Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 02:40
Static task
static1
Behavioral task
behavioral1
Sample
4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe
Resource
win10v2004-20241007-en
General
-
Target
4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe
-
Size
479KB
-
MD5
3be509fc3b6d4fc036e3a808471a1426
-
SHA1
0fef31408b76787cf1b93425c2c9dfa2619b804a
-
SHA256
4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f
-
SHA512
e63f23e213e102b25f4de89054dac03ff5424bd2fb83abf8be99734353987f868439fb84a6f9b0466d87e65c49920274d99caa0383fb8fc894ac2ee26583af07
-
SSDEEP
6144:K9y+bnr+Dp0yN90QEXwp3yFkLKCrInepRJIVKxtbcVSP4ART2MguqX6zwRCbUfUF:HMrjy90udOzZUcVSPt5SKzcIs6jrF
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3436-15-0x00000000048D0000-0x00000000048EA000-memory.dmp healer behavioral1/memory/3436-18-0x0000000004980000-0x0000000004998000-memory.dmp healer behavioral1/memory/3436-48-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-46-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-44-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-42-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-32-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-40-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-38-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-36-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-34-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-30-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-28-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-26-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-24-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-22-0x0000000004980000-0x0000000004992000-memory.dmp healer behavioral1/memory/3436-21-0x0000000004980000-0x0000000004992000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k7298159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k7298159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k7298159.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k7298159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k7298159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k7298159.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/1028-56-0x0000000000090000-0x00000000000B8000-memory.dmp family_redline behavioral1/files/0x0007000000023c82-55.dat family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2776 y0701905.exe 3436 k7298159.exe 1028 l3716582.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k7298159.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k7298159.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y0701905.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language y0701905.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k7298159.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language l3716582.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3436 k7298159.exe 3436 k7298159.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3436 k7298159.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2776 2016 4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe 85 PID 2016 wrote to memory of 2776 2016 4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe 85 PID 2016 wrote to memory of 2776 2016 4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe 85 PID 2776 wrote to memory of 3436 2776 y0701905.exe 86 PID 2776 wrote to memory of 3436 2776 y0701905.exe 86 PID 2776 wrote to memory of 3436 2776 y0701905.exe 86 PID 2776 wrote to memory of 1028 2776 y0701905.exe 101 PID 2776 wrote to memory of 1028 2776 y0701905.exe 101 PID 2776 wrote to memory of 1028 2776 y0701905.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe"C:\Users\Admin\AppData\Local\Temp\4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0701905.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0701905.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7298159.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7298159.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3716582.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3716582.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1028
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307KB
MD556c06bf8c1bd2f4106fa9d532b8724bf
SHA19fec8cb079126b16afeb665f5b534f5d14daa9f6
SHA256381fc6b5f3c6fc06d0139adde50db1c1c1594a000937bb67f93a858a02673436
SHA5120710f9b49c08ad2937b58fc667a3b95354a37bb31ebd0761f016cc317201361a56cf8b03b55323a7cec40cefbfb837885ddffa2892fb5297347817786903237c
-
Filesize
175KB
MD5fb77dcec0fec3b0117c37eb9daae2fe6
SHA1af36116624fcd1fc13af712e6d17bf3800a2d0fb
SHA256b204eda5139d23783a6c7c464cc8862c838024ae83d68408c90e78a7e079eab2
SHA512cd85faa7e0150d649ca6688a1e572b7073bef37720d8641f051e7eef03c56adf38a89590aed74ed3ac2147045b3c30ea23d35d55771f5549f98c01c98f5b9e50
-
Filesize
136KB
MD5c737d795774eec8e8cdf7f8ecbc2d5f5
SHA1d07b0f7025274a40551a4a9f1b402b990c3f4eec
SHA256e092ee3cab622f95e1a03fb571da493614baf9fc0a7aca09d9bccb0277e2388d
SHA512a51167b660251dde1ec7faa0a8affb25955b6f0b14c640db1c63d7c1ffea1fae7cdf1d61afccb464f7d2e2bd846c03efc71a1056807e89139bf5c2dcf312ec10