Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    12/04/2023, 00:54

General

  • Target

    setup.exe

  • Size

    670KB

  • MD5

    3357c8c078642c1601da89732840fd81

  • SHA1

    13328174d26e7a654958175a8deb626a338e88bf

  • SHA256

    ee2ba65fdf882ddf5926278f741239be3ed823403ef52a69f12cfbe8a162cb21

  • SHA512

    65bc43282c3be02bb7724ae54e5c266142bb12bdfd1a83f2f4a1bea0c8270f0a11c05ee08597b0761926f7479fb43d0179c3ed1c695be29f3537fbb3079e6d82

  • SSDEEP

    12288:IMrdy901l4F564PFCuV4Fx3RF1rvRLe5vRT867CsVwXRn1Y:1yub4P8CUdLe5vRT8Z6wXY

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

C2

185.161.248.90:4125

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqZ8167.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqZ8167.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it238600.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it238600.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr660231.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr660231.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr660231.exe

    Filesize

    168KB

    MD5

    c52ebada00a59ec1f651a0e9fbcef2eb

    SHA1

    e1941278df76616f1ca3202ef2a9f99d2592d52f

    SHA256

    35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

    SHA512

    6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr660231.exe

    Filesize

    168KB

    MD5

    c52ebada00a59ec1f651a0e9fbcef2eb

    SHA1

    e1941278df76616f1ca3202ef2a9f99d2592d52f

    SHA256

    35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

    SHA512

    6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqZ8167.exe

    Filesize

    516KB

    MD5

    9458d6a579757b808a0572f29fd2adf6

    SHA1

    a96efebdb9373b61f6c58df59a2954ec03c81c73

    SHA256

    a390c6e3fb0856b69c4a2afcdda762afca28d91a13b0f612ae2ca725354989f8

    SHA512

    73dec352ab95a40d9345ee10595fe5280bb2ad65d8a73e70f6f82c45afd4e8110772c8c0593a5aed6b640ab0a96760a7ccadb19b7a4d72c398921dc4973b5b67

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqZ8167.exe

    Filesize

    516KB

    MD5

    9458d6a579757b808a0572f29fd2adf6

    SHA1

    a96efebdb9373b61f6c58df59a2954ec03c81c73

    SHA256

    a390c6e3fb0856b69c4a2afcdda762afca28d91a13b0f612ae2ca725354989f8

    SHA512

    73dec352ab95a40d9345ee10595fe5280bb2ad65d8a73e70f6f82c45afd4e8110772c8c0593a5aed6b640ab0a96760a7ccadb19b7a4d72c398921dc4973b5b67

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it238600.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it238600.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe

    Filesize

    438KB

    MD5

    e8f22bcf83c8d9e0b7e3faadb390154d

    SHA1

    4f14badcaf666131385442f3d1301ac1fe6eaa68

    SHA256

    f37003c9225c8e0f8ccc9823ee817836f8464e03771d1a2652206cc99038f9b8

    SHA512

    b97400fb202a9fe767699bca9fa7fe306aa2d9ff6ac14de1ad66a15a8d68caa511b8979981458d50d1341ab0e13aa002ee950550a60f361749af349f0603e31a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe

    Filesize

    438KB

    MD5

    e8f22bcf83c8d9e0b7e3faadb390154d

    SHA1

    4f14badcaf666131385442f3d1301ac1fe6eaa68

    SHA256

    f37003c9225c8e0f8ccc9823ee817836f8464e03771d1a2652206cc99038f9b8

    SHA512

    b97400fb202a9fe767699bca9fa7fe306aa2d9ff6ac14de1ad66a15a8d68caa511b8979981458d50d1341ab0e13aa002ee950550a60f361749af349f0603e31a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe

    Filesize

    438KB

    MD5

    e8f22bcf83c8d9e0b7e3faadb390154d

    SHA1

    4f14badcaf666131385442f3d1301ac1fe6eaa68

    SHA256

    f37003c9225c8e0f8ccc9823ee817836f8464e03771d1a2652206cc99038f9b8

    SHA512

    b97400fb202a9fe767699bca9fa7fe306aa2d9ff6ac14de1ad66a15a8d68caa511b8979981458d50d1341ab0e13aa002ee950550a60f361749af349f0603e31a

