Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe
Resource
win10v2004-20230220-en
General
-
Target
8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe
-
Size
480KB
-
MD5
573ac023cd3132b29234b30d58c9e19b
-
SHA1
033af447fe524326576bb119574636d1538f8835
-
SHA256
8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598
-
SHA512
ba548ae79d6438be3e78efb4cf15610a1828f03499daed061e1d767a32fa66bb92f2f0e14e6d2c75fd73a4714c798fa208f120887dab17c842b9d2dd1e8f8ecc
-
SSDEEP
12288:eMray90wV3xe5eauoFSHxiJZBt4WgwgFJkN:AyjpxQ4vxqBIwg/q
Malware Config
Extracted
redline
daris
217.196.96.56:4138
-
auth_value
3491f24ae0250969cd45ce4b3fe77549
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection l4859005.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l4859005.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l4859005.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l4859005.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l4859005.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l4859005.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation m7902809.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 1764 y3106755.exe 3912 k8620001.exe 4036 l4859005.exe 4780 m7902809.exe 3988 oneetx.exe 1976 oneetx.exe 2508 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1284 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features l4859005.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" l4859005.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y3106755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3106755.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3912 k8620001.exe 3912 k8620001.exe 4036 l4859005.exe 4036 l4859005.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3912 k8620001.exe Token: SeDebugPrivilege 4036 l4859005.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4780 m7902809.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4648 wrote to memory of 1764 4648 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe 85 PID 4648 wrote to memory of 1764 4648 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe 85 PID 4648 wrote to memory of 1764 4648 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe 85 PID 1764 wrote to memory of 3912 1764 y3106755.exe 86 PID 1764 wrote to memory of 3912 1764 y3106755.exe 86 PID 1764 wrote to memory of 3912 1764 y3106755.exe 86 PID 1764 wrote to memory of 4036 1764 y3106755.exe 93 PID 1764 wrote to memory of 4036 1764 y3106755.exe 93 PID 1764 wrote to memory of 4036 1764 y3106755.exe 93 PID 4648 wrote to memory of 4780 4648 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe 94 PID 4648 wrote to memory of 4780 4648 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe 94 PID 4648 wrote to memory of 4780 4648 8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe 94 PID 4780 wrote to memory of 3988 4780 m7902809.exe 95 PID 4780 wrote to memory of 3988 4780 m7902809.exe 95 PID 4780 wrote to memory of 3988 4780 m7902809.exe 95 PID 3988 wrote to memory of 4448 3988 oneetx.exe 96 PID 3988 wrote to memory of 4448 3988 oneetx.exe 96 PID 3988 wrote to memory of 4448 3988 oneetx.exe 96 PID 3988 wrote to memory of 4368 3988 oneetx.exe 98 PID 3988 wrote to memory of 4368 3988 oneetx.exe 98 PID 3988 wrote to memory of 4368 3988 oneetx.exe 98 PID 4368 wrote to memory of 3872 4368 cmd.exe 100 PID 4368 wrote to memory of 3872 4368 cmd.exe 100 PID 4368 wrote to memory of 3872 4368 cmd.exe 100 PID 4368 wrote to memory of 4604 4368 cmd.exe 101 PID 4368 wrote to memory of 4604 4368 cmd.exe 101 PID 4368 wrote to memory of 4604 4368 cmd.exe 101 PID 4368 wrote to memory of 2520 4368 cmd.exe 102 PID 4368 wrote to memory of 2520 4368 cmd.exe 102 PID 4368 wrote to memory of 2520 4368 cmd.exe 102 PID 4368 wrote to memory of 2820 4368 cmd.exe 103 PID 4368 wrote to memory of 2820 4368 cmd.exe 103 PID 4368 wrote to memory of 2820 4368 cmd.exe 103 PID 4368 wrote to memory of 1456 4368 cmd.exe 104 PID 4368 wrote to memory of 1456 4368 cmd.exe 104 PID 4368 wrote to memory of 1456 4368 cmd.exe 104 PID 4368 wrote to memory of 1908 4368 cmd.exe 105 PID 4368 wrote to memory of 1908 4368 cmd.exe 105 PID 4368 wrote to memory of 1908 4368 cmd.exe 105 PID 3988 wrote to memory of 1284 3988 oneetx.exe 108 PID 3988 wrote to memory of 1284 3988 oneetx.exe 108 PID 3988 wrote to memory of 1284 3988 oneetx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe"C:\Users\Admin\AppData\Local\Temp\8332afd2b2ceabb42843e429cff83e0ed7f2a693d6c62b9a3d5b845966745598.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3106755.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3106755.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8620001.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8620001.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4859005.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4859005.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m7902809.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m7902809.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4448
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3872
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4604
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2820
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:1456
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:1908
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1284
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:1976
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
308KB
MD555fe8f2009ce80c57678444bc972393c
SHA11e3af70a1da1d80a348f22835d27394abb85f4b4
SHA2560788e14ef1b62bc1ac0239e35ed4078727caa5e9c4532eee7d0c0ba47b372dda
SHA512624c3478b856175a901b6bce7ca8c5ecf0b478299225ec4d47f8f65575b3b95fb0d737eadb4402e15c6b2e83d236a93c72961d9f280553b64a193f53bd4212e5
-
Filesize
308KB
MD555fe8f2009ce80c57678444bc972393c
SHA11e3af70a1da1d80a348f22835d27394abb85f4b4
SHA2560788e14ef1b62bc1ac0239e35ed4078727caa5e9c4532eee7d0c0ba47b372dda
SHA512624c3478b856175a901b6bce7ca8c5ecf0b478299225ec4d47f8f65575b3b95fb0d737eadb4402e15c6b2e83d236a93c72961d9f280553b64a193f53bd4212e5
-
Filesize
168KB
MD5557e53a82b44653f103c2005a5d1085c
SHA19c2dbebacc8026d96dadc38e02571cdb4384fb25
SHA256b2a1f68f722c881c60f5d56f72e16d2ec3246de3793787e73ed7f233be9fdc44
SHA51230f5154b0be3cd7ff056709cdb67ad31aa081e813e5caa6558dc9575d3f74be662dc786de4bf41abd4200596d16c3cd634ee1d3e42261e7303b8b7805a5f9418
-
Filesize
168KB
MD5557e53a82b44653f103c2005a5d1085c
SHA19c2dbebacc8026d96dadc38e02571cdb4384fb25
SHA256b2a1f68f722c881c60f5d56f72e16d2ec3246de3793787e73ed7f233be9fdc44
SHA51230f5154b0be3cd7ff056709cdb67ad31aa081e813e5caa6558dc9575d3f74be662dc786de4bf41abd4200596d16c3cd634ee1d3e42261e7303b8b7805a5f9418
-
Filesize
178KB
MD5e0eec7d3dca3339bd4e95142fcd27516
SHA18ae7aa163ec10dc42b7441f781426477e09728a0
SHA2567d810523102531d54c61a8a8e1268cdbe9d02aaa94c324f4e15154b12319bf70
SHA5127c1c3739fc6257b70057e36aa805fcd7dbf69e9c0563396e4724b157e68d4639d58f63fb04b8fda8febd5431921f4e304af8725a2e5eb0a8e88af9d72e554dac
-
Filesize
178KB
MD5e0eec7d3dca3339bd4e95142fcd27516
SHA18ae7aa163ec10dc42b7441f781426477e09728a0
SHA2567d810523102531d54c61a8a8e1268cdbe9d02aaa94c324f4e15154b12319bf70
SHA5127c1c3739fc6257b70057e36aa805fcd7dbf69e9c0563396e4724b157e68d4639d58f63fb04b8fda8febd5431921f4e304af8725a2e5eb0a8e88af9d72e554dac
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
206KB
MD59cfedc925d2e61f23ddb12da185d2f33
SHA16ae2d6072d07360ad81c76ecdfe522114bbb3c1b
SHA25650f13483029ad0232e4addfec7b15e82f1ab060fe7be4cc1aabd4a207dfb898b
SHA512fac3f10eb8388a8e0fb8ab962bc0a88aec8fef9dc210515b72074f45b04c31b370ab2e627250d03e3627019d396a449d677fad33f4477aa7542d0e8fe40e0c7a
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5