Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/11/2024, 01:11
General
-
Target
955cdb8022fc586c90dedf7939de6d0a9500298a010ec4a0b53b4d7da5bd481e.exe
-
Size
674KB
-
MD5
4cbd1ac9fe3978bafefec0823698215b
-
SHA1
5d9d7130d552eed0fea6d2eda6c521556d93e7cc
-
SHA256
955cdb8022fc586c90dedf7939de6d0a9500298a010ec4a0b53b4d7da5bd481e
-
SHA512
184978e40bfdb3b3946668e5c0b5a43b105f68d2c2a9bb5ffee37190ee7d986cc506f6c45d900aa4e14fc647ebe6375d6b81f82715f2b9bdf4db786436faea4c
-
SSDEEP
12288:Dy90Je9T1rh/VRU6hfSGFP+JmAnNXKZrIqXQRhwlXs9kYrsXhrAqz:Dyce9hhDbFP+JmAnNXKZrzXfW9kYAhF
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\955cdb8022fc586c90dedf7939de6d0a9500298a010ec4a0b53b4d7da5bd481e.exe"C:\Users\Admin\AppData\Local\Temp\955cdb8022fc586c90dedf7939de6d0a9500298a010ec4a0b53b4d7da5bd481e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st819916.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st819916.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\24870164.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\24870164.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp882329.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp882329.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520KB
MD5b2fc08fe1150b16194430b036c5a892c
SHA1ce09518d09026182e422bf0dc1b6b439e0a95d77
SHA25613e97ad27a8c9d08db8fd9ba1ec63ce4fbb4e2a715e20343fc8dd810c4c4527a
SHA512220613662a91e255b5ed3818efadc77ac8c6c216d9a362a840e6e769f6ec55de2953ffdbafc7805bfa3a845ac50238beca9aac41b14e29f8849b69d4de0a7a1a
-
Filesize
175KB
MD509846796e84145cfc8cf63f18a3b788f
SHA1058499bd1b740e5938fe446527d042e88acf8b05
SHA256e4ed376eedc8500fe4192a964b6b40fd7326e41b119e685eee5af87906b82837
SHA5121ae105dc99e90037b41d1ad647e260c9db18d912b2853dc59cc976cab30b5c524069da284be160c94ab1ffe64f0addd09d018e6f6ac03b255b6562233fd18a4c
-
Filesize
415KB
MD5ae6eea091c9369db3a3d29b8bc66b4f4
SHA1ca144bc127c2a82e655f13204a08ffc65e2eea91
SHA256f3bf80e19216daf7d2571eda21276967a8a6a56ad4c27752c78877d5e7c93779
SHA51280c80646613a5349aad4152f8babe8e5d8cf4aba0a8f43d057711a943469a9dba121c229576f2bd88d9b86db7f25af89311ce998ee26ee166d07d080a3c6cbac
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
304KB