Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 22:31
Static task
static1
Behavioral task
behavioral1
Sample
71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe
Resource
win10v2004-20230220-en
General
-
Target
71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe
-
Size
893KB
-
MD5
d777f047d742b1c50257e42eba59a9b0
-
SHA1
9958804e06d3b267ed7cdef316fbd32c22a9a91d
-
SHA256
71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001
-
SHA512
24c28d943c92eace81fcd49012c9268e545279f62674c461f20c28e915a3c0ee490654d9cca7728ca7f2e7dc2a5a60f1d4dda296154414e56b7456066068f2c6
-
SSDEEP
24576:TycQYc4RdL/3trTMNRpcTTfiQbdK021Q5:mxYnRdLPtPMNRuqQ8h
Malware Config
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 5 IoCs
pid Process 908 st799353.exe 616 22499290.exe 1572 1.exe 592 kp694743.exe 436 lr097078.exe -
Loads dropped DLL 10 IoCs
pid Process 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 908 st799353.exe 908 st799353.exe 616 22499290.exe 616 22499290.exe 908 st799353.exe 908 st799353.exe 592 kp694743.exe 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 436 lr097078.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce st799353.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st799353.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1572 1.exe 1572 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 616 22499290.exe Token: SeDebugPrivilege 592 kp694743.exe Token: SeDebugPrivilege 1572 1.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 2000 wrote to memory of 908 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 28 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 908 wrote to memory of 616 908 st799353.exe 29 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 616 wrote to memory of 1572 616 22499290.exe 30 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 908 wrote to memory of 592 908 st799353.exe 31 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32 PID 2000 wrote to memory of 436 2000 71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe"C:\Users\Admin\AppData\Local\Temp\71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD504747e8f894f6d3968fe4b25a9625db3
SHA1f37ad91bacd8a129b9924938aa7b27da3965a67d
SHA256c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6
SHA512e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3
-
Filesize
169KB
MD504747e8f894f6d3968fe4b25a9625db3
SHA1f37ad91bacd8a129b9924938aa7b27da3965a67d
SHA256c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6
SHA512e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3
-
Filesize
739KB
MD53cc79175c91e7b13537f687a61351123
SHA163bfed1ad2079119fb64d6d5b99974904940d6a6
SHA2560d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd
SHA51233f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488
-
Filesize
739KB
MD53cc79175c91e7b13537f687a61351123
SHA163bfed1ad2079119fb64d6d5b99974904940d6a6
SHA2560d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd
SHA51233f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488
-
Filesize
301KB
MD5b2509e24d9410257b5f3b8d9ff5fcc57
SHA174712746cec5f23fd0f31a7d7e0c502e851d0ee9
SHA256c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b
SHA5121bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15
-
Filesize
301KB
MD5b2509e24d9410257b5f3b8d9ff5fcc57
SHA174712746cec5f23fd0f31a7d7e0c502e851d0ee9
SHA256c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b
SHA5121bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15
-
Filesize
582KB
MD5d90133c1a7a63090810153fcacac0b70
SHA1cb95cb4b2c91f496abb003cbe22254edbb09acee
SHA256fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21
SHA512fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6
-
Filesize
582KB
MD5d90133c1a7a63090810153fcacac0b70
SHA1cb95cb4b2c91f496abb003cbe22254edbb09acee
SHA256fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21
SHA512fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6
-
Filesize
582KB
MD5d90133c1a7a63090810153fcacac0b70
SHA1cb95cb4b2c91f496abb003cbe22254edbb09acee
SHA256fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21
SHA512fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
169KB
MD504747e8f894f6d3968fe4b25a9625db3
SHA1f37ad91bacd8a129b9924938aa7b27da3965a67d
SHA256c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6
SHA512e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3
-
Filesize
169KB
MD504747e8f894f6d3968fe4b25a9625db3
SHA1f37ad91bacd8a129b9924938aa7b27da3965a67d
SHA256c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6
SHA512e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3
-
Filesize
739KB
MD53cc79175c91e7b13537f687a61351123
SHA163bfed1ad2079119fb64d6d5b99974904940d6a6
SHA2560d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd
SHA51233f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488
-
Filesize
739KB
MD53cc79175c91e7b13537f687a61351123
SHA163bfed1ad2079119fb64d6d5b99974904940d6a6
SHA2560d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd
SHA51233f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488
-
Filesize
301KB
MD5b2509e24d9410257b5f3b8d9ff5fcc57
SHA174712746cec5f23fd0f31a7d7e0c502e851d0ee9
SHA256c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b
SHA5121bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15
-
Filesize
301KB
MD5b2509e24d9410257b5f3b8d9ff5fcc57
SHA174712746cec5f23fd0f31a7d7e0c502e851d0ee9
SHA256c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b
SHA5121bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15
-
Filesize
582KB
MD5d90133c1a7a63090810153fcacac0b70
SHA1cb95cb4b2c91f496abb003cbe22254edbb09acee
SHA256fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21
SHA512fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6
-
Filesize
582KB
MD5d90133c1a7a63090810153fcacac0b70
SHA1cb95cb4b2c91f496abb003cbe22254edbb09acee
SHA256fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21
SHA512fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6
-
Filesize
582KB
MD5d90133c1a7a63090810153fcacac0b70
SHA1cb95cb4b2c91f496abb003cbe22254edbb09acee
SHA256fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21
SHA512fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91