Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 13:11

General

  • Target

    f9ef5e5e24efe5c4cc8659f19ead050fc5ec698cecea2a0802e1ade2a16e9e95.exe

  • Size

    568KB

  • MD5

    ba292e86a9c8eb813502ab2b3c92ec60

  • SHA1

    3f19265cb6d3ff295aea7057375ba1ea7d472c37

  • SHA256

    f9ef5e5e24efe5c4cc8659f19ead050fc5ec698cecea2a0802e1ade2a16e9e95

  • SHA512

    82958f99e5dd838b63934dc37d96b822ddf956f651ad7921df431987565c480517e9217639d5006c45ac6a6d8929847777d0fca23d4716fe9f1ecc7875faf850

  • SSDEEP

    12288:8y90c3odxUFchxZEGxMA9vYf/mCr4iYtORXwehBNcd1VHh6eIbUk08:8yfodxUjGxM5f/jYt+XzIXVHh6pUd8

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9ef5e5e24efe5c4cc8659f19ead050fc5ec698cecea2a0802e1ade2a16e9e95.exe
    "C:\Users\Admin\AppData\Local\Temp\f9ef5e5e24efe5c4cc8659f19ead050fc5ec698cecea2a0802e1ade2a16e9e95.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipt5332.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipt5332.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it914637.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it914637.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4284
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp437287.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp437287.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipt5332.exe

    Filesize

    414KB

    MD5

    dc1599b95a9a022593ecfd045f2a5f0b

    SHA1

    3dd03be20f67874479c3e00a2bad659d75952b55

    SHA256

    98c98b9b2bf8b8959aeea4cece7f006dff4c9dacfe07075a1139172de642335d

    SHA512

    224cd966c28d4523d6f0074b0e22cfc8a267dda39eff4f8497e43eaf2d1bd4ebe3f0fc30a7cf5ec91cce0056f3692430f0a54c32db099221c5901aa4a4fcb039

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it914637.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp437287.exe

    Filesize

    381KB

    MD5

    887322cdd66e6dd965dcda0d85f2673b

    SHA1

    0c8865aba5095efa66377f3f28b64261292fe372

    SHA256

    d9480b8312b74fd5771cafb38e4ae5030a8347a4c25f172b9e138e73f3ea192c

    SHA512

    480e8df2e643d94e7fd6372ccd1cccb02260c5f6d5d551c510f66618dec44ff4d4a74fb9e3767e7849c23a386326cc61af857c6dcd970bcd683369ac19252c21

  • memory/3152-72-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-48-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-821-0x0000000006DC0000-0x0000000006E0C000-memory.dmp

    Filesize

    304KB

  • memory/3152-22-0x0000000004D40000-0x0000000004D7C000-memory.dmp

    Filesize

    240KB

  • memory/3152-23-0x0000000007310000-0x00000000078B4000-memory.dmp

    Filesize

    5.6MB

  • memory/3152-24-0x00000000078C0000-0x00000000078FA000-memory.dmp

    Filesize

    232KB

  • memory/3152-30-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-28-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-26-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-25-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-32-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-88-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-86-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-84-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-82-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-80-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-78-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-76-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-74-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-820-0x000000000A5E0000-0x000000000A61C000-memory.dmp

    Filesize

    240KB

  • memory/3152-66-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-819-0x000000000A4B0000-0x000000000A5BA000-memory.dmp

    Filesize

    1.0MB

  • memory/3152-68-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-64-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-62-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-60-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-58-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-56-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-54-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-52-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-50-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-70-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-46-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-44-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-42-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-40-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-34-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-38-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-37-0x00000000078C0000-0x00000000078F5000-memory.dmp

    Filesize

    212KB

  • memory/3152-817-0x0000000009DD0000-0x000000000A3E8000-memory.dmp

    Filesize

    6.1MB

  • memory/3152-818-0x000000000A490000-0x000000000A4A2000-memory.dmp

    Filesize

    72KB

  • memory/4284-16-0x00007FFC7B7F3000-0x00007FFC7B7F5000-memory.dmp

    Filesize

    8KB

  • memory/4284-14-0x00007FFC7B7F3000-0x00007FFC7B7F5000-memory.dmp

    Filesize

    8KB

  • memory/4284-15-0x0000000000F30000-0x0000000000F3A000-memory.dmp

    Filesize

    40KB