Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/09/2024, 15:05
General
-
Target
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe
-
Size
894KB
-
MD5
826eb90d730bf03e39d78daa585364bc
-
SHA1
d139eee9235e1f997ef14f014c7fbc3dd3b36a03
-
SHA256
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e
-
SHA512
c5e50071603a0f7f8e27098a7272f8fa9d987c6daba1104890afa354f1c2ba506c2476911e306d0bae99772159f2462b3f61e844b608b1e1ea0463df22a33d42
-
SSDEEP
24576:0NA3R5drX/WfwOauc1XayZWtTHOB8nDFQXi7hQHX:V5OfwOg1KyMHOi0i7hQ3
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
193.233.255.84:4284
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
.NET Reactor proctector 29 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\2.exe"C:\Windows\Temp\2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
2KB
MD567b0e8f90c35b1c24be4bfb48d6e2f7b
SHA1285a20c175e12a3537d045ee53efa4fe690dcf69
SHA256690ccec9c4729ff1afc8a3aa53599e7d6cbba3d6a2dd9f7983ef68210bb4f865
SHA5120ba283c7fb800d359c009100f05a7a900c3f01eb363edc39977fa72302a24fc2c93a3ec1270c18bfc5ccd08afcf02ff8296ab1fc12e257b6a8819bf385c0d302
-
Filesize
2KB
MD57caabe344325e2e205b70219ba671463
SHA18bb2ddef09a1f928f9ad5691020a593d4c12493b
SHA2569c915cdffa6099b65c9072e6412a9541ed185968b2f223e02cf2b7e5f7db2b67
SHA5124b5aa1934d42b6439bbe091103d6660841f9a0108f5b7bedf2c48e094e8b996f4e93cb00eba684b07c149333327c8b12b71e06a287c9a2a4b2bb89e02340e7e6
-
Filesize
323KB
MD58214daede69a0da8327553bd9f8ae499
SHA1334655ca2474e04b411f064e86d4bbfd3b6b19f8
SHA2560d968172eebfc13e25d0e70b2d476e5711fc2e96604bbcfdfd89c0c157e7a61f
SHA512f8c8fa7344b5e9da9cbc835b71aac984ef6712b52101937074c0908e2bfc8fc01f875484ace40292c542bcb93196cac7267433e2cd5f4444878856b822101d3c
-
Filesize
435KB
MD51f3cfcf8aad3e5e3164405d272aa213e
SHA196f1c646d19deab4ff071fbc6b3c73c87ce56e49
SHA256fcdab9639af874cba780e20c21a9bc662b160dc313ddb75e5f82f779f1680101
SHA5120d2008b613bed0f1bed205ace8e89d13d5b5e0fca924ca1f9d0e322564c7d7610e0e735e3686701d3042fef1c164dcd43e40a67eb60199b885fbcb761fa41b06
-
Filesize
6.9MB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
456KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB