Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:22

General

  • Target

    2aea95d7b9293a521467cddb1f60d49dc0414ce5363b7474a3861967cfe26ec5.exe

  • Size

    1.0MB

  • MD5

    6f2f60870f54677c8abc465951bfa97a

  • SHA1

    04f5e7a323d9e9ae4cace6db5f77b407ef71a938

  • SHA256

    2aea95d7b9293a521467cddb1f60d49dc0414ce5363b7474a3861967cfe26ec5

  • SHA512

    3b94fc45c634133ccfca85553406c76b8195fe319b437c70dada905c9415bad321222763e003130dbb8e96db473fb27cf6a9e37281d984730d7b35d1aa67e5e5

  • SSDEEP

    24576:hye19Mg4rpZ0j9tE78PLy+ravKruEdCpnEqxBc2:Ue1qTrv8y78z+HEcpEp

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2aea95d7b9293a521467cddb1f60d49dc0414ce5363b7474a3861967cfe26ec5.exe
    "C:\Users\Admin\AppData\Local\Temp\2aea95d7b9293a521467cddb1f60d49dc0414ce5363b7474a3861967cfe26ec5.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848345.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848345.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un064147.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un064147.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:440
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr633408.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr633408.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2584
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1080
            5⤵
            • Program crash
            PID:8
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu357597.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu357597.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1516
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2584 -ip 2584
    1⤵
      PID:3460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un848345.exe

      Filesize

      749KB

      MD5

      ad1b47760c1767cdee203d9387168014

      SHA1

      e08ae550092aede2215478b9236e47b50f3e4091

      SHA256

      2c002b9270b473c95aa94d5eaf1d5a24574e47e47499e4a377e84e68332d2e99

      SHA512

      c4fcb8e23c5ac5d57751228a2adde5ad267e7b7bae34fca80f5e4a3d7f87ef229313f78db1f54c1c2a9ccf83dca49f01f855f59e9eb52f0e993b1366e09e8022

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un064147.exe

      Filesize

      595KB

      MD5

      feca79e60fbf7c5d800006abbcfb3055

      SHA1

      3240ca3cf9a1dc6cd967585677024be3a28ea689

      SHA256

      06188e0b5b4ef965e3fa2b114aec784829d024feaa24e7ab38a1306c62dcb209

      SHA512

      52a4c32efbc0fb88a085e7e076d43f0bc16fd16060434b35c64ddccd79d5d4d3b0f39545d40b62bb86e233af6de40d03bce815b1f11d6afd6537fd972adf2fc9

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr633408.exe

      Filesize

      389KB

      MD5

      0bf1bb48112a0ccb3d9cffd7aae15efe

      SHA1

      be55a1542138592f63fe276b410e57a1d79f0e3f

      SHA256

      7ad13ce3102b99f1f66fb361d1764723d92a0d30c9052f3e4c47fb668b9336fb

      SHA512

      6fb79fec680394e88b575687a89ffda66005c80d4794376482629d53b7005d103ed01a731a3ebdc28f4179cfa1af5f45b096cb9aa551297fdfd8e54ac2289a95

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu357597.exe

      Filesize

      472KB

      MD5

      772d23d4142eed32934ae2b8bf6cbe4b

      SHA1

      51f754e444fb75012b1bc485dd4319433e6e93f8

      SHA256

      1f5a41f1a249081747257a61af6f43c786ece3c880a96b472b327f86c63bd8e3

      SHA512

      c5217e80f6b51f76008f130541112bb2af7875129bee08e48431685432b9c96d46842b1841796fd2b261a40e1c40d7f5320a49943a40d8efd4868cf3bd18cd9c

    • memory/1516-77-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-85-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-857-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

      Filesize

      72KB

    • memory/1516-856-0x00000000078E0000-0x0000000007EF8000-memory.dmp

      Filesize

      6.1MB

    • memory/1516-89-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-69-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-71-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-73-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-859-0x00000000080E0000-0x000000000811C000-memory.dmp

      Filesize

      240KB

    • memory/1516-75-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-65-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-82-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-83-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-858-0x0000000007FC0000-0x00000000080CA000-memory.dmp

      Filesize

      1.0MB

    • memory/1516-87-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-91-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-93-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-95-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-97-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-79-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-64-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/1516-860-0x0000000002850000-0x000000000289C000-memory.dmp

      Filesize

      304KB

    • memory/1516-62-0x0000000004D70000-0x0000000004DAC000-memory.dmp

      Filesize

      240KB

    • memory/1516-63-0x00000000053E0000-0x000000000541A000-memory.dmp

      Filesize

      232KB

    • memory/1516-67-0x00000000053E0000-0x0000000005415000-memory.dmp

      Filesize

      212KB

    • memory/2584-43-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-57-0x0000000000400000-0x0000000000806000-memory.dmp

      Filesize

      4.0MB

    • memory/2584-54-0x0000000000400000-0x0000000000806000-memory.dmp

      Filesize

      4.0MB

    • memory/2584-55-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2584-26-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-27-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-29-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-31-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-33-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-35-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-37-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-39-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-41-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-45-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-47-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-49-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-51-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-53-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/2584-25-0x0000000002960000-0x0000000002978000-memory.dmp

      Filesize

      96KB

    • memory/2584-24-0x0000000004E20000-0x00000000053C4000-memory.dmp

      Filesize

      5.6MB

    • memory/2584-23-0x0000000002770000-0x000000000278A000-memory.dmp

      Filesize

      104KB

    • memory/2584-22-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB