Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
182s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
13/04/2023, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe
Resource
win7-20230220-en
General
-
Target
d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe
-
Size
1.0MB
-
MD5
163deccb385e6c5a45ac1e198504fd20
-
SHA1
59887837031c9867e85aa30f5052e78960453128
-
SHA256
d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e
-
SHA512
49697444b9b09ed0a6320e15afbdece7fc5c0e981faf12b96a71bb39f52df6277ab303f613bbb9dc42a3ddf87e172a301d213d59be84f90175af5db3fd3149d3
-
SSDEEP
24576:5yvM7ofK8Zjxsf+ku5lm8w+cld8d35a4zlXjqv:sioy2Df680kft
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diro
185.161.248.90:4125
-
auth_value
ae95bda0dd2e95169886a3a68138568b
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it689330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it689330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it689330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it689330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it689330.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 4228 ziRe5428.exe 3652 zieQ4733.exe 5012 it689330.exe 2276 jr599744.exe 1800 1.exe 2044 kp447029.exe 628 lr476178.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it689330.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziRe5428.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zieQ4733.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zieQ4733.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziRe5428.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
pid pid_target Process procid_target 2504 628 WerFault.exe 73 3084 628 WerFault.exe 73 3588 628 WerFault.exe 73 3992 628 WerFault.exe 73 3656 628 WerFault.exe 73 4248 628 WerFault.exe 73 1004 628 WerFault.exe 73 4252 628 WerFault.exe 73 2260 628 WerFault.exe 73 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5012 it689330.exe 5012 it689330.exe 1800 1.exe 2044 kp447029.exe 2044 kp447029.exe 1800 1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5012 it689330.exe Token: SeDebugPrivilege 2276 jr599744.exe Token: SeDebugPrivilege 1800 1.exe Token: SeDebugPrivilege 2044 kp447029.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3748 wrote to memory of 4228 3748 d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe 66 PID 3748 wrote to memory of 4228 3748 d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe 66 PID 3748 wrote to memory of 4228 3748 d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe 66 PID 4228 wrote to memory of 3652 4228 ziRe5428.exe 67 PID 4228 wrote to memory of 3652 4228 ziRe5428.exe 67 PID 4228 wrote to memory of 3652 4228 ziRe5428.exe 67 PID 3652 wrote to memory of 5012 3652 zieQ4733.exe 68 PID 3652 wrote to memory of 5012 3652 zieQ4733.exe 68 PID 3652 wrote to memory of 2276 3652 zieQ4733.exe 69 PID 3652 wrote to memory of 2276 3652 zieQ4733.exe 69 PID 3652 wrote to memory of 2276 3652 zieQ4733.exe 69 PID 2276 wrote to memory of 1800 2276 jr599744.exe 70 PID 2276 wrote to memory of 1800 2276 jr599744.exe 70 PID 2276 wrote to memory of 1800 2276 jr599744.exe 70 PID 4228 wrote to memory of 2044 4228 ziRe5428.exe 71 PID 4228 wrote to memory of 2044 4228 ziRe5428.exe 71 PID 4228 wrote to memory of 2044 4228 ziRe5428.exe 71 PID 3748 wrote to memory of 628 3748 d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe 73 PID 3748 wrote to memory of 628 3748 d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe 73 PID 3748 wrote to memory of 628 3748 d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe"C:\Users\Admin\AppData\Local\Temp\d6c68500b47cd7db3b4c164270aef1475fd431a2c915e6792ce712dd43b10f9e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRe5428.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRe5428.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieQ4733.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieQ4733.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it689330.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it689330.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr599744.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr599744.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp447029.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp447029.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr476178.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr476178.exe2⤵
- Executes dropped EXE
PID:628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 6323⤵
- Program crash
PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 7083⤵
- Program crash
PID:3084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 8443⤵
- Program crash
PID:3588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 8563⤵
- Program crash
PID:3992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 8843⤵
- Program crash
PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 9443⤵
- Program crash
PID:4248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 11323⤵
- Program crash
PID:1004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 11883⤵
- Program crash
PID:4252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 12043⤵
- Program crash
PID:2260
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
397KB
MD54d611f4112ed8379871f8bcb211ca4a3
SHA15da68386eaf519b34f8de099d3443379ab027ef7
SHA256a76929112fba2a0c2a7eaf33e6fef368ba8f828ec791192b7a44b13fb86ed80e
SHA5124801282feec1c85982f1eceaba0293f99b64a001b7ff3c7e46e147d10f88ede3dd421c67117ccc19ac2b3e4245009bbecb5de497c5c0cd4c4ae120717ab310a7
-
Filesize
397KB
MD54d611f4112ed8379871f8bcb211ca4a3
SHA15da68386eaf519b34f8de099d3443379ab027ef7
SHA256a76929112fba2a0c2a7eaf33e6fef368ba8f828ec791192b7a44b13fb86ed80e
SHA5124801282feec1c85982f1eceaba0293f99b64a001b7ff3c7e46e147d10f88ede3dd421c67117ccc19ac2b3e4245009bbecb5de497c5c0cd4c4ae120717ab310a7
-
Filesize
723KB
MD5aecf58fec72ce8550efe70b439d840d5
SHA18673856aebcbb42babce14ee2d3e5eb6bbe967a2
SHA2569d61ee78f2393e8d9804b13ef538f095964c684f20c4c059fab758a757286116
SHA512135126648564b9305c823cb3de0942fd9067e119d613668dc088983d02458f93548f51382b4f5da28811a01573d79730bd2a0dd685f8107765ecb598fcd18128
-
Filesize
723KB
MD5aecf58fec72ce8550efe70b439d840d5
SHA18673856aebcbb42babce14ee2d3e5eb6bbe967a2
SHA2569d61ee78f2393e8d9804b13ef538f095964c684f20c4c059fab758a757286116
SHA512135126648564b9305c823cb3de0942fd9067e119d613668dc088983d02458f93548f51382b4f5da28811a01573d79730bd2a0dd685f8107765ecb598fcd18128
-
Filesize
168KB
MD5aa8bb998c46f60bacf91f98f8d4d7b5c
SHA161c7e314d916035128849f85a29b34ac1fb482e0
SHA2567e0252d52b7ff9e4466411941eb98cc220824be0f2eefdfe38e6b494f1176131
SHA5123e1e8400351fbeedbb0f07370260dea23782c24924482d33c54f9db9659c858c2ee89f69b9a8256b091efec0ea33b09e408e0d218769ca3e2cbd013dd935dde7
-
Filesize
168KB
MD5aa8bb998c46f60bacf91f98f8d4d7b5c
SHA161c7e314d916035128849f85a29b34ac1fb482e0
SHA2567e0252d52b7ff9e4466411941eb98cc220824be0f2eefdfe38e6b494f1176131
SHA5123e1e8400351fbeedbb0f07370260dea23782c24924482d33c54f9db9659c858c2ee89f69b9a8256b091efec0ea33b09e408e0d218769ca3e2cbd013dd935dde7
-
Filesize
569KB
MD5fd17c7b078c0596f93998379b5812115
SHA1449d480b1d4de511d49ae2a15556c01bb5067c21
SHA2560b3a5b0e249a9194f99808aed8c16b926ebd1b6bd58be3b238a5d0f984edcc32
SHA512122ce172b91a9e3a226378e0b98971748e9b807f3cb8af1a139c4e0237ec3dd07fb6f3013c53caa177cd706b4d4783183ce15a432a4145747088e91d3e0a5731
-
Filesize
569KB
MD5fd17c7b078c0596f93998379b5812115
SHA1449d480b1d4de511d49ae2a15556c01bb5067c21
SHA2560b3a5b0e249a9194f99808aed8c16b926ebd1b6bd58be3b238a5d0f984edcc32
SHA512122ce172b91a9e3a226378e0b98971748e9b807f3cb8af1a139c4e0237ec3dd07fb6f3013c53caa177cd706b4d4783183ce15a432a4145747088e91d3e0a5731
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
588KB
MD5f3342eac6186ec3db5d5273bd90d6622
SHA14c1e08395e6a5979c33327460598cc833fa20e9c
SHA2562cf0fdf484b4c4542f5fe094a0698eea7b872c784243b5a2117f6bdc4424bc6e
SHA51271bc85fe70e97710426d0a7f7461423f993daddebcf2e5a8fc70e87e15b1e8c58767877c34c84797b91d729c42649182c2e65192db1e58cf6388c9eb890d5579
-
Filesize
588KB
MD5f3342eac6186ec3db5d5273bd90d6622
SHA14c1e08395e6a5979c33327460598cc833fa20e9c
SHA2562cf0fdf484b4c4542f5fe094a0698eea7b872c784243b5a2117f6bdc4424bc6e
SHA51271bc85fe70e97710426d0a7f7461423f993daddebcf2e5a8fc70e87e15b1e8c58767877c34c84797b91d729c42649182c2e65192db1e58cf6388c9eb890d5579
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1