Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2023, 11:17
Static task
static1
Behavioral task
behavioral1
Sample
349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe
Resource
win10v2004-20230220-en
General
-
Target
349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe
-
Size
731KB
-
MD5
af2fee0bfcea457f9762b5764b1ccc23
-
SHA1
474197911b4ab0ff9498c6c5e174bdc035327e20
-
SHA256
349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3
-
SHA512
9d93b192543bd670feba1b905863ac22a1b967a4fb0cb247482bfbf0e8dc52a796822a086372e8a02b4ab1842b1851c6cf6256834d4b0fb88e0c55ccd6b4b467
-
SSDEEP
12288:hQzSqyOm5fdGWX1PQqujRPcNrRnqIgoVGbx/V2Mxs3EZ86ra:0yO+V1PQjjZARnqoVG1osZbra
Malware Config
Extracted
redline
diza
193.56.146.11:4173
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bum0753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bum0753.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bum0753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bum0753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bum0753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bum0753.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation dBz39s36.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation metafor.exe -
Executes dropped EXE 7 IoCs
pid Process 4128 film2454.exe 4796 bum0753.exe 4044 con0973.exe 2068 dBz39s36.exe 4100 metafor.exe 2984 metafor.exe 4708 metafor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bum0753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bum0753.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce film2454.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" film2454.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4340 1912 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4832 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4796 bum0753.exe 4796 bum0753.exe 4044 con0973.exe 4044 con0973.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4796 bum0753.exe Token: SeDebugPrivilege 4044 con0973.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1912 wrote to memory of 4128 1912 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe 85 PID 1912 wrote to memory of 4128 1912 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe 85 PID 1912 wrote to memory of 4128 1912 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe 85 PID 4128 wrote to memory of 4796 4128 film2454.exe 86 PID 4128 wrote to memory of 4796 4128 film2454.exe 86 PID 4128 wrote to memory of 4796 4128 film2454.exe 86 PID 4128 wrote to memory of 4044 4128 film2454.exe 98 PID 4128 wrote to memory of 4044 4128 film2454.exe 98 PID 4128 wrote to memory of 4044 4128 film2454.exe 98 PID 1912 wrote to memory of 2068 1912 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe 100 PID 1912 wrote to memory of 2068 1912 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe 100 PID 1912 wrote to memory of 2068 1912 349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe 100 PID 2068 wrote to memory of 4100 2068 dBz39s36.exe 101 PID 2068 wrote to memory of 4100 2068 dBz39s36.exe 101 PID 2068 wrote to memory of 4100 2068 dBz39s36.exe 101 PID 4100 wrote to memory of 4832 4100 metafor.exe 103 PID 4100 wrote to memory of 4832 4100 metafor.exe 103 PID 4100 wrote to memory of 4832 4100 metafor.exe 103 PID 4100 wrote to memory of 4108 4100 metafor.exe 105 PID 4100 wrote to memory of 4108 4100 metafor.exe 105 PID 4100 wrote to memory of 4108 4100 metafor.exe 105 PID 4108 wrote to memory of 4240 4108 cmd.exe 108 PID 4108 wrote to memory of 4240 4108 cmd.exe 108 PID 4108 wrote to memory of 4240 4108 cmd.exe 108 PID 4108 wrote to memory of 2224 4108 cmd.exe 109 PID 4108 wrote to memory of 2224 4108 cmd.exe 109 PID 4108 wrote to memory of 2224 4108 cmd.exe 109 PID 4108 wrote to memory of 3760 4108 cmd.exe 110 PID 4108 wrote to memory of 3760 4108 cmd.exe 110 PID 4108 wrote to memory of 3760 4108 cmd.exe 110 PID 4108 wrote to memory of 3516 4108 cmd.exe 111 PID 4108 wrote to memory of 3516 4108 cmd.exe 111 PID 4108 wrote to memory of 3516 4108 cmd.exe 111 PID 4108 wrote to memory of 3708 4108 cmd.exe 112 PID 4108 wrote to memory of 3708 4108 cmd.exe 112 PID 4108 wrote to memory of 3708 4108 cmd.exe 112 PID 4108 wrote to memory of 3932 4108 cmd.exe 113 PID 4108 wrote to memory of 3932 4108 cmd.exe 113 PID 4108 wrote to memory of 3932 4108 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe"C:\Users\Admin\AppData\Local\Temp\349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film2454.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film2454.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum0753.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum0753.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0973.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0973.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dBz39s36.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dBz39s36.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F4⤵
- Creates scheduled task(s)
PID:4832
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4240
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:N"5⤵PID:2224
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:R" /E5⤵PID:3760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3516
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:N"5⤵PID:3708
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:R" /E5⤵PID:3932
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 5122⤵
- Program crash
PID:4340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1912 -ip 19121⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:4708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
382KB
MD5c24e1d7a3b37f2d94db3c8a95455de7b
SHA162de187c9a5b9346ffe7f719b13184cc440229f1
SHA25641d46b43b59c2b0832b08d3870fdf565d58d0cf6bb0ce43e49bed66ed52e8475
SHA51289987c5160cc19e6986fa8b197966a4b39af0c6ccebb5f8cfdbbf0b01db1d2d9682b6a5fb45c673732d58af86657ded9f7a97eafebc1826ad155e32c0d6af68b
-
Filesize
382KB
MD5c24e1d7a3b37f2d94db3c8a95455de7b
SHA162de187c9a5b9346ffe7f719b13184cc440229f1
SHA25641d46b43b59c2b0832b08d3870fdf565d58d0cf6bb0ce43e49bed66ed52e8475
SHA51289987c5160cc19e6986fa8b197966a4b39af0c6ccebb5f8cfdbbf0b01db1d2d9682b6a5fb45c673732d58af86657ded9f7a97eafebc1826ad155e32c0d6af68b
-
Filesize
323KB
MD5ee43881ab62092621b2d2e22a0295878
SHA10339221e3f787602fea6a0541817565d751a293c
SHA2562764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d
SHA512df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c
-
Filesize
323KB
MD5ee43881ab62092621b2d2e22a0295878
SHA10339221e3f787602fea6a0541817565d751a293c
SHA2562764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d
SHA512df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c
-
Filesize
175KB
MD55c65803d42d5d06e302798faee3a11cd
SHA11e8de783b9994a3e422d9799437e4ad0ce554cc6
SHA256a44091a1a8110f482b8a4bea50b7eeddc9d8cb6c11878fe49b955f886b3defd2
SHA51271a465f5df53ed7fcc34a492acedb12bb2d81538aa4e137dfb9ec71bb911a943eed2b2d3f45cd13f15cb57aaf4f7536576cc5629848da5c6e273ec1e323d4804
-
Filesize
175KB
MD55c65803d42d5d06e302798faee3a11cd
SHA11e8de783b9994a3e422d9799437e4ad0ce554cc6
SHA256a44091a1a8110f482b8a4bea50b7eeddc9d8cb6c11878fe49b955f886b3defd2
SHA51271a465f5df53ed7fcc34a492acedb12bb2d81538aa4e137dfb9ec71bb911a943eed2b2d3f45cd13f15cb57aaf4f7536576cc5629848da5c6e273ec1e323d4804