Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe
Resource
win10v2004-20241007-en
General
-
Target
a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe
-
Size
612KB
-
MD5
7e681a0a9f65283000868a6921f019c0
-
SHA1
5114901acbdc39d1fa481d94fe64fbda24a89fa7
-
SHA256
a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e
-
SHA512
d45328025c35dfe99e06e3726b3aff900f39c11643f0c1393302ae7d1fa0349cfd5cf088d9951d6ba81434e27cd9756cd42066deb0241117ddbafa971c5d44fb
-
SSDEEP
12288:fy90XEEdSXTSaONu7sSF9RQ3Bbn7WBohiulYE/p9xkge:fyaSDSaON2CBb7WBgRl/He
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3036-12-0x0000000002580000-0x000000000259A000-memory.dmp healer behavioral1/memory/3036-14-0x0000000004DA0000-0x0000000004DB8000-memory.dmp healer behavioral1/memory/3036-34-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-42-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-40-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-38-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-36-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-32-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-30-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-28-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-26-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-24-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-20-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-18-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-16-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer behavioral1/memory/3036-15-0x0000000004DA0000-0x0000000004DB2000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr173836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr173836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr173836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr173836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr173836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr173836.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/1280-55-0x0000000002680000-0x00000000026BC000-memory.dmp family_redline behavioral1/memory/1280-57-0x0000000002AE0000-0x0000000002B1A000-memory.dmp family_redline behavioral1/memory/1280-59-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-69-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-91-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-89-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-87-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-85-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-83-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-81-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-79-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-77-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-75-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-73-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-67-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-65-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-63-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-61-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-71-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline behavioral1/memory/1280-58-0x0000000002AE0000-0x0000000002B15000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
pid Process 3036 pr173836.exe 1280 qu246497.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr173836.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr173836.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4920 3036 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu246497.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr173836.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 pr173836.exe 3036 pr173836.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3036 pr173836.exe Token: SeDebugPrivilege 1280 qu246497.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2024 wrote to memory of 3036 2024 a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe 83 PID 2024 wrote to memory of 3036 2024 a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe 83 PID 2024 wrote to memory of 3036 2024 a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe 83 PID 2024 wrote to memory of 1280 2024 a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe 99 PID 2024 wrote to memory of 1280 2024 a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe 99 PID 2024 wrote to memory of 1280 2024 a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe"C:\Users\Admin\AppData\Local\Temp\a7880d0c4f6092c6c043561841893611acbd0df2b421055e8bb3f5b053c9b56e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr173836.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr173836.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 10803⤵
- Program crash
PID:4920
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu246497.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu246497.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3036 -ip 30361⤵PID:4676
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404KB
MD5bd3965856019215a5421b78753eaa637
SHA194c4cb8a7fc11a93a97b129559658335e2b7556a
SHA25653090fb18cd088749bab68a641154a8750960e467d91312e4bf5f0a82bd39276
SHA5126382e6013f273bbc30246bc888ce766f5159c4beb3be9312828ec22b29a22b3e4cc87dc2503ba7e8aa38de1ab74d075da272614e7d2fe1c4327f01b34748c679
-
Filesize
487KB
MD52d6d755b61da44507993f4b2601ab10e
SHA11431f331cb92dd1c9ec0ba5a83b8a7264306ddd5
SHA256cf26857d2f07492df7d66f6ce2e69b34fb14f46dc252a04a0ea282e52d785f28
SHA512ded794f1d14da7dd9e9b18c8ce5c6e5d39b371243dc664a6ae1767fe1df6927c17d540e31d1c363764b3a46da489cc9cb0c17a4302c9aac3a29db8aa6aacc756