Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/01/2023, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
SоftwarеSetuрFilе.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
General
-
Target
SоftwarеSetuрFilе.exe
-
Size
686.6MB
-
MD5
f5679ca36a2c3f5a619e7c35e3897db2
-
SHA1
55c95120c1e75389b2e45a18c0aa4bda38a9dcf9
-
SHA256
ead3b800dcccdefeada1f825a3f1911040a965c93f16eed5c711317ab3fb7f0f
-
SHA512
676bc18e5b19c7d2a44757b04667174704a23c82a4ec4b8db92bd66a63daa98cfed27337c58b6d0ffaec0cf6e9cf2a4215f1ca66d71a1e5c3964d6a9617f44f1
-
SSDEEP
49152:YmVlA7GqB6/KWpXeJpyYmJdIiDix/TYLAbJMZnMw2tNn1Or/GtXEJ+GRgD6Vk3jI:L8Na5XeJQpU/sLAKnMwoyXz
Malware Config
Extracted
Family
redline
Botnet
Meta
C2
109.205.214.6:81
Attributes
-
auth_value
ff920b9b3b34fa545260b11f0ece519d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 832 SоftwarеSetuрFilе.exe 832 SоftwarеSetuрFilе.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1856 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 832 SоftwarеSetuрFilе.exe Token: SeDebugPrivilege 1856 taskmgr.exe Token: SeDebugPrivilege 1952 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1856 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe 1952 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SоftwarеSetuрFilе.exe"C:\Users\Admin\AppData\Local\Temp\SоftwarеSetuрFilе.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1856
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1952