Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2023, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
714KB
-
MD5
0b4e0ff9bb68c7d337df284eb1f318d6
-
SHA1
635e9adafd773ed0844cdb8854fdd384d4dc5119
-
SHA256
1e2ed693393782810af0ab0ea37fd11e27749fedf85451fd0d1abb01bd73bbff
-
SHA512
ce275cf2ce5680e00878cec176f23650194608c3f3987898c349c324b87102d916751a5a4294911b9bbad0c6e7cf2000b1c7b83807d0a592628d23dadc86749d
-
SSDEEP
12288:lMrVy90uj82Z99MMPs4v5NHuheoTjExFw4CPJN6PPMLKvvUBXMvnc11/dDarG3i4:8yF82Z99M565NHugCBYpqcvnWcI
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" fyF62.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" fyF62.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection fyF62.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" fyF62.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" fyF62.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" fyF62.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation bbl04FI.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 9 IoCs
pid Process 3544 gHJ30ve.exe 4776 gBV99TS.exe 2688 anl66dY.exe 1444 bbl04FI.exe 4948 mnolyk.exe 2120 dUl6799.exe 1784 fyF62.exe 3068 mnolyk.exe 4888 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 4040 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" fyF62.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" gBV99TS.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce gHJ30ve.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" gHJ30ve.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce gBV99TS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3476 2120 WerFault.exe 86 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4148 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2688 anl66dY.exe 2688 anl66dY.exe 2120 dUl6799.exe 2120 dUl6799.exe 1784 fyF62.exe 1784 fyF62.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2688 anl66dY.exe Token: SeDebugPrivilege 2120 dUl6799.exe Token: SeDebugPrivilege 1784 fyF62.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 444 wrote to memory of 3544 444 file.exe 81 PID 444 wrote to memory of 3544 444 file.exe 81 PID 444 wrote to memory of 3544 444 file.exe 81 PID 3544 wrote to memory of 4776 3544 gHJ30ve.exe 82 PID 3544 wrote to memory of 4776 3544 gHJ30ve.exe 82 PID 3544 wrote to memory of 4776 3544 gHJ30ve.exe 82 PID 4776 wrote to memory of 2688 4776 gBV99TS.exe 83 PID 4776 wrote to memory of 2688 4776 gBV99TS.exe 83 PID 4776 wrote to memory of 2688 4776 gBV99TS.exe 83 PID 4776 wrote to memory of 1444 4776 gBV99TS.exe 84 PID 4776 wrote to memory of 1444 4776 gBV99TS.exe 84 PID 4776 wrote to memory of 1444 4776 gBV99TS.exe 84 PID 1444 wrote to memory of 4948 1444 bbl04FI.exe 85 PID 1444 wrote to memory of 4948 1444 bbl04FI.exe 85 PID 1444 wrote to memory of 4948 1444 bbl04FI.exe 85 PID 3544 wrote to memory of 2120 3544 gHJ30ve.exe 86 PID 3544 wrote to memory of 2120 3544 gHJ30ve.exe 86 PID 3544 wrote to memory of 2120 3544 gHJ30ve.exe 86 PID 4948 wrote to memory of 4148 4948 mnolyk.exe 87 PID 4948 wrote to memory of 4148 4948 mnolyk.exe 87 PID 4948 wrote to memory of 4148 4948 mnolyk.exe 87 PID 4948 wrote to memory of 260 4948 mnolyk.exe 89 PID 4948 wrote to memory of 260 4948 mnolyk.exe 89 PID 4948 wrote to memory of 260 4948 mnolyk.exe 89 PID 260 wrote to memory of 3264 260 cmd.exe 91 PID 260 wrote to memory of 3264 260 cmd.exe 91 PID 260 wrote to memory of 3264 260 cmd.exe 91 PID 260 wrote to memory of 1132 260 cmd.exe 92 PID 260 wrote to memory of 1132 260 cmd.exe 92 PID 260 wrote to memory of 1132 260 cmd.exe 92 PID 260 wrote to memory of 3772 260 cmd.exe 93 PID 260 wrote to memory of 3772 260 cmd.exe 93 PID 260 wrote to memory of 3772 260 cmd.exe 93 PID 260 wrote to memory of 4260 260 cmd.exe 94 PID 260 wrote to memory of 4260 260 cmd.exe 94 PID 260 wrote to memory of 4260 260 cmd.exe 94 PID 260 wrote to memory of 3644 260 cmd.exe 95 PID 260 wrote to memory of 3644 260 cmd.exe 95 PID 260 wrote to memory of 3644 260 cmd.exe 95 PID 260 wrote to memory of 3172 260 cmd.exe 96 PID 260 wrote to memory of 3172 260 cmd.exe 96 PID 260 wrote to memory of 3172 260 cmd.exe 96 PID 444 wrote to memory of 1784 444 file.exe 99 PID 444 wrote to memory of 1784 444 file.exe 99 PID 4948 wrote to memory of 4040 4948 mnolyk.exe 103 PID 4948 wrote to memory of 4040 4948 mnolyk.exe 103 PID 4948 wrote to memory of 4040 4948 mnolyk.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gHJ30ve.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gHJ30ve.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gBV99TS.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gBV99TS.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\anl66dY.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\anl66dY.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbl04FI.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbl04FI.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F6⤵
- Creates scheduled task(s)
PID:4148
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3264
