Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 22:31

General

  • Target

    71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe

  • Size

    893KB

  • MD5

    d777f047d742b1c50257e42eba59a9b0

  • SHA1

    9958804e06d3b267ed7cdef316fbd32c22a9a91d

  • SHA256

    71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001

  • SHA512

    24c28d943c92eace81fcd49012c9268e545279f62674c461f20c28e915a3c0ee490654d9cca7728ca7f2e7dc2a5a60f1d4dda296154414e56b7456066068f2c6

  • SSDEEP

    24576:TycQYc4RdL/3trTMNRpcTTfiQbdK021Q5:mxYnRdLPtPMNRuqQ8h

Malware Config

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe
    "C:\Users\Admin\AppData\Local\Temp\71f7fb436946ae6831430cbc041e18c57ebecbb6da7061536be06b1803426001.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:616
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1572
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:592
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe

    Filesize

    169KB

    MD5

    04747e8f894f6d3968fe4b25a9625db3

    SHA1

    f37ad91bacd8a129b9924938aa7b27da3965a67d

    SHA256

    c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6

    SHA512

    e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe

    Filesize

    169KB

    MD5

    04747e8f894f6d3968fe4b25a9625db3

    SHA1

    f37ad91bacd8a129b9924938aa7b27da3965a67d

    SHA256

    c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6

    SHA512

    e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe

    Filesize

    739KB

    MD5

    3cc79175c91e7b13537f687a61351123

    SHA1

    63bfed1ad2079119fb64d6d5b99974904940d6a6

    SHA256

    0d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd

    SHA512

    33f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe

    Filesize

    739KB

    MD5

    3cc79175c91e7b13537f687a61351123

    SHA1

    63bfed1ad2079119fb64d6d5b99974904940d6a6

    SHA256

    0d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd

    SHA512

    33f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe

    Filesize

    301KB

    MD5

    b2509e24d9410257b5f3b8d9ff5fcc57

    SHA1

    74712746cec5f23fd0f31a7d7e0c502e851d0ee9

    SHA256

    c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b

    SHA512

    1bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe

    Filesize

    301KB

    MD5

    b2509e24d9410257b5f3b8d9ff5fcc57

    SHA1

    74712746cec5f23fd0f31a7d7e0c502e851d0ee9

    SHA256

    c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b

    SHA512

    1bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe

    Filesize

    582KB

    MD5

    d90133c1a7a63090810153fcacac0b70

    SHA1

    cb95cb4b2c91f496abb003cbe22254edbb09acee

    SHA256

    fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21

    SHA512

    fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe

    Filesize

    582KB

    MD5

    d90133c1a7a63090810153fcacac0b70

    SHA1

    cb95cb4b2c91f496abb003cbe22254edbb09acee

    SHA256

    fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21

    SHA512

    fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe

    Filesize

    582KB

    MD5

    d90133c1a7a63090810153fcacac0b70

    SHA1

    cb95cb4b2c91f496abb003cbe22254edbb09acee

    SHA256

    fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21

    SHA512

    fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6

  • C:\Windows\Temp\1.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Windows\Temp\1.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe

    Filesize

    169KB

    MD5

    04747e8f894f6d3968fe4b25a9625db3

    SHA1

    f37ad91bacd8a129b9924938aa7b27da3965a67d

    SHA256

    c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6

    SHA512

    e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr097078.exe

    Filesize

    169KB

    MD5

    04747e8f894f6d3968fe4b25a9625db3

    SHA1

    f37ad91bacd8a129b9924938aa7b27da3965a67d

    SHA256

    c5a3692140b55ad5ecad6b7fda421bf80eaa61b39ff01c1f6b32e30ee847ead6

    SHA512

    e1e0e56dd25e5a885f1f631e25a37890d7986719e9e40cc0a37876d2285bd06ac9a355d820caf78596c5061925c9b2e6a44bf8a590ae47d57b31bd019be9e6a3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe

    Filesize

    739KB

    MD5

    3cc79175c91e7b13537f687a61351123

    SHA1

    63bfed1ad2079119fb64d6d5b99974904940d6a6

    SHA256

    0d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd

    SHA512

    33f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st799353.exe

    Filesize

    739KB

    MD5

    3cc79175c91e7b13537f687a61351123

    SHA1

    63bfed1ad2079119fb64d6d5b99974904940d6a6

    SHA256

    0d2980398c3acef8e6c3a6063c6eb8e0b1e27bd1f41aabc41dd4dbdaf5e6e7fd

    SHA512

    33f4fa8a77da1a485e2e18769d854ae5379305c52e234cfd850895ff4277afbd05e8609ff7e7800c29bc954416c7e2c5478a86374f221df1f79c87f4127e1488

