Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21/04/2023, 11:23
General
-
Target
KMSauto-setup.exe
-
Size
3.8MB
-
MD5
c7e2bb8d867d4f4bb484cfe674a16c55
-
SHA1
fdd4fbd30bc2db3faf199799bb732dbf3a137a1a
-
SHA256
727a5380cc5975839d6411d42569d834a337d139fb40f2e94e855835e2b538d6
-
SHA512
c8596183949d7c888724374f48c202b2f96af8a32654234f746124b0a3476682ab109c7bc293a4c5a8b8e0661a56c954ab467c5d86b9b789237f86acadd596d3
-
SSDEEP
98304:CpyfN3PlMJaE15aViYyf6L0c6veW0YDr9C3PVbiUk:SyfQJt15RY66gnZvJUk
Malware Config
Extracted
redline
0215
badinytlesi.xyz:80
yaliesarevi.xyz:80
-
auth_value
c9dd5ca07f69257239203a3c44bb8a57
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KMSauto-setup.exe"C:\Users\Admin\AppData\Local\Temp\KMSauto-setup.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\script.vbs"2⤵
- Blocklisted process makes network request
-
-
C:\Users\Admin\AppData\Roaming\build.exe"C:\Users\Admin\AppData\Roaming\build.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\KMSAuto Net.exe"C:\Users\Admin\AppData\Roaming\KMSAuto Net.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c md "C:\Users\Admin\AppData\Local\MSfree Inc"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c echo test>>"C:\Users\Admin\AppData\Roaming\test.test"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /D /c del /F /Q "test.test"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b4 0x4b81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.6MB
MD593a3a8ce440197d31168fac569082937
SHA1fad3066803a1ba8f9cb8bb7d1969eea0398b5ea0
SHA25622ef521964080e77d7006f9341d720683fa98409361c62a7bc4fe81ec474b1b2
SHA51208efe7e24d8d9e484d39c1381421c3fbbf231e46a5ac33c22bf3735a06c4a3d278a752c25afeb4217cc663a6c6955a55985056a7d5d5142e57c2ac5d99e5d0c8
-
Filesize
8.6MB
MD593a3a8ce440197d31168fac569082937
SHA1fad3066803a1ba8f9cb8bb7d1969eea0398b5ea0
SHA25622ef521964080e77d7006f9341d720683fa98409361c62a7bc4fe81ec474b1b2
SHA51208efe7e24d8d9e484d39c1381421c3fbbf231e46a5ac33c22bf3735a06c4a3d278a752c25afeb4217cc663a6c6955a55985056a7d5d5142e57c2ac5d99e5d0c8
-
Filesize
8.6MB
MD593a3a8ce440197d31168fac569082937
SHA1fad3066803a1ba8f9cb8bb7d1969eea0398b5ea0
SHA25622ef521964080e77d7006f9341d720683fa98409361c62a7bc4fe81ec474b1b2
SHA51208efe7e24d8d9e484d39c1381421c3fbbf231e46a5ac33c22bf3735a06c4a3d278a752c25afeb4217cc663a6c6955a55985056a7d5d5142e57c2ac5d99e5d0c8
-
Filesize
377KB
MD504eef1596eb9769556b5ef8c42ee709a
SHA1db4180e1ff94e544346c758826a214136e92072f
SHA2569732508128b1dfc791d4af808eacbed5dcafaa7ad3f3f8e03cd5fc885285080d
SHA51214b1397c5775e3f65d74570d2ebd51df980f0850a38b385b1a0dd2bea5c420da735c84698ce0fb48e884b505febd9c4f97a49c1525c3413271979876d215a8ac
-
Filesize
377KB
MD504eef1596eb9769556b5ef8c42ee709a
SHA1db4180e1ff94e544346c758826a214136e92072f
SHA2569732508128b1dfc791d4af808eacbed5dcafaa7ad3f3f8e03cd5fc885285080d
SHA51214b1397c5775e3f65d74570d2ebd51df980f0850a38b385b1a0dd2bea5c420da735c84698ce0fb48e884b505febd9c4f97a49c1525c3413271979876d215a8ac
-
Filesize
377KB
MD504eef1596eb9769556b5ef8c42ee709a
SHA1db4180e1ff94e544346c758826a214136e92072f
SHA2569732508128b1dfc791d4af808eacbed5dcafaa7ad3f3f8e03cd5fc885285080d
SHA51214b1397c5775e3f65d74570d2ebd51df980f0850a38b385b1a0dd2bea5c420da735c84698ce0fb48e884b505febd9c4f97a49c1525c3413271979876d215a8ac
-
Filesize
685B
MD50dea7d1c1544d71cc604cd364f5b9e52
SHA1c02058d9241ec21c9dd81f280fa2f988b6762544
SHA256fd3a646f5f862fb4eb34a1a7b4274a8be4a6afd8364e2f24a58c6dbde1e10214
SHA512abaf39f768931dd4c7cb749d6c5a280d443888b445beed4b12aa41bee5259407683e62cfaa7ab8e4d61ff223867356dcfd2de2eeed39a1f1273653b28f912ba1
-
Filesize
6B
MD59f06243abcb89c70e0c331c61d871fa7
SHA1fde773a18bb29f5ed65e6f0a7aa717fd1fa485d4
SHA256837ccb607e312b170fac7383d7ccfd61fa5072793f19a25e75fbacb56539b86b
SHA512b947b99d1baddd347550c9032e9ab60b6be56551cf92c076b38e4e11f436051a4af51c47e54f8641316a720b043641a3b3c1e1b01ba50445ea1ba60bfd1b7a86
-
Filesize
8.6MB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
64KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
228KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB