Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2023, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe
Resource
win10v2004-20230220-en
General
-
Target
ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe
-
Size
864KB
-
MD5
5e65c7e1507aa3913b25c28ecaeda200
-
SHA1
1e23dd144ca411681049f5af45009ed7188e299d
-
SHA256
ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736
-
SHA512
cfab0605606d3c47b2815f149e237fbd7e918753ce3668e6ac312389d2325ca29e20b0694a80440cf6cb9dd48ff79a5473a62f7fab61f8b82a9cc9027195405c
-
SSDEEP
24576:myekVHws4Kma2UNXJ3E0mEbEqm+N2DV7:1ekVQslxzXmpciV
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" s37826935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" s37826935.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection s37826935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" s37826935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" s37826935.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" s37826935.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 5 IoCs
pid Process 860 y78028717.exe 524 p73435598.exe 1564 1.exe 1512 r01652227.exe 1572 s37826935.exe -
Loads dropped DLL 12 IoCs
pid Process 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 860 y78028717.exe 860 y78028717.exe 860 y78028717.exe 524 p73435598.exe 524 p73435598.exe 1564 1.exe 860 y78028717.exe 1512 r01652227.exe 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 1572 s37826935.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" s37826935.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features s37826935.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y78028717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y78028717.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1512 r01652227.exe 1564 1.exe 1512 r01652227.exe 1564 1.exe 1572 s37826935.exe 1572 s37826935.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 524 p73435598.exe Token: SeDebugPrivilege 1564 1.exe Token: SeDebugPrivilege 1512 r01652227.exe Token: SeDebugPrivilege 1572 s37826935.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 1040 wrote to memory of 860 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 27 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 860 wrote to memory of 524 860 y78028717.exe 28 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 524 wrote to memory of 1564 524 p73435598.exe 29 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 860 wrote to memory of 1512 860 y78028717.exe 30 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32 PID 1040 wrote to memory of 1572 1040 ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe"C:\Users\Admin\AppData\Local\Temp\ec87c7283fbb91fe817d744ec9259b5c00c1f33f57956e90e772de307adc1736.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y78028717.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y78028717.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p73435598.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p73435598.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r01652227.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r01652227.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s37826935.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s37826935.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD56041b04497b23c3ca6afb3e5cf2f9c45
SHA1a51726ca09b615227053ca0bed191686080f329f
SHA25602993be6d7fbcd02f1b1b864002872620373c62258c334dece037f9d7273350a
SHA5120061f8d462d09360b8ba1ce9971f600a0830637d5f5d4fdb49661318411d904ecf09848c1a4235987ebfe55326d721315b3a472f1eb385746352d3e2d40cf47d
-
Filesize
395KB
MD56041b04497b23c3ca6afb3e5cf2f9c45
SHA1a51726ca09b615227053ca0bed191686080f329f
SHA25602993be6d7fbcd02f1b1b864002872620373c62258c334dece037f9d7273350a
SHA5120061f8d462d09360b8ba1ce9971f600a0830637d5f5d4fdb49661318411d904ecf09848c1a4235987ebfe55326d721315b3a472f1eb385746352d3e2d40cf47d
-
Filesize
395KB
MD56041b04497b23c3ca6afb3e5cf2f9c45
SHA1a51726ca09b615227053ca0bed191686080f329f
SHA25602993be6d7fbcd02f1b1b864002872620373c62258c334dece037f9d7273350a
SHA5120061f8d462d09360b8ba1ce9971f600a0830637d5f5d4fdb49661318411d904ecf09848c1a4235987ebfe55326d721315b3a472f1eb385746352d3e2d40cf47d
-
Filesize
577KB
MD5fe229b6e9bf234d7e9f34572de52bd10
SHA12e3cbfa18de488d18d4e49011e7c67198faf41d6
SHA256d3e4a370b68cd42d9fba30ff11ec75c6a00e77ec812c433459f34eaa839e10cf
SHA51210562f94773b520f5a1687728bd142e389b004646606daa8d84796bb9b916773704b60904488089fa3604ce845245d0ac7512f951eaffb6d29527657cb5bf847
-
Filesize
577KB
MD5fe229b6e9bf234d7e9f34572de52bd10
SHA12e3cbfa18de488d18d4e49011e7c67198faf41d6
SHA256d3e4a370b68cd42d9fba30ff11ec75c6a00e77ec812c433459f34eaa839e10cf
SHA51210562f94773b520f5a1687728bd142e389b004646606daa8d84796bb9b916773704b60904488089fa3604ce845245d0ac7512f951eaffb6d29527657cb5bf847
-
Filesize
574KB
MD5affa711a29008c734f21044d240baf6f
SHA12eb3b3dd0a228d71a2a94cc94929e661e9879c6b
SHA256ecaf0797d2a0d210a2199ff705a77a4392fe1041a84817229f04ad49ceee973d
SHA51270ae4246b2f6b3d875a6ffb4f45a038fc63e21311813bc62006dcccaf822c2eb06c6f2cfbd8a7265b7b6deec86f2a96ef8edccd2dc2238f459a987fb43f967b2
-
Filesize
574KB
MD5affa711a29008c734f21044d240baf6f
SHA12eb3b3dd0a228d71a2a94cc94929e661e9879c6b
SHA256ecaf0797d2a0d210a2199ff705a77a4392fe1041a84817229f04ad49ceee973d
SHA51270ae4246b2f6b3d875a6ffb4f45a038fc63e21311813bc62006dcccaf822c2eb06c6f2cfbd8a7265b7b6deec86f2a96ef8edccd2dc2238f459a987fb43f967b2
-
Filesize
574KB
MD5affa711a29008c734f21044d240baf6f
SHA12eb3b3dd0a228d71a2a94cc94929e661e9879c6b
SHA256ecaf0797d2a0d210a2199ff705a77a4392fe1041a84817229f04ad49ceee973d
SHA51270ae4246b2f6b3d875a6ffb4f45a038fc63e21311813bc62006dcccaf822c2eb06c6f2cfbd8a7265b7b6deec86f2a96ef8edccd2dc2238f459a987fb43f967b2
-
Filesize
171KB
MD5db90f2673efc20210a5a22dbc8089103
SHA1af888d87596c52df672a66904972407403b20eb3
SHA256a1933638f69fcf3154a596ab61c6b6a418bd82759e20996b01bc89671de2fec5
SHA512898c068fe9ba9c348e23e792335ec3e81845c0048b89e9a8b95b31c75799224887259097f37586c6cf78605c158497830c81e67235e6285a6d0b06136ef42ef9
-
Filesize
171KB
MD5db90f2673efc20210a5a22dbc8089103
SHA1af888d87596c52df672a66904972407403b20eb3
SHA256a1933638f69fcf3154a596ab61c6b6a418bd82759e20996b01bc89671de2fec5
SHA512898c068fe9ba9c348e23e792335ec3e81845c0048b89e9a8b95b31c75799224887259097f37586c6cf78605c158497830c81e67235e6285a6d0b06136ef42ef9
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
395KB
MD56041b04497b23c3ca6afb3e5cf2f9c45
SHA1a51726ca09b615227053ca0bed191686080f329f
SHA25602993be6d7fbcd02f1b1b864002872620373c62258c334dece037f9d7273350a
SHA5120061f8d462d09360b8ba1ce9971f600a0830637d5f5d4fdb49661318411d904ecf09848c1a4235987ebfe55326d721315b3a472f1eb385746352d3e2d40cf47d
-
Filesize
395KB
MD56041b04497b23c3ca6afb3e5cf2f9c45
SHA1a51726ca09b615227053ca0bed191686080f329f
SHA25602993be6d7fbcd02f1b1b864002872620373c62258c334dece037f9d7273350a
SHA5120061f8d462d09360b8ba1ce9971f600a0830637d5f5d4fdb49661318411d904ecf09848c1a4235987ebfe55326d721315b3a472f1eb385746352d3e2d40cf47d
-
Filesize
395KB
MD56041b04497b23c3ca6afb3e5cf2f9c45
SHA1a51726ca09b615227053ca0bed191686080f329f
SHA25602993be6d7fbcd02f1b1b864002872620373c62258c334dece037f9d7273350a
SHA5120061f8d462d09360b8ba1ce9971f600a0830637d5f5d4fdb49661318411d904ecf09848c1a4235987ebfe55326d721315b3a472f1eb385746352d3e2d40cf47d
-
Filesize
577KB
MD5fe229b6e9bf234d7e9f34572de52bd10
SHA12e3cbfa18de488d18d4e49011e7c67198faf41d6
SHA256d3e4a370b68cd42d9fba30ff11ec75c6a00e77ec812c433459f34eaa839e10cf
SHA51210562f94773b520f5a1687728bd142e389b004646606daa8d84796bb9b916773704b60904488089fa3604ce845245d0ac7512f951eaffb6d29527657cb5bf847
-
Filesize
577KB
MD5fe229b6e9bf234d7e9f34572de52bd10
SHA12e3cbfa18de488d18d4e49011e7c67198faf41d6
SHA256d3e4a370b68cd42d9fba30ff11ec75c6a00e77ec812c433459f34eaa839e10cf
SHA51210562f94773b520f5a1687728bd142e389b004646606daa8d84796bb9b916773704b60904488089fa3604ce845245d0ac7512f951eaffb6d29527657cb5bf847
-
Filesize
574KB
MD5affa711a29008c734f21044d240baf6f
SHA12eb3b3dd0a228d71a2a94cc94929e661e9879c6b
SHA256ecaf0797d2a0d210a2199ff705a77a4392fe1041a84817229f04ad49ceee973d
SHA51270ae4246b2f6b3d875a6ffb4f45a038fc63e21311813bc62006dcccaf822c2eb06c6f2cfbd8a7265b7b6deec86f2a96ef8edccd2dc2238f459a987fb43f967b2
-
Filesize
574KB
MD5affa711a29008c734f21044d240baf6f
SHA12eb3b3dd0a228d71a2a94cc94929e661e9879c6b
SHA256ecaf0797d2a0d210a2199ff705a77a4392fe1041a84817229f04ad49ceee973d
SHA51270ae4246b2f6b3d875a6ffb4f45a038fc63e21311813bc62006dcccaf822c2eb06c6f2cfbd8a7265b7b6deec86f2a96ef8edccd2dc2238f459a987fb43f967b2
-
Filesize
574KB
MD5affa711a29008c734f21044d240baf6f
SHA12eb3b3dd0a228d71a2a94cc94929e661e9879c6b
SHA256ecaf0797d2a0d210a2199ff705a77a4392fe1041a84817229f04ad49ceee973d
SHA51270ae4246b2f6b3d875a6ffb4f45a038fc63e21311813bc62006dcccaf822c2eb06c6f2cfbd8a7265b7b6deec86f2a96ef8edccd2dc2238f459a987fb43f967b2
-
Filesize
171KB
MD5db90f2673efc20210a5a22dbc8089103
SHA1af888d87596c52df672a66904972407403b20eb3
SHA256a1933638f69fcf3154a596ab61c6b6a418bd82759e20996b01bc89671de2fec5
SHA512898c068fe9ba9c348e23e792335ec3e81845c0048b89e9a8b95b31c75799224887259097f37586c6cf78605c158497830c81e67235e6285a6d0b06136ef42ef9
-
Filesize
171KB
MD5db90f2673efc20210a5a22dbc8089103
SHA1af888d87596c52df672a66904972407403b20eb3
SHA256a1933638f69fcf3154a596ab61c6b6a418bd82759e20996b01bc89671de2fec5
SHA512898c068fe9ba9c348e23e792335ec3e81845c0048b89e9a8b95b31c75799224887259097f37586c6cf78605c158497830c81e67235e6285a6d0b06136ef42ef9
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf