Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2023, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe
Resource
win10v2004-20221111-en
General
-
Target
1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe
-
Size
478KB
-
MD5
8ec9d9d74fe6a323affae5071935ac66
-
SHA1
6f8cae45b6469520088942d008e475edc90ba7fc
-
SHA256
1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd
-
SHA512
453b42728174064325a9e2650a42d45b844adad1fc56365a9cdedd8a6330cadf23f2257f8de656a590697e5277e8cc8239cfda0982a5561eab041c1e9034aaa0
-
SSDEEP
12288:YMrFy90FJNGMd1wQ9hLotKvH2yGUq3YREqEZpc0:dyuNGMdiQ9JBfGUquJYT
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection lQW34fi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" lQW34fi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" lQW34fi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" lQW34fi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" lQW34fi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" lQW34fi.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 2540 nfM97To.exe 560 bjM59al.exe 2168 day66zn.exe 852 lQW34fi.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bjM59al.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" lQW34fi.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nfM97To.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce nfM97To.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2924 560 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 560 bjM59al.exe 560 bjM59al.exe 2168 day66zn.exe 2168 day66zn.exe 852 lQW34fi.exe 852 lQW34fi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 560 bjM59al.exe Token: SeDebugPrivilege 2168 day66zn.exe Token: SeDebugPrivilege 852 lQW34fi.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4800 wrote to memory of 2540 4800 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe 81 PID 4800 wrote to memory of 2540 4800 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe 81 PID 4800 wrote to memory of 2540 4800 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe 81 PID 2540 wrote to memory of 560 2540 nfM97To.exe 82 PID 2540 wrote to memory of 560 2540 nfM97To.exe 82 PID 2540 wrote to memory of 560 2540 nfM97To.exe 82 PID 2540 wrote to memory of 2168 2540 nfM97To.exe 85 PID 2540 wrote to memory of 2168 2540 nfM97To.exe 85 PID 2540 wrote to memory of 2168 2540 nfM97To.exe 85 PID 4800 wrote to memory of 852 4800 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe 86 PID 4800 wrote to memory of 852 4800 1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe"C:\Users\Admin\AppData\Local\Temp\1f9250b567d166729d25a9bfd709ae66a11a80350eacbb229db879357b7adadd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nfM97To.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nfM97To.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bjM59al.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bjM59al.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 10644⤵
- Program crash
PID:2924
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\day66zn.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\day66zn.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lQW34fi.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lQW34fi.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 560 -ip 5601⤵PID:3716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
374KB
MD58ac25df6dae6c303f421b40b485fde9d
SHA138dd1fe9a154a28e5109e373eb87aff7cd0c071b
SHA256a5e67f5190fb51f99eb8013e04ff58c0c95ccbaa26e1c5ba1277f3fd875c9093
SHA512785d1fcd4d1de78bf066aca9e351e54b2abbd4ea7243a11f3637a7779ab82173ccf89dc4ce47ae556185696ae6ded24344b063162275ce9f6476ac3559b45929
-
Filesize
374KB
MD58ac25df6dae6c303f421b40b485fde9d
SHA138dd1fe9a154a28e5109e373eb87aff7cd0c071b
SHA256a5e67f5190fb51f99eb8013e04ff58c0c95ccbaa26e1c5ba1277f3fd875c9093
SHA512785d1fcd4d1de78bf066aca9e351e54b2abbd4ea7243a11f3637a7779ab82173ccf89dc4ce47ae556185696ae6ded24344b063162275ce9f6476ac3559b45929
-
Filesize
234KB
MD5a7585267b7ee449583a37516dd0875f3
SHA15e1d49da2036caac2bc7f8148196a85279cfcd88
SHA2565486cca58e0179df33a9eb3ab056acd4ff2c2c80ab610b7151215c8595c37a30
SHA51220f4503b80fdc94499e9895dbe63e497f11098b785b7f504dc53c451a4df72555aa04e0ae02c2d11efe56c370f04325ba78d07df72bda4bdd7dc3007196a79c6
-
Filesize
234KB
MD5a7585267b7ee449583a37516dd0875f3
SHA15e1d49da2036caac2bc7f8148196a85279cfcd88
SHA2565486cca58e0179df33a9eb3ab056acd4ff2c2c80ab610b7151215c8595c37a30
SHA51220f4503b80fdc94499e9895dbe63e497f11098b785b7f504dc53c451a4df72555aa04e0ae02c2d11efe56c370f04325ba78d07df72bda4bdd7dc3007196a79c6
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2