Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2023, 18:54
Static task
static1
Behavioral task
behavioral1
Sample
98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe
Resource
win10v2004-20230220-en
General
-
Target
98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe
-
Size
773KB
-
MD5
a3e30168327fe0750ec8fb20f277aa87
-
SHA1
6d2a22acafc59f1d5fa3d031e8249ab66f9bab32
-
SHA256
98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d
-
SHA512
528bfdf282afec9875a32a5f1af6683636c42f96942bb6d6e7b86e4bae8a2a593af1d715d6c39ba56fa448e2eb217267d17b34b044620e70007af74e3d43e20e
-
SSDEEP
12288:eAZN5Bv30aX6nqtNl7BAmsRhUFjeTIEhhyFTIP2qVpZfxOFyrMxS6DVT:HN5Bv30a1l7StedeKGPnVPoS6DVT
Malware Config
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bum8113.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bum8113.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bum8113.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bum8113.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bum8113.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bum8113.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation dRF92s79.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation metafor.exe -
Executes dropped EXE 7 IoCs
pid Process 4048 film5950.exe 3336 bum8113.exe 3588 con3150.exe 2268 dRF92s79.exe 3200 metafor.exe 4728 metafor.exe 1912 metafor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bum8113.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bum8113.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" film5950.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce film5950.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2824 3756 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3336 bum8113.exe 3336 bum8113.exe 3588 con3150.exe 3588 con3150.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3336 bum8113.exe Token: SeDebugPrivilege 3588 con3150.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3756 wrote to memory of 4048 3756 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe 85 PID 3756 wrote to memory of 4048 3756 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe 85 PID 3756 wrote to memory of 4048 3756 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe 85 PID 4048 wrote to memory of 3336 4048 film5950.exe 86 PID 4048 wrote to memory of 3336 4048 film5950.exe 86 PID 4048 wrote to memory of 3336 4048 film5950.exe 86 PID 4048 wrote to memory of 3588 4048 film5950.exe 95 PID 4048 wrote to memory of 3588 4048 film5950.exe 95 PID 4048 wrote to memory of 3588 4048 film5950.exe 95 PID 3756 wrote to memory of 2268 3756 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe 96 PID 3756 wrote to memory of 2268 3756 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe 96 PID 3756 wrote to memory of 2268 3756 98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe 96 PID 2268 wrote to memory of 3200 2268 dRF92s79.exe 97 PID 2268 wrote to memory of 3200 2268 dRF92s79.exe 97 PID 2268 wrote to memory of 3200 2268 dRF92s79.exe 97 PID 3200 wrote to memory of 2532 3200 metafor.exe 99 PID 3200 wrote to memory of 2532 3200 metafor.exe 99 PID 3200 wrote to memory of 2532 3200 metafor.exe 99 PID 3200 wrote to memory of 3604 3200 metafor.exe 101 PID 3200 wrote to memory of 3604 3200 metafor.exe 101 PID 3200 wrote to memory of 3604 3200 metafor.exe 101 PID 3604 wrote to memory of 100 3604 cmd.exe 104 PID 3604 wrote to memory of 100 3604 cmd.exe 104 PID 3604 wrote to memory of 100 3604 cmd.exe 104 PID 3604 wrote to memory of 4808 3604 cmd.exe 105 PID 3604 wrote to memory of 4808 3604 cmd.exe 105 PID 3604 wrote to memory of 4808 3604 cmd.exe 105 PID 3604 wrote to memory of 3644 3604 cmd.exe 106 PID 3604 wrote to memory of 3644 3604 cmd.exe 106 PID 3604 wrote to memory of 3644 3604 cmd.exe 106 PID 3604 wrote to memory of 1016 3604 cmd.exe 107 PID 3604 wrote to memory of 1016 3604 cmd.exe 107 PID 3604 wrote to memory of 1016 3604 cmd.exe 107 PID 3604 wrote to memory of 4428 3604 cmd.exe 108 PID 3604 wrote to memory of 4428 3604 cmd.exe 108 PID 3604 wrote to memory of 4428 3604 cmd.exe 108 PID 3604 wrote to memory of 1976 3604 cmd.exe 109 PID 3604 wrote to memory of 1976 3604 cmd.exe 109 PID 3604 wrote to memory of 1976 3604 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe"C:\Users\Admin\AppData\Local\Temp\98e6606a19b20e5733e026125340c1aef777fc370a686b6100a6c7395df7cc5d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F4⤵
- Creates scheduled task(s)
PID:2532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:100
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:N"5⤵PID:4808
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:R" /E5⤵PID:3644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1016
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:N"5⤵PID:4428
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:R" /E5⤵PID:1976
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 4282⤵
- Program crash
PID:2824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3756 -ip 37561⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:4728
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:1912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
382KB
MD565e4e4f30a4aef3d28440aefb0a4b05b
SHA19ba27fc1878e66823785565db46369ca3b065d35
SHA25656566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa
SHA51286ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4
-
Filesize
382KB
MD565e4e4f30a4aef3d28440aefb0a4b05b
SHA19ba27fc1878e66823785565db46369ca3b065d35
SHA25656566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa
SHA51286ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4
-
Filesize
323KB
MD5ee43881ab62092621b2d2e22a0295878
SHA10339221e3f787602fea6a0541817565d751a293c
SHA2562764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d
SHA512df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c
-
Filesize
323KB
MD5ee43881ab62092621b2d2e22a0295878
SHA10339221e3f787602fea6a0541817565d751a293c
SHA2562764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d
SHA512df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c
-
Filesize
175KB
MD592f2a148b8f701e50e2f838f73d4d7b7
SHA1324d8546e35d4f4285cac15b21620299ba5cb023
SHA2569ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04
SHA5123300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c
-
Filesize
175KB
MD592f2a148b8f701e50e2f838f73d4d7b7
SHA1324d8546e35d4f4285cac15b21620299ba5cb023
SHA2569ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04
SHA5123300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c