908-16-0x00000000094D0000-0x00000000094EE000-memory.dmp

      Filesize

      120KB

    • memory/908-17-0x000000000A310000-0x000000000A4D2000-memory.dmp

      Filesize

      1.8MB

    • memory/908-18-0x000000000AF30000-0x000000000B45C000-memory.dmp

      Filesize

      5.2MB

    • memory/908-19-0x0000000075040000-0x00000000757F0000-memory.dmp

      Filesize

      7.7MB