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr660231.exe

    Filesize

    168KB

    MD5

    c52ebada00a59ec1f651a0e9fbcef2eb

    SHA1

    e1941278df76616f1ca3202ef2a9f99d2592d52f

    SHA256

    35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

    SHA512

    6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr660231.exe

    Filesize

    168KB

    MD5

    c52ebada00a59ec1f651a0e9fbcef2eb

    SHA1

    e1941278df76616f1ca3202ef2a9f99d2592d52f

    SHA256

    35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

    SHA512

    6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqZ8167.exe

    Filesize

    516KB

    MD5

    9458d6a579757b808a0572f29fd2adf6

    SHA1

    a96efebdb9373b61f6c58df59a2954ec03c81c73

    SHA256

    a390c6e3fb0856b69c4a2afcdda762afca28d91a13b0f612ae2ca725354989f8

    SHA512

    73dec352ab95a40d9345ee10595fe5280bb2ad65d8a73e70f6f82c45afd4e8110772c8c0593a5aed6b640ab0a96760a7ccadb19b7a4d72c398921dc4973b5b67

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqZ8167.exe

    Filesize

    516KB

    MD5

    9458d6a579757b808a0572f29fd2adf6

    SHA1

    a96efebdb9373b61f6c58df59a2954ec03c81c73

    SHA256

    a390c6e3fb0856b69c4a2afcdda762afca28d91a13b0f612ae2ca725354989f8

    SHA512

    73dec352ab95a40d9345ee10595fe5280bb2ad65d8a73e70f6f82c45afd4e8110772c8c0593a5aed6b640ab0a96760a7ccadb19b7a4d72c398921dc4973b5b67

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\it238600.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe

    Filesize

    438KB

    MD5

    e8f22bcf83c8d9e0b7e3faadb390154d

    SHA1

    4f14badcaf666131385442f3d1301ac1fe6eaa68

    SHA256

    f37003c9225c8e0f8ccc9823ee817836f8464e03771d1a2652206cc99038f9b8

    SHA512

    b97400fb202a9fe767699bca9fa7fe306aa2d9ff6ac14de1ad66a15a8d68caa511b8979981458d50d1341ab0e13aa002ee950550a60f361749af349f0603e31a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe

    Filesize

    438KB

    MD5

    e8f22bcf83c8d9e0b7e3faadb390154d

    SHA1

    4f14badcaf666131385442f3d1301ac1fe6eaa68

    SHA256

    f37003c9225c8e0f8ccc9823ee817836f8464e03771d1a2652206cc99038f9b8

    SHA512

    b97400fb202a9fe767699bca9fa7fe306aa2d9ff6ac14de1ad66a15a8d68caa511b8979981458d50d1341ab0e13aa002ee950550a60f361749af349f0603e31a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jr776750.exe

    Filesize

    438KB

    MD5

    e8f22bcf83c8d9e0b7e3faadb390154d

    SHA1

    4f14badcaf666131385442f3d1301ac1fe6eaa68

    SHA256

    f37003c9225c8e0f8ccc9823ee817836f8464e03771d1a2652206cc99038f9b8

    SHA512

    b97400fb202a9fe767699bca9fa7fe306aa2d9ff6ac14de1ad66a15a8d68caa511b8979981458d50d1341ab0e13aa002ee950550a60f361749af349f0603e31a

  • \Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • \Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/1012-2245-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/1012-2250-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

    Filesize

    256KB

  • memory/1012-2239-0x0000000000EF0000-0x0000000000F1E000-memory.dmp

    Filesize

    184KB

  • memory/1472-115-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-141-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-103-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-105-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-107-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-109-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-111-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-113-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-99-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-117-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-121-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-119-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-123-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-125-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-127-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-129-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-131-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-133-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-135-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-137-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-139-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-101-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-147-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-145-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-143-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-151-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-149-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-2230-0x0000000002250000-0x0000000002282000-memory.dmp

    Filesize

    200KB

  • memory/1472-97-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-95-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-93-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-91-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-89-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-88-0x0000000004990000-0x00000000049F0000-memory.dmp

    Filesize

    384KB

  • memory/1472-83-0x0000000004920000-0x0000000004988000-memory.dmp

    Filesize

    416KB

  • memory/1472-84-0x0000000000250000-0x00000000002AB000-memory.dmp

    Filesize

    364KB

  • memory/1472-87-0x0000000004990000-0x00000000049F6000-memory.dmp

    Filesize

    408KB

  • memory/1472-86-0x00000000049F0000-0x0000000004A30000-memory.dmp

    Filesize

    256KB

  • memory/1472-85-0x00000000049F0000-0x0000000004A30000-memory.dmp

    Filesize

    256KB

  • memory/1480-72-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

    Filesize

    40KB

  • memory/2024-2248-0x0000000001100000-0x0000000001130000-memory.dmp

    Filesize

    192KB

  • memory/2024-2249-0x00000000007C0000-0x00000000007C6000-memory.dmp

    Filesize

    24KB

  • memory/2024-2251-0x0000000004BF0000-0x0000000004C30000-memory.dmp

    Filesize

    256KB