Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2023, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe
Resource
win10v2004-20221111-en
General
-
Target
0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe
-
Size
770KB
-
MD5
1e226692b2d5423e50a51bea02971818
-
SHA1
6372899359638d4440876a6e6c5c2541401241bf
-
SHA256
0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f
-
SHA512
fbcc06dce71e538d17a13d9d6d41b80b3c1f8ee3d03f81c5f2f461283dcbd6bedca32a60bd4bc8c09be36021afc4c3531d1d2264129779988fe59599a040a90b
-
SSDEEP
24576:LyiCSIPlQjAmLRNtLh0o/IhSdi6ZHB9Z:+hlkASDXy16ZB9
Malware Config
Extracted
redline
cr2
176.113.115.17:4132
-
auth_value
4bf573d6f5ab16f3b5e36da6855dc128
Extracted
redline
dunm
193.233.20.12:4132
-
auth_value
352959e3707029296ec94306d74e2334
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" svA90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" svA90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" svA90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" svA90.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection svA90.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" svA90.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
pid Process 4232 vYx49.exe 988 vbc55.exe 2576 dwM92.exe 3948 lCW04.exe 4628 nIY14.exe 3588 svA90.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" svA90.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vYx49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vYx49.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vbc55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" vbc55.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3948 set thread context of 2872 3948 lCW04.exe 93 -
Program crash 1 IoCs
pid pid_target Process procid_target 4876 2576 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2576 dwM92.exe 2576 dwM92.exe 4628 nIY14.exe 4628 nIY14.exe 2872 AppLaunch.exe 2872 AppLaunch.exe 3588 svA90.exe 3588 svA90.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2576 dwM92.exe Token: SeDebugPrivilege 4628 nIY14.exe Token: SeDebugPrivilege 2872 AppLaunch.exe Token: SeDebugPrivilege 3588 svA90.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2800 wrote to memory of 4232 2800 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe 80 PID 2800 wrote to memory of 4232 2800 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe 80 PID 2800 wrote to memory of 4232 2800 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe 80 PID 4232 wrote to memory of 988 4232 vYx49.exe 81 PID 4232 wrote to memory of 988 4232 vYx49.exe 81 PID 4232 wrote to memory of 988 4232 vYx49.exe 81 PID 988 wrote to memory of 2576 988 vbc55.exe 82 PID 988 wrote to memory of 2576 988 vbc55.exe 82 PID 988 wrote to memory of 2576 988 vbc55.exe 82 PID 988 wrote to memory of 3948 988 vbc55.exe 91 PID 988 wrote to memory of 3948 988 vbc55.exe 91 PID 988 wrote to memory of 3948 988 vbc55.exe 91 PID 3948 wrote to memory of 2872 3948 lCW04.exe 93 PID 3948 wrote to memory of 2872 3948 lCW04.exe 93 PID 3948 wrote to memory of 2872 3948 lCW04.exe 93 PID 3948 wrote to memory of 2872 3948 lCW04.exe 93 PID 3948 wrote to memory of 2872 3948 lCW04.exe 93 PID 4232 wrote to memory of 4628 4232 vYx49.exe 94 PID 4232 wrote to memory of 4628 4232 vYx49.exe 94 PID 4232 wrote to memory of 4628 4232 vYx49.exe 94 PID 2800 wrote to memory of 3588 2800 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe 95 PID 2800 wrote to memory of 3588 2800 0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe"C:\Users\Admin\AppData\Local\Temp\0bead0cdef80c6f14d2886f577edaa1b9d81e7e254ba63d3d5667f10293edb2f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vYx49.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vYx49.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vbc55.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vbc55.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dwM92.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dwM92.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 13525⤵