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"7⤵PID:1132
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E7⤵PID:3772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4260
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"7⤵PID:3644
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E7⤵PID:3172
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4040
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUl6799.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUl6799.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 13244⤵
- Program crash
PID:3476
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fyF62.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fyF62.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2120 -ip 21201⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:3068
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
PID:4888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD552fca4d08faccbd7d3f9a487158ed24a
SHA1999297fae9adaaca1f2163e45aa4100ebe2a27f6
SHA2566ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14
SHA5127669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368
-
Filesize
236KB
MD552fca4d08faccbd7d3f9a487158ed24a
SHA1999297fae9adaaca1f2163e45aa4100ebe2a27f6
SHA2566ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14
SHA5127669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368
-
Filesize
236KB
MD552fca4d08faccbd7d3f9a487158ed24a
SHA1999297fae9adaaca1f2163e45aa4100ebe2a27f6
SHA2566ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14
SHA5127669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368
-
Filesize
236KB
MD552fca4d08faccbd7d3f9a487158ed24a
SHA1999297fae9adaaca1f2163e45aa4100ebe2a27f6
SHA2566ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14
SHA5127669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
610KB
MD5c7614615de3cbb333d29dfb381c4d0ef
SHA1f6705fdfdee4ef5bf64aac4512fdbf14d8a83031
SHA256949f9427de53ab0ead5b502bd0634e9abf3260a747ec741688375420ace46fe3
SHA5125c9b45c154897cc6f6129e174eb7235a43d99bfca6ea8727b1e127d0183c97f786f6db187e6730445882486bdfb8477ee62fcf15742b32439120bdcdaeffd633
-
Filesize
610KB
MD5c7614615de3cbb333d29dfb381c4d0ef
SHA1f6705fdfdee4ef5bf64aac4512fdbf14d8a83031
SHA256949f9427de53ab0ead5b502bd0634e9abf3260a747ec741688375420ace46fe3
SHA5125c9b45c154897cc6f6129e174eb7235a43d99bfca6ea8727b1e127d0183c97f786f6db187e6730445882486bdfb8477ee62fcf15742b32439120bdcdaeffd633
-
Filesize
278KB
MD55e7ad96227ac97ea047c202bab0a79dd
SHA1700c285600d0d8324660dac5326eaae1b1891645
SHA2561e55c8ff6e68cb300f581fd5003dd36f35835d00f9c8938a3a0eb9b7cded4875
SHA51227af17d76db10679b00a15ef754ebc41e830bc4fbcd93073d1cfba416824e800da10e636bd44ce8f177281c4a706c41c9af58ea82e9db54c81d038d7b18af08f
-
Filesize
278KB
MD55e7ad96227ac97ea047c202bab0a79dd
SHA1700c285600d0d8324660dac5326eaae1b1891645
SHA2561e55c8ff6e68cb300f581fd5003dd36f35835d00f9c8938a3a0eb9b7cded4875
SHA51227af17d76db10679b00a15ef754ebc41e830bc4fbcd93073d1cfba416824e800da10e636bd44ce8f177281c4a706c41c9af58ea82e9db54c81d038d7b18af08f
-
Filesize
285KB
MD517559bb2092cb3e1c88bb59983337ea3
SHA1ce398c56819807343ffa52cb5a63c7be8da58810
SHA256fb2ceab656059e904423467a271af67c3ac573d9163f278d7ec741505a0092bd
SHA5127b9b87360eec78c2121193a38fa59593e919807312d23c075999c9d619fbec4e744b376edf7a6af5fb739643e266c51a293157f98cfcd4407ae38fc7fc2f0602
-
Filesize
285KB
MD517559bb2092cb3e1c88bb59983337ea3
SHA1ce398c56819807343ffa52cb5a63c7be8da58810
SHA256fb2ceab656059e904423467a271af67c3ac573d9163f278d7ec741505a0092bd
SHA5127b9b87360eec78c2121193a38fa59593e919807312d23c075999c9d619fbec4e744b376edf7a6af5fb739643e266c51a293157f98cfcd4407ae38fc7fc2f0602
-
Filesize
175KB
MD5dd0c9e110c68ce1fa5308979ef718f7b
SHA1473deb8069f0841d47b74b7f414dacc6f96eca78
SHA256dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3
SHA51229bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236
-
Filesize
175KB
MD5dd0c9e110c68ce1fa5308979ef718f7b
SHA1473deb8069f0841d47b74b7f414dacc6f96eca78
SHA256dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3
SHA51229bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236
-
Filesize
236KB
MD552fca4d08faccbd7d3f9a487158ed24a
SHA1999297fae9adaaca1f2163e45aa4100ebe2a27f6
SHA2566ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14
SHA5127669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368
-
Filesize
236KB
MD552fca4d08faccbd7d3f9a487158ed24a
SHA1999297fae9adaaca1f2163e45aa4100ebe2a27f6
SHA2566ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14
SHA5127669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368
-
Filesize
89KB
MD58c5b3a2beac24f9a4878c50ce26c4623
SHA1e223a25b65a685c5be974ab1865e03497f64bda0
SHA256c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4
SHA512b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6
-
Filesize
89KB
MD58c5b3a2beac24f9a4878c50ce26c4623
SHA1e223a25b65a685c5be974ab1865e03497f64bda0
SHA256c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4
SHA512b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6