Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 12:11

General

  • Target

    f2a8db1999a5eef1e8f5e9962ed8de6b3c3ac5bc534647e26397d27453436212.exe

  • Size

    552KB

  • MD5

    ab3f52faadf55e35ffa1a9b488ecc3d9

  • SHA1

    839463068dfd486629444fe4572b42c6775df901

  • SHA256

    f2a8db1999a5eef1e8f5e9962ed8de6b3c3ac5bc534647e26397d27453436212

  • SHA512

    781d9fa9e9331a9aa7f96999f54a9d4e0aaeff15aa01738fbe00c96a8752bf4723a4c30e47c12b9ed8bbba0a1ff87a8dc398af22ae66909397d0a2da5c1de61d

  • SSDEEP

    12288:ky90mFgUwJUt36eonh2vKJ5GWgpB+DMFTn1BqufVJCec5l:kyibJ23HO2vm8WEZRcbeel

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2a8db1999a5eef1e8f5e9962ed8de6b3c3ac5bc534647e26397d27453436212.exe
    "C:\Users\Admin\AppData\Local\Temp\f2a8db1999a5eef1e8f5e9962ed8de6b3c3ac5bc534647e26397d27453436212.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:348
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr082458.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr082458.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 236
        3⤵
        • Program crash
        PID:4072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu242046.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu242046.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2772 -ip 2772
    1⤵
      PID:1016

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr082458.exe

      Filesize

      283KB

      MD5

      1364f6e53b4e71245b113b8e38494392

      SHA1

      c1ae5e0e3b6e014bb3de6477febe717609866216

      SHA256

      6a13ab8d323fdb2b31a27e6aec201ba545105ff7cb7dc677233962bf2f78b3ff

      SHA512

      da13337fa65aa7aca6473398aea56e057990b6eb75ce1fffd90141571718e3595bdfa27eb86df9887070ca44332b6e85227e0b4d6ac47930aee080e29b6bd9d3

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu242046.exe

      Filesize

      353KB

      MD5

      d9588724e2501742b327c693f77f76bd

      SHA1

      6bcbd14672b63d61dbea9179369881ae3e2a8265

      SHA256

      6876dc4381e4af514cd00df4ff204f882c3e3f9e94ff09f6f42b53e5a3554795

      SHA512

      bb3b13e96b54bb485b6379d895b33728148daeec6eca552ec9f7610578f9fd6706f5ec9b574ef658e2b5049811c86e154f06e8e4259dd48a3e4166eecf5bff44

    • memory/2772-46-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

      Filesize

      1024KB

    • memory/2772-8-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

      Filesize

      1024KB

    • memory/2772-11-0x0000000007100000-0x00000000076A4000-memory.dmp

      Filesize

      5.6MB

    • memory/2772-12-0x0000000007700000-0x0000000007718000-memory.dmp

      Filesize

      96KB

    • memory/2772-13-0x0000000000400000-0x0000000002BB0000-memory.dmp

      Filesize

      39.7MB

    • memory/2772-15-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-14-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-35-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-39-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-41-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-38-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-33-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-31-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-29-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-27-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-25-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-23-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-21-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-19-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-17-0x0000000007700000-0x0000000007712000-memory.dmp

      Filesize

      72KB

    • memory/2772-42-0x0000000000400000-0x0000000002BB0000-memory.dmp

      Filesize

      39.7MB

    • memory/2772-48-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2772-47-0x0000000000400000-0x0000000002BB0000-memory.dmp

      Filesize

      39.7MB

    • memory/2772-9-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2772-10-0x0000000004BC0000-0x0000000004BDA000-memory.dmp

      Filesize

      104KB

    • memory/3088-58-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-54-0x00000000070D0000-0x000000000710A000-memory.dmp

      Filesize

      232KB

    • memory/3088-80-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-88-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-86-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-84-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-82-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-78-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-76-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-74-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-72-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-70-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-68-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-66-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-62-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-61-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-64-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-53-0x00000000049D0000-0x0000000004A0C000-memory.dmp

      Filesize

      240KB

    • memory/3088-56-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-55-0x00000000070D0000-0x0000000007105000-memory.dmp

      Filesize

      212KB

    • memory/3088-847-0x0000000009CE0000-0x000000000A2F8000-memory.dmp

      Filesize

      6.1MB

    • memory/3088-848-0x000000000A350000-0x000000000A362000-memory.dmp

      Filesize

      72KB

    • memory/3088-849-0x000000000A370000-0x000000000A47A000-memory.dmp

      Filesize

      1.0MB

    • memory/3088-850-0x000000000A490000-0x000000000A4CC000-memory.dmp

      Filesize

      240KB

    • memory/3088-851-0x0000000004A60000-0x0000000004AAC000-memory.dmp

      Filesize

      304KB