Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2023, 03:37

General

  • Target

    072af4027c94ee255fbd32b25ad60798d3f5668dc994f4ebc4f72971a02c300e.exe

  • Size

    546KB

  • MD5

    0652658f0d87fba539d4e65083c815e2

  • SHA1

    fb302cbc7cf27f498aacc246db04f38098eea199

  • SHA256

    072af4027c94ee255fbd32b25ad60798d3f5668dc994f4ebc4f72971a02c300e

  • SHA512

    b6b919be69d2af4414459ee48a66960b32215dfc2fe979d39963aae25a6737c7940f0dbeb57c28bf8ee0cb6171d40d9685b54c17d871a93f522eda477026465f

  • SSDEEP

    12288:IMrmy90dJG/rHg62J30NsYeyJidazIUaqAE2BADPWtWtYGSe:+yCJGjHsJEuhezIUaqAj1tWAe

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

gonna

C2

193.56.146.220:4174

Attributes
  • auth_value

    10ce5127fa09a5422f1a407fb6a7c077

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\072af4027c94ee255fbd32b25ad60798d3f5668dc994f4ebc4f72971a02c300e.exe
    "C:\Users\Admin\AppData\Local\Temp\072af4027c94ee255fbd32b25ad60798d3f5668dc994f4ebc4f72971a02c300e.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkWQ6077hP.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkWQ6077hP.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2866yQ.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2866yQ.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1088
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uzast82.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uzast82.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:276

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uzast82.exe

    Filesize

    175KB

    MD5

    ddaf6a7e4c6bd55f4001a68b41020710

    SHA1

    cc50a5dd9e0b1be80c43b0850c002e0484b5d2ad

    SHA256

    5669aa2a6e00d71f9ca012fecdea7ec1134e22f4ac349106af7f7e5372a5b6a8

    SHA512

    02ececce795610f012f81feb1ec338dabedfbbfe0461df7352b1600cc04b6f5b8e14ebd715ba3ff32a3d5a75345eddd26cae6059bad48e3fda93e61cffac4d51

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uzast82.exe

    Filesize

    175KB

    MD5

    ddaf6a7e4c6bd55f4001a68b41020710

    SHA1

    cc50a5dd9e0b1be80c43b0850c002e0484b5d2ad

    SHA256

    5669aa2a6e00d71f9ca012fecdea7ec1134e22f4ac349106af7f7e5372a5b6a8

    SHA512

    02ececce795610f012f81feb1ec338dabedfbbfe0461df7352b1600cc04b6f5b8e14ebd715ba3ff32a3d5a75345eddd26cae6059bad48e3fda93e61cffac4d51

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkWQ6077hP.exe

    Filesize

    402KB

    MD5

    ae92995063c599f57c80a5d35a98b340

    SHA1

    72bbb27d0ea04722ba1cb373667db2bb2a2f2810

    SHA256

    ec81fa71088214f6f50b0f4e35f2ee96f405a97b165b24ddf3851fc81e816f13

    SHA512

    76b0d5b5420d4de748bd0115a72dc506471893bfbc07bc9bfa9dbc4623a13a0b610de653bb666675ec6998b59f5d85a044bb6b5cf0b0266afc6e76fc1636ea08

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkWQ6077hP.exe

    Filesize

    402KB

    MD5

    ae92995063c599f57c80a5d35a98b340

    SHA1

    72bbb27d0ea04722ba1cb373667db2bb2a2f2810

    SHA256

    ec81fa71088214f6f50b0f4e35f2ee96f405a97b165b24ddf3851fc81e816f13

    SHA512

    76b0d5b5420d4de748bd0115a72dc506471893bfbc07bc9bfa9dbc4623a13a0b610de653bb666675ec6998b59f5d85a044bb6b5cf0b0266afc6e76fc1636ea08

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2866yQ.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2866yQ.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe

    Filesize

    367KB

    MD5

    b027ebb3e70d7bc51c75bbdfd85ea392

    SHA1

    89bea40a9f34e998af07884e9a3da1df21037b2a

    SHA256

    0c7a52e23934ed22905ccf78982f546ab0a36f92cdc64bf1cfddc7b4cb02d0e3

    SHA512

    4d51137bd5c210f57198dd9f08858415ec2b5f4cd4324651bbc4b0127fbcfb1486b4f5f2add49602afeb340675ba3f37344ccf3d728039dabf3411bd547f0a4c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe

    Filesize

    367KB

    MD5

    b027ebb3e70d7bc51c75bbdfd85ea392

    SHA1

    89bea40a9f34e998af07884e9a3da1df21037b2a

    SHA256

    0c7a52e23934ed22905ccf78982f546ab0a36f92cdc64bf1cfddc7b4cb02d0e3

    SHA512

    4d51137bd5c210f57198dd9f08858415ec2b5f4cd4324651bbc4b0127fbcfb1486b4f5f2add49602afeb340675ba3f37344ccf3d728039dabf3411bd547f0a4c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe

    Filesize

    367KB

    MD5

    b027ebb3e70d7bc51c75bbdfd85ea392

    SHA1

    89bea40a9f34e998af07884e9a3da1df21037b2a

    SHA256

    0c7a52e23934ed22905ccf78982f546ab0a36f92cdc64bf1cfddc7b4cb02d0e3

    SHA512

    4d51137bd5c210f57198dd9f08858415ec2b5f4cd4324651bbc4b0127fbcfb1486b4f5f2add49602afeb340675ba3f37344ccf3d728039dabf3411bd547f0a4c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\uzast82.exe

    Filesize

    175KB

    MD5

    ddaf6a7e4c6bd55f4001a68b41020710

    SHA1

    cc50a5dd9e0b1be80c43b0850c002e0484b5d2ad

    SHA256

    5669aa2a6e00d71f9ca012fecdea7ec1134e22f4ac349106af7f7e5372a5b6a8

    SHA512

    02ececce795610f012f81feb1ec338dabedfbbfe0461df7352b1600cc04b6f5b8e14ebd715ba3ff32a3d5a75345eddd26cae6059bad48e3fda93e61cffac4d51

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\uzast82.exe

    Filesize

    175KB

    MD5

    ddaf6a7e4c6bd55f4001a68b41020710

    SHA1

    cc50a5dd9e0b1be80c43b0850c002e0484b5d2ad

    SHA256

    5669aa2a6e00d71f9ca012fecdea7ec1134e22f4ac349106af7f7e5372a5b6a8

    SHA512

    02ececce795610f012f81feb1ec338dabedfbbfe0461df7352b1600cc04b6f5b8e14ebd715ba3ff32a3d5a75345eddd26cae6059bad48e3fda93e61cffac4d51

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vkWQ6077hP.exe

    Filesize

    402KB

    MD5

    ae92995063c599f57c80a5d35a98b340

    SHA1

    72bbb27d0ea04722ba1cb373667db2bb2a2f2810

    SHA256

    ec81fa71088214f6f50b0f4e35f2ee96f405a97b165b24ddf3851fc81e816f13

    SHA512

    76b0d5b5420d4de748bd0115a72dc506471893bfbc07bc9bfa9dbc4623a13a0b610de653bb666675ec6998b59f5d85a044bb6b5cf0b0266afc6e76fc1636ea08

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vkWQ6077hP.exe

    Filesize

    402KB

    MD5

    ae92995063c599f57c80a5d35a98b340

    SHA1

    72bbb27d0ea04722ba1cb373667db2bb2a2f2810

    SHA256

    ec81fa71088214f6f50b0f4e35f2ee96f405a97b165b24ddf3851fc81e816f13

    SHA512

    76b0d5b5420d4de748bd0115a72dc506471893bfbc07bc9bfa9dbc4623a13a0b610de653bb666675ec6998b59f5d85a044bb6b5cf0b0266afc6e76fc1636ea08

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\s2866yQ.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe

    Filesize

    367KB

    MD5

    b027ebb3e70d7bc51c75bbdfd85ea392

    SHA1

    89bea40a9f34e998af07884e9a3da1df21037b2a

    SHA256

    0c7a52e23934ed22905ccf78982f546ab0a36f92cdc64bf1cfddc7b4cb02d0e3

    SHA512

    4d51137bd5c210f57198dd9f08858415ec2b5f4cd4324651bbc4b0127fbcfb1486b4f5f2add49602afeb340675ba3f37344ccf3d728039dabf3411bd547f0a4c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe

    Filesize

    367KB

    MD5

    b027ebb3e70d7bc51c75bbdfd85ea392

    SHA1

    89bea40a9f34e998af07884e9a3da1df21037b2a

    SHA256

    0c7a52e23934ed22905ccf78982f546ab0a36f92cdc64bf1cfddc7b4cb02d0e3

    SHA512

    4d51137bd5c210f57198dd9f08858415ec2b5f4cd4324651bbc4b0127fbcfb1486b4f5f2add49602afeb340675ba3f37344ccf3d728039dabf3411bd547f0a4c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\t38xk55.exe

    Filesize

    367KB

    MD5

    b027ebb3e70d7bc51c75bbdfd85ea392

    SHA1

    89bea40a9f34e998af07884e9a3da1df21037b2a

    SHA256

    0c7a52e23934ed22905ccf78982f546ab0a36f92cdc64bf1cfddc7b4cb02d0e3

    SHA512

    4d51137bd5c210f57198dd9f08858415ec2b5f4cd4324651bbc4b0127fbcfb1486b4f5f2add49602afeb340675ba3f37344ccf3d728039dabf3411bd547f0a4c

  • memory/276-1002-0x0000000000AF0000-0x0000000000B22000-memory.dmp

    Filesize

    200KB

  • memory/1036-72-0x0000000000F10000-0x0000000000F1A000-memory.dmp

    Filesize

    40KB

  • memory/1088-105-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-125-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-94-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-96-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-98-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-99-0x0000000000290000-0x00000000002DB000-memory.dmp

    Filesize

    300KB

  • memory/1088-102-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-101-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

    Filesize

    256KB

  • memory/1088-103-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

    Filesize

    256KB

  • memory/1088-90-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-107-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-109-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-111-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-113-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-115-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-117-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-119-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-121-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-123-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-92-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-127-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-131-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-129-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-133-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-135-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-137-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-139-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-141-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-145-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-143-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-147-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-149-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-151-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-88-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-86-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-85-0x0000000001FD0000-0x000000000200E000-memory.dmp

    Filesize

    248KB

  • memory/1088-84-0x0000000001FD0000-0x0000000002014000-memory.dmp

    Filesize

    272KB

  • memory/1088-83-0x00000000008E0000-0x0000000000926000-memory.dmp

    Filesize

    280KB