Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2023, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe
Resource
win10v2004-20230220-en
General
-
Target
d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe
-
Size
537KB
-
MD5
f323b7fb5cd5b7b98c995b42145bd709
-
SHA1
3d5418e18b4763ec5f5400b364b3e5e7f7ba43da
-
SHA256
d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334
-
SHA512
c70bcdb4698ffd3ff7bb25c481b4dab4cb199b63dc7e403c71b8c424637fc4d777b944ea912077e4cc9d37dc8ac70d62804bfc5a557dee46ea4a817fd013a55c
-
SSDEEP
12288:9d5+vYnP4MFbt9ZJM8HHJE/aey6Pl+sZKXIm:9vPLl68JERySl+3N
Malware Config
Extracted
redline
well
193.233.20.28:4125
-
auth_value
265e7373dd436339d88347c08a10b402
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bus8152.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bus8152.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bus8152.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bus8152.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection bus8152.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bus8152.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation duI09s41.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation metafor.exe -
Executes dropped EXE 7 IoCs
pid Process 4164 film9537.exe 1292 bus8152.exe 3296 con0735.exe 1008 duI09s41.exe 1928 metafor.exe 3560 metafor.exe 4372 metafor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" bus8152.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce film9537.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" film9537.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1356 4276 WerFault.exe 83 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3116 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1292 bus8152.exe 1292 bus8152.exe 3296 con0735.exe 3296 con0735.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1292 bus8152.exe Token: SeDebugPrivilege 3296 con0735.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4276 wrote to memory of 4164 4276 d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe 84 PID 4276 wrote to memory of 4164 4276 d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe 84 PID 4276 wrote to memory of 4164 4276 d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe 84 PID 4164 wrote to memory of 1292 4164 film9537.exe 85 PID 4164 wrote to memory of 1292 4164 film9537.exe 85 PID 4164 wrote to memory of 3296 4164 film9537.exe 89 PID 4164 wrote to memory of 3296 4164 film9537.exe 89 PID 4164 wrote to memory of 3296 4164 film9537.exe 89 PID 4276 wrote to memory of 1008 4276 d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe 90 PID 4276 wrote to memory of 1008 4276 d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe 90 PID 4276 wrote to memory of 1008 4276 d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe 90 PID 1008 wrote to memory of 1928 1008 duI09s41.exe 91 PID 1008 wrote to memory of 1928 1008 duI09s41.exe 91 PID 1008 wrote to memory of 1928 1008 duI09s41.exe 91 PID 1928 wrote to memory of 3116 1928 metafor.exe 94 PID 1928 wrote to memory of 3116 1928 metafor.exe 94 PID 1928 wrote to memory of 3116 1928 metafor.exe 94 PID 1928 wrote to memory of 1480 1928 metafor.exe 96 PID 1928 wrote to memory of 1480 1928 metafor.exe 96 PID 1928 wrote to memory of 1480 1928 metafor.exe 96 PID 1480 wrote to memory of 3344 1480 cmd.exe 99 PID 1480 wrote to memory of 3344 1480 cmd.exe 99 PID 1480 wrote to memory of 3344 1480 cmd.exe 99 PID 1480 wrote to memory of 4292 1480 cmd.exe 100 PID 1480 wrote to memory of 4292 1480 cmd.exe 100 PID 1480 wrote to memory of 4292 1480 cmd.exe 100 PID 1480 wrote to memory of 4640 1480 cmd.exe 101 PID 1480 wrote to memory of 4640 1480 cmd.exe 101 PID 1480 wrote to memory of 4640 1480 cmd.exe 101 PID 1480 wrote to memory of 432 1480 cmd.exe 102 PID 1480 wrote to memory of 432 1480 cmd.exe 102 PID 1480 wrote to memory of 432 1480 cmd.exe 102 PID 1480 wrote to memory of 2548 1480 cmd.exe 103 PID 1480 wrote to memory of 2548 1480 cmd.exe 103 PID 1480 wrote to memory of 2548 1480 cmd.exe 103 PID 1480 wrote to memory of 4552 1480 cmd.exe 104 PID 1480 wrote to memory of 4552 1480 cmd.exe 104 PID 1480 wrote to memory of 4552 1480 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe"C:\Users\Admin\AppData\Local\Temp\d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F4⤵
- Creates scheduled task(s)
PID:3116
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3344
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:N"5⤵PID:4292
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:R" /E5⤵PID:4640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:432
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:N"5⤵PID:2548
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:R" /E5⤵PID:4552
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 5322⤵
- Program crash
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4276 -ip 42761⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:3560
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:4372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
192KB
MD5fa4870d435e242159168b9a9b26715de
SHA12284166d902bde49c43ed6056434fd663b1c7aad
SHA2566fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42
SHA512f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8
-
Filesize
192KB
MD5fa4870d435e242159168b9a9b26715de
SHA12284166d902bde49c43ed6056434fd663b1c7aad
SHA2566fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42
SHA512f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD5b3cbfcd14491f891be0baef768f2a4da
SHA147be5bb6f31976fad7f904f52a19a177f84e04de
SHA2560c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f
SHA512330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf
-
Filesize
175KB
MD5b3cbfcd14491f891be0baef768f2a4da
SHA147be5bb6f31976fad7f904f52a19a177f84e04de
SHA2560c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f
SHA512330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf