Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 06:41

General

  • Target

    c7f3d7e1bcca5a6925b1b0762f871e99.exe

  • Size

    567KB

  • MD5

    c7f3d7e1bcca5a6925b1b0762f871e99

  • SHA1

    a157a60fc48887a08bed0ff175cae033508e812e

  • SHA256

    8dad64d50dae279010dd6d487290efd3049f5f5f3d268ba94f80311ec943e50b

  • SHA512

    cdcfd5b56b46b42aee0df2ec89fb303110cd38d7c04a50ade303acda1bd769c7f52b63f7c50c30c35f05f50b296db02daaf5b1c768358b0a29de493be548a91a

  • SSDEEP

    12288:CMrNy90AcvKfwk8jtoYtGYZx3adYQVHxC7zB:vyicngZYYZx1Ft

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7f3d7e1bcca5a6925b1b0762f871e99.exe
    "C:\Users\Admin\AppData\Local\Temp\c7f3d7e1bcca5a6925b1b0762f871e99.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3043368.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3043368.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0994562.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0994562.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1340
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1721562.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1721562.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 976
          4⤵
          • Program crash
          PID:2572
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0093985.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0093985.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3832
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3116
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3492
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:1640
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:3476
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:788
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1464
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:3300
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:2228
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:3956
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4780 -ip 4780
                1⤵
                  PID:436
                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3748
                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:388

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0093985.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0093985.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3043368.exe

                  Filesize

                  395KB

                  MD5

                  d1e622994082ff760ca8a7abef8c8406

                  SHA1

                  4d80361ca94373836d6a8f352d75496a8e58c5e8

                  SHA256

                  380a483a7e595c8005bf91b5c273eec8647c4382fd90b8a76039b81725c2391b

                  SHA512

                  2c973645c04b1942c78b7252f96c5922472aa80a1c821f8ed67f1039c24162d0c65f88d8ddf4035925c7ed0148c397b4e3f71f890435ee0dde0b66f0a4467229

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3043368.exe

                  Filesize

                  395KB

                  MD5

                  d1e622994082ff760ca8a7abef8c8406

                  SHA1

                  4d80361ca94373836d6a8f352d75496a8e58c5e8

                  SHA256

                  380a483a7e595c8005bf91b5c273eec8647c4382fd90b8a76039b81725c2391b

                  SHA512

                  2c973645c04b1942c78b7252f96c5922472aa80a1c821f8ed67f1039c24162d0c65f88d8ddf4035925c7ed0148c397b4e3f71f890435ee0dde0b66f0a4467229

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0994562.exe

                  Filesize

                  168KB

                  MD5

                  6ead7d5aa9a0ddfa6b6e932244ac77b7

                  SHA1

                  8ca7ae09fc71ea0a70fcfcb9ae3fa30729f51eab

                  SHA256

                  58ea2be9820824e13dd7d27bced255cf866f50a233994862319ff5cc3a4c8306

                  SHA512

                  748c42016d38a4f2acdb83250a8cfbaf5258c35b3366631243a79a0f4fb99db3c1a506626d4e18cc9ad08b4aecbbb1b75b52d0a3120214d89512e1ef7186e1eb

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0994562.exe

                  Filesize

                  168KB

                  MD5

                  6ead7d5aa9a0ddfa6b6e932244ac77b7

                  SHA1

                  8ca7ae09fc71ea0a70fcfcb9ae3fa30729f51eab

                  SHA256

                  58ea2be9820824e13dd7d27bced255cf866f50a233994862319ff5cc3a4c8306

                  SHA512

                  748c42016d38a4f2acdb83250a8cfbaf5258c35b3366631243a79a0f4fb99db3c1a506626d4e18cc9ad08b4aecbbb1b75b52d0a3120214d89512e1ef7186e1eb

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1721562.exe

                  Filesize

                  315KB

                  MD5

                  f36e9959592c09bfd0510eac073293cb

                  SHA1

                  269efccb06b966929275462ee6694e79a3ee37c0

                  SHA256

                  fc20416a58f791102ee8d76a3747510024943d0f8e000c913eaaed09b7aa690a

                  SHA512

                  6411d5f89db22e80441b74c618bef6e7b876ab7a7b86150f57ed5d5c84d37858332d59d9c3df95df667f8025ac7d745acbe6fb0f606259f51c70643412eb5831

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1721562.exe

                  Filesize

                  315KB

                  MD5

                  f36e9959592c09bfd0510eac073293cb

                  SHA1

                  269efccb06b966929275462ee6694e79a3ee37c0

                  SHA256

                  fc20416a58f791102ee8d76a3747510024943d0f8e000c913eaaed09b7aa690a

                  SHA512

                  6411d5f89db22e80441b74c618bef6e7b876ab7a7b86150f57ed5d5c84d37858332d59d9c3df95df667f8025ac7d745acbe6fb0f606259f51c70643412eb5831

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  5e75428dbdfa0913579c2a837c5ae46e

                  SHA1

                  e01762b53560e35a54e6ef477a90bf9acb9e01b6

                  SHA256

                  337588775e398fda00a498ce37f9e04154bf97e0ef2688b7ee840773b3c571e8

                  SHA512

                  9343b4804f117a723d7406fbb09efc4b5995d83e14421b826c421ec87bfe7f9683a9a356de99e70c3be20bdba4c84c4fa42acd476598e5d1a075622f99c9e63b

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8451a2c5daa42b25333b1b2089c5ea39

                  SHA1

                  700cc99ec8d3113435e657070d2d6bde0a833adc

                  SHA256

                  b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                  SHA512

                  6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8451a2c5daa42b25333b1b2089c5ea39

                  SHA1

                  700cc99ec8d3113435e657070d2d6bde0a833adc

                  SHA256

                  b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                  SHA512

                  6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8451a2c5daa42b25333b1b2089c5ea39

                  SHA1

                  700cc99ec8d3113435e657070d2d6bde0a833adc

                  SHA256

                  b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                  SHA512

                  6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/1340-152-0x0000000005170000-0x0000000005180000-memory.dmp

                  Filesize

                  64KB

                • memory/1340-156-0x000000000BAF0000-0x000000000C094000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1340-157-0x000000000B8A0000-0x000000000BA62000-memory.dmp

                  Filesize

                  1.8MB

                • memory/1340-158-0x000000000C5D0000-0x000000000CAFC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/1340-159-0x0000000005170000-0x0000000005180000-memory.dmp

                  Filesize

                  64KB

                • memory/1340-160-0x000000000BA70000-0x000000000BAC0000-memory.dmp

                  Filesize

                  320KB

                • memory/1340-155-0x000000000A960000-0x000000000A9C6000-memory.dmp

                  Filesize

                  408KB

                • memory/1340-154-0x000000000AA00000-0x000000000AA92000-memory.dmp

                  Filesize

                  584KB

                • memory/1340-153-0x000000000A8E0000-0x000000000A956000-memory.dmp

                  Filesize

                  472KB

                • memory/1340-151-0x000000000A5D0000-0x000000000A60C000-memory.dmp

                  Filesize

                  240KB

                • memory/1340-150-0x000000000A570000-0x000000000A582000-memory.dmp

                  Filesize

                  72KB

                • memory/1340-149-0x000000000A640000-0x000000000A74A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/1340-148-0x000000000AB20000-0x000000000B138000-memory.dmp

                  Filesize

                  6.1MB

                • memory/1340-147-0x0000000000800000-0x000000000082E000-memory.dmp

                  Filesize

                  184KB

                • memory/4780-171-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-183-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-185-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-187-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-189-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-191-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-193-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-194-0x0000000000580000-0x00000000005AD000-memory.dmp

                  Filesize

                  180KB

                • memory/4780-195-0x00000000025B0000-0x00000000025C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4780-196-0x00000000025B0000-0x00000000025C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4780-197-0x00000000025B0000-0x00000000025C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4780-198-0x0000000000400000-0x0000000000485000-memory.dmp

                  Filesize

                  532KB

                • memory/4780-200-0x00000000025B0000-0x00000000025C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4780-181-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-179-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-177-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-175-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-173-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-169-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-167-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-166-0x00000000023F0000-0x0000000002402000-memory.dmp

                  Filesize

                  72KB

                • memory/4780-201-0x00000000025B0000-0x00000000025C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4780-202-0x00000000025B0000-0x00000000025C0000-memory.dmp

                  Filesize

                  64KB

                • memory/4780-203-0x0000000000400000-0x0000000000485000-memory.dmp

                  Filesize

                  532KB