Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2023, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe
Resource
win10v2004-20230220-en
General
-
Target
d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe
-
Size
867KB
-
MD5
08fb8213523b037d030d043e358603fa
-
SHA1
9188463260116c8d6542c34264d009fffb4939a2
-
SHA256
d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323
-
SHA512
c7da520e4cfed63979ecd52ff7851926847aeb539b2cb1fe10fd467234de2a85bc266fdaa5fdfea19236f603d2c061c9256eccbfec64c32fb3996208933a0321
-
SSDEEP
24576:gyOSBDwYbtFDhw69HgIk9Hn2w2RRnNtgZnQSjhQh:n70YblPHgr9H2ZRRnY2Sj
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection s82510535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" s82510535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" s82510535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" s82510535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" s82510535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" s82510535.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 5 IoCs
pid Process 1808 y91978596.exe 1512 p42816439.exe 1824 1.exe 1408 r99304155.exe 1160 s82510535.exe -
Loads dropped DLL 12 IoCs
pid Process 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 1808 y91978596.exe 1808 y91978596.exe 1808 y91978596.exe 1512 p42816439.exe 1512 p42816439.exe 1824 1.exe 1808 y91978596.exe 1408 r99304155.exe 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 1160 s82510535.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features s82510535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" s82510535.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y91978596.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y91978596.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1824 1.exe 1408 r99304155.exe 1408 r99304155.exe 1824 1.exe 1160 s82510535.exe 1160 s82510535.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1512 p42816439.exe Token: SeDebugPrivilege 1408 r99304155.exe Token: SeDebugPrivilege 1824 1.exe Token: SeDebugPrivilege 1160 s82510535.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1544 wrote to memory of 1808 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 28 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1808 wrote to memory of 1512 1808 y91978596.exe 29 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1512 wrote to memory of 1824 1512 p42816439.exe 30 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1808 wrote to memory of 1408 1808 y91978596.exe 31 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33 PID 1544 wrote to memory of 1160 1544 d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe"C:\Users\Admin\AppData\Local\Temp\d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD54d8cb05a084335e0f50ea9ce96287a36
SHA1b3403c1038ae92f12cb97ba58627bc78c45630e7
SHA256f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63
SHA5123ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99
-
Filesize
395KB
MD54d8cb05a084335e0f50ea9ce96287a36
SHA1b3403c1038ae92f12cb97ba58627bc78c45630e7
SHA256f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63
SHA5123ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99
-
Filesize
395KB
MD54d8cb05a084335e0f50ea9ce96287a36
SHA1b3403c1038ae92f12cb97ba58627bc78c45630e7
SHA256f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63
SHA5123ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99
-
Filesize
577KB
MD56f5292fc176a7f5c40cebfe6988f4523
SHA1294b6e47e6f9ce47093b51d90fdde5b18037155e
SHA2563c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e
SHA512946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5
-
Filesize
577KB
MD56f5292fc176a7f5c40cebfe6988f4523
SHA1294b6e47e6f9ce47093b51d90fdde5b18037155e
SHA2563c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e
SHA512946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5
-
Filesize
575KB
MD52cba3ace2ab6b5c80ac4ffb5570cf548
SHA134e392fdb111e2e5ecc1e5db42b105568c281141
SHA256c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184
SHA512539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8
-
Filesize
575KB
MD52cba3ace2ab6b5c80ac4ffb5570cf548
SHA134e392fdb111e2e5ecc1e5db42b105568c281141
SHA256c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184
SHA512539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8
-
Filesize
575KB
MD52cba3ace2ab6b5c80ac4ffb5570cf548
SHA134e392fdb111e2e5ecc1e5db42b105568c281141
SHA256c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184
SHA512539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8
-
Filesize
172KB
MD585a51ce72ae111efa7768eed479edf90
SHA10a0e03711c9ea219356d4e40e9b21282b97288bd
SHA25614982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5
SHA51224cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7
-
Filesize
172KB
MD585a51ce72ae111efa7768eed479edf90
SHA10a0e03711c9ea219356d4e40e9b21282b97288bd
SHA25614982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5
SHA51224cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
395KB
MD54d8cb05a084335e0f50ea9ce96287a36
SHA1b3403c1038ae92f12cb97ba58627bc78c45630e7
SHA256f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63
SHA5123ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99
-
Filesize
395KB
MD54d8cb05a084335e0f50ea9ce96287a36
SHA1b3403c1038ae92f12cb97ba58627bc78c45630e7
SHA256f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63
SHA5123ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99
-
Filesize
395KB
MD54d8cb05a084335e0f50ea9ce96287a36
SHA1b3403c1038ae92f12cb97ba58627bc78c45630e7
SHA256f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63
SHA5123ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99
-
Filesize
577KB
MD56f5292fc176a7f5c40cebfe6988f4523
SHA1294b6e47e6f9ce47093b51d90fdde5b18037155e
SHA2563c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e
SHA512946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5
-
Filesize
577KB
MD56f5292fc176a7f5c40cebfe6988f4523
SHA1294b6e47e6f9ce47093b51d90fdde5b18037155e
SHA2563c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e
SHA512946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5
-
Filesize
575KB
MD52cba3ace2ab6b5c80ac4ffb5570cf548
SHA134e392fdb111e2e5ecc1e5db42b105568c281141
SHA256c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184
SHA512539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8
-
Filesize
575KB
MD52cba3ace2ab6b5c80ac4ffb5570cf548
SHA134e392fdb111e2e5ecc1e5db42b105568c281141
SHA256c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184
SHA512539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8
-
Filesize
575KB
MD52cba3ace2ab6b5c80ac4ffb5570cf548
SHA134e392fdb111e2e5ecc1e5db42b105568c281141
SHA256c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184
SHA512539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8
-
Filesize
172KB
MD585a51ce72ae111efa7768eed479edf90
SHA10a0e03711c9ea219356d4e40e9b21282b97288bd
SHA25614982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5
SHA51224cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7
-
Filesize
172KB
MD585a51ce72ae111efa7768eed479edf90
SHA10a0e03711c9ea219356d4e40e9b21282b97288bd
SHA25614982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5
SHA51224cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf