Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/01/2025, 13:01
250106-p9jekaxkcx 1013/10/2024, 23:16
241013-289lkssepc 1014/03/2023, 17:05
230314-vl5ksagf73 714/03/2023, 16:59
230314-vhej7agf56 7Analysis
-
max time kernel
62s -
max time network
66s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/10/2024, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
thisIsScary.exe
Resource
win11-20241007-en
windows11-21h2-x64
16 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
thisIsScary.exe
-
Size
746.2MB
-
MD5
f359144193a123071150ae6d7c998a2e
-
SHA1
f521e43219ec31925397cf358b0d965f0597ef5d
-
SHA256
4297e5866beebdedce1e28b89724a9853af982bc39988a38cf3c70db2a98c86a
-
SHA512
c577cc3ca0354acb1333ebeae9b4abd50c088a68fa3bcdd499404f38c8f05b79a3322972d3ff5a729fc89ad4b72f224173a16e8d7f22929f6f41b5b50369baba
-
SSDEEP
24576:3R49/r0wcuSm364suiUv9poYGOecJz/tzYUl8RvIGLlECdB8MIw+RY6ATLZFAgYq:A/Mm31/oLO/58qnRL6LW
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
xmas
C2
37.220.87.78:25387
Attributes
-
auth_value
47dd71225cb3a0a92188486269819009
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/2672-0-0x0000000000700000-0x0000000000746000-memory.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4180 set thread context of 2672 4180 thisIsScary.exe 79 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "55" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3068 taskmgr.exe Token: SeSystemProfilePrivilege 3068 taskmgr.exe Token: SeCreateGlobalPrivilege 3068 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2784 LogonUI.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79 PID 4180 wrote to memory of 2672 4180 thisIsScary.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\thisIsScary.exe"C:\Users\Admin\AppData\Local\Temp\thisIsScary.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3068
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3404
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a39055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2784