- Program crash
PID:4876
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lCW04.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lCW04.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nIY14.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nIY14.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svA90.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svA90.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2576 -ip 25761⤵PID:4392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
666KB
MD5834257b7abd368047bb5e7191cb18466
SHA15f6d29b699b26dca4088a8cd93a57ee3d8957934
SHA256ff84bb2e31dea5749f7699f5f6bc4601aa4f74b01f383db17c423c11f269e186
SHA512b5f5e6f2ff500585cbf1b8290377bede06e9308414ed4998b7e08ffa67538ddfd3bd0cf9be5b158c99ff491a5ef1a49b3a67c7a8e296ec07b5021ac5147d009c
-
Filesize
666KB
MD5834257b7abd368047bb5e7191cb18466
SHA15f6d29b699b26dca4088a8cd93a57ee3d8957934
SHA256ff84bb2e31dea5749f7699f5f6bc4601aa4f74b01f383db17c423c11f269e186
SHA512b5f5e6f2ff500585cbf1b8290377bede06e9308414ed4998b7e08ffa67538ddfd3bd0cf9be5b158c99ff491a5ef1a49b3a67c7a8e296ec07b5021ac5147d009c
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
175KB
MD569f79e05d0c83aee310d9adfe5aa7f2b
SHA1485c490180380051a14316564fbda07723be11b1
SHA256c41dc7f6cc752595337cd7f209f923b43b061b201c6ab4dc02151afb90cd66e2
SHA512f1789a74aeb83867c37ddeadcd06cddfc1454a94fcc122b35d67b0309b46742b9a6611e4c3e583baa90a3fd456e45c75ae5f1a206f6e4500c1f3f8ddf5e47b42
-
Filesize
521KB
MD5f76b7d591680121f0e4859decaad4d96
SHA174f5431a449dc97aff47a2e3a37a1d658355a108
SHA25615795e52a2230ed68cdf2e7e951bebf73567a3f295bea6108223c0b2838e2c20
SHA5124042eec1349378828650ca244326021a79104343652e49bf8ad14d13c0b370d43482bbd17409f1c500c03a95c3b15183b38bb60cf31074943e0869f7d5d61a39
-
Filesize
521KB
MD5f76b7d591680121f0e4859decaad4d96
SHA174f5431a449dc97aff47a2e3a37a1d658355a108
SHA25615795e52a2230ed68cdf2e7e951bebf73567a3f295bea6108223c0b2838e2c20
SHA5124042eec1349378828650ca244326021a79104343652e49bf8ad14d13c0b370d43482bbd17409f1c500c03a95c3b15183b38bb60cf31074943e0869f7d5d61a39
-
Filesize
306KB
MD5921ae22af4e5bcbbba6eeac357e87cdc
SHA1fe565744533a2c245ae97f1f96971e6618439867
SHA256c0f241a8d18844f41622cde61dc532a31249f2ea6af1ed23ad0f83df4c95bc21
SHA512923b394378e9c6df6c101a7d134a7c8c931bb8fabe744df002fa2d49bb6c35e1b4ea0ea9ed6e70384cf6205561c3816c83e55592e4305ccde653a76e98e61514
-
Filesize
306KB
MD5921ae22af4e5bcbbba6eeac357e87cdc
SHA1fe565744533a2c245ae97f1f96971e6618439867
SHA256c0f241a8d18844f41622cde61dc532a31249f2ea6af1ed23ad0f83df4c95bc21
SHA512923b394378e9c6df6c101a7d134a7c8c931bb8fabe744df002fa2d49bb6c35e1b4ea0ea9ed6e70384cf6205561c3816c83e55592e4305ccde653a76e98e61514
-
Filesize
281KB
MD54f7302c3f372c146e2dd87a7ea481f31
SHA1c1f39c30a4138440399ae1c566cd414b2a4dd459
SHA2566c9f8de22f30f2d8ddf1fa04c975d2832f6455e546a5ac1e923e76016ffa66e3
SHA512a9a355bef77e741cb4b5040480960e0509d5c2ebcc866ad81a448bd24096fafa4962d02f76f365f8714bb8f41bbff28320566ce049746e3857c4353029140312
-
Filesize
281KB
MD54f7302c3f372c146e2dd87a7ea481f31
SHA1c1f39c30a4138440399ae1c566cd414b2a4dd459
SHA2566c9f8de22f30f2d8ddf1fa04c975d2832f6455e546a5ac1e923e76016ffa66e3
SHA512a9a355bef77e741cb4b5040480960e0509d5c2ebcc866ad81a448bd24096fafa4962d02f76f365f8714bb8f41bbff28320566ce049746e3857c4353029140312