Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 21:37

General

  • Target

    8376a393beba9b4b400bed03258165e4d7d345c5c37d327b9589d7e279317a67.exe

  • Size

    660KB

  • MD5

    4af2075f09533c96439e472c41216a35

  • SHA1

    648435d4c9cf161b30113d9dce725342abef4a31

  • SHA256

    8376a393beba9b4b400bed03258165e4d7d345c5c37d327b9589d7e279317a67

  • SHA512

    82ab4d80fcd3a5b1ea2d352aa3516dbd8a1dafeae2fa10936f9aff8706f4c5afac9493d563e0011a57ef326d64c6badc370ca67ba95a2e4a0df33156a356eaff

  • SSDEEP

    12288:MMriy90ZXcSJAx7w0ugW9MqJ5zW7VmM9OXeCa4QOoJRAbcjSNX4rshpds8r7xlK:OyCA9wNNiqJJgv2H1wfAbcj+Vpdpr7xL

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

C2

77.91.124.145:4125

Attributes
  • auth_value

    d099adf6dbf6ccb8e16967104280634a

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8376a393beba9b4b400bed03258165e4d7d345c5c37d327b9589d7e279317a67.exe
    "C:\Users\Admin\AppData\Local\Temp\8376a393beba9b4b400bed03258165e4d7d345c5c37d327b9589d7e279317a67.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPa0396.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPa0396.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr902953.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr902953.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2484
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku086375.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku086375.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1376
          4⤵
          • Program crash
          PID:3200
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr177237.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr177237.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2092
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4424 -ip 4424
    1⤵
      PID:3512
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:6036

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr177237.exe

      Filesize

      168KB

      MD5

      e3be1f6f574df32d467810a391f9eb72

      SHA1

      679fa5c6ca6c9c9cc322f4989feb05ed9ebd7bca

      SHA256

      f6e282bb93271802a242944bec9df89759e85a00c90fca7e4a95f9068b6c9312

      SHA512

      530f3c7478ef44b9b627d5f3683611eaaebd0da85e41483d1f9a6c6d88fc0a5b146ac5e0fd2d6b4a418adb4526a4c55f14f6c9ea218ac36bc72e36b14ce22450

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziPa0396.exe

      Filesize

      507KB

      MD5

      5145772cf0f81da893f44d4f7c8486b4

      SHA1

      ab7b570baa15e5f12aea643266e7c07a47171134

      SHA256

      736f7aa6f9483bc2f4995966184b2c096f0303d5e116af06152935033a5b94ad

      SHA512

      1ff7de658b715a779d65c790eb478c3b3b70a9448b510abc7088487dac8c9cfe92c7085039684222055102a1a7f49453234694f09f9585832fcd1d96cb61a4fe

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr902953.exe

      Filesize

      14KB

      MD5

      157f569de6729fa9d47859a0907c8253

      SHA1

      70e34ee629b7cdac5e253f534bb45ce9b551c2bc

      SHA256

      5f3a0909f5d93a9f2b2d95b219b87140f44e02004f956947696db6a3a7501ef3

      SHA512

      bd7d9c0e9958c6b967a0fd16aa8317521b776ca7d59f867c8ad3085b0d44c0e19f4309e64915900133ab6b1e0930a989de22d3874bc28db5c2b7a51cb4125f79

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku086375.exe

      Filesize

      426KB

      MD5

      e63cf4a525220f3dae4740893456890c

      SHA1

      610d4fe76cdab9aca54caddbf9fb6fd155b2ec76

      SHA256

      14f04321b8f20c19c64da36cca2aa7f5f43aef66db4eb3263bf5ea482ef806e5

      SHA512

      7c01ad33a8fd08e718776ae8dc318dfda10f4c1c36f95835f3e482b74fd34d403fafbf2a0482eca357fc7475f1d300b0dfec73bf43bdca61d477288373f1e2d4

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      1073b2e7f778788852d3f7bb79929882

      SHA1

      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

      SHA256

      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

      SHA512

      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

    • memory/2092-2129-0x00000000001E0000-0x000000000020E000-memory.dmp

      Filesize

      184KB

    • memory/2092-2130-0x00000000024C0000-0x00000000024C6000-memory.dmp

      Filesize

      24KB

    • memory/2484-14-0x00007FFBABF03000-0x00007FFBABF05000-memory.dmp

      Filesize

      8KB

    • memory/2484-15-0x0000000000A50000-0x0000000000A5A000-memory.dmp

      Filesize

      40KB

    • memory/2484-16-0x00007FFBABF03000-0x00007FFBABF05000-memory.dmp

      Filesize

      8KB

    • memory/4424-64-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-52-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-24-0x0000000004D20000-0x0000000004D86000-memory.dmp

      Filesize

      408KB

    • memory/4424-38-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-40-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-88-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-86-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-84-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-82-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-80-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-78-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-74-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-72-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-70-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-68-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-66-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-22-0x0000000004CB0000-0x0000000004D16000-memory.dmp

      Filesize

      408KB

    • memory/4424-62-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-60-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-58-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-56-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-23-0x0000000004DA0000-0x0000000005344000-memory.dmp

      Filesize

      5.6MB

    • memory/4424-50-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-48-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-46-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-44-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-42-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-36-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-34-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-32-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-30-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-28-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-76-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-54-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-26-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-25-0x0000000004D20000-0x0000000004D7F000-memory.dmp

      Filesize

      380KB

    • memory/4424-2105-0x0000000005530000-0x0000000005562000-memory.dmp

      Filesize

      200KB

    • memory/5784-2118-0x00000000007D0000-0x0000000000800000-memory.dmp

      Filesize

      192KB

    • memory/5784-2119-0x00000000050E0000-0x00000000050E6000-memory.dmp

      Filesize

      24KB

    • memory/5784-2120-0x00000000058C0000-0x0000000005ED8000-memory.dmp

      Filesize

      6.1MB

    • memory/5784-2121-0x00000000053B0000-0x00000000054BA000-memory.dmp

      Filesize

      1.0MB

    • memory/5784-2122-0x0000000005170000-0x0000000005182000-memory.dmp

      Filesize

      72KB

    • memory/5784-2123-0x00000000052E0000-0x000000000531C000-memory.dmp

      Filesize

      240KB

    • memory/5784-2124-0x0000000005330000-0x000000000537C000-memory.dmp

      Filesize

      304KB