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe

    Filesize

    301KB

    MD5

    b2509e24d9410257b5f3b8d9ff5fcc57

    SHA1

    74712746cec5f23fd0f31a7d7e0c502e851d0ee9

    SHA256

    c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b

    SHA512

    1bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\22499290.exe

    Filesize

    301KB

    MD5

    b2509e24d9410257b5f3b8d9ff5fcc57

    SHA1

    74712746cec5f23fd0f31a7d7e0c502e851d0ee9

    SHA256

    c90e7ff9511192332ef490861997108f732950cd7ac59d2132ff3af0c16cf09b

    SHA512

    1bf9420466044b31b8294b241bd92fc64be3160cddc53af9cb7187e93ccf620f99a3c9554cf824bc0cc1a422744cc24e8b532c8f1445bab2ecc487d4cd519f15

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe

    Filesize

    582KB

    MD5

    d90133c1a7a63090810153fcacac0b70

    SHA1

    cb95cb4b2c91f496abb003cbe22254edbb09acee

    SHA256

    fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21

    SHA512

    fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe

    Filesize

    582KB

    MD5

    d90133c1a7a63090810153fcacac0b70

    SHA1

    cb95cb4b2c91f496abb003cbe22254edbb09acee

    SHA256

    fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21

    SHA512

    fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp694743.exe

    Filesize

    582KB

    MD5

    d90133c1a7a63090810153fcacac0b70

    SHA1

    cb95cb4b2c91f496abb003cbe22254edbb09acee

    SHA256

    fad9a2f0189b552a3b8346ff7d3c6ba470677b37ba46f2560a0e086357377e21

    SHA512

    fbd1dd10e4aa47bad46d3e37781d7f71121d25422242579c463a07a808f201ec7b718e768ce1f7c907fdfb703efbee3d48813b9f0b9af4676c5ad377cff073a6

  • \Windows\Temp\1.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • memory/436-4387-0x0000000000CA0000-0x0000000000CD0000-memory.dmp

    Filesize

    192KB

  • memory/436-4388-0x0000000000560000-0x0000000000566000-memory.dmp

    Filesize

    24KB

  • memory/436-4389-0x0000000004BC0000-0x0000000004C00000-memory.dmp

    Filesize

    256KB

  • memory/436-4390-0x0000000004BC0000-0x0000000004C00000-memory.dmp

    Filesize

    256KB

  • memory/592-4378-0x0000000002570000-0x00000000025B0000-memory.dmp

    Filesize

    256KB

  • memory/592-2224-0x0000000002640000-0x00000000026A8000-memory.dmp

    Filesize

    416KB

  • memory/592-2225-0x0000000004E20000-0x0000000004E86000-memory.dmp

    Filesize

    408KB

  • memory/592-2620-0x00000000002A0000-0x00000000002FB000-memory.dmp

    Filesize

    364KB

  • memory/592-2621-0x0000000002570000-0x00000000025B0000-memory.dmp

    Filesize

    256KB

  • memory/592-2623-0x0000000002570000-0x00000000025B0000-memory.dmp

    Filesize

    256KB

  • memory/592-4375-0x00000000025C0000-0x00000000025F2000-memory.dmp

    Filesize

    200KB

  • memory/592-4376-0x0000000002570000-0x00000000025B0000-memory.dmp

    Filesize

    256KB

  • memory/592-4379-0x0000000002570000-0x00000000025B0000-memory.dmp

    Filesize

    256KB

  • memory/616-91-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-115-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-139-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-141-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-137-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-129-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-121-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-109-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-103-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-93-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-85-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-2206-0x00000000004D0000-0x00000000004DA000-memory.dmp

    Filesize

    40KB

  • memory/616-133-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-131-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-127-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-125-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-123-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-119-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-117-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-135-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-113-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-74-0x0000000002090000-0x00000000020E8000-memory.dmp

    Filesize

    352KB

  • memory/616-111-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-107-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-105-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-101-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-99-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-97-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-95-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-89-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-87-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-83-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-81-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-79-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-78-0x0000000002280000-0x00000000022D1000-memory.dmp

    Filesize

    324KB

  • memory/616-77-0x0000000004B30000-0x0000000004B70000-memory.dmp

    Filesize

    256KB

  • memory/616-76-0x0000000004B30000-0x0000000004B70000-memory.dmp

    Filesize

    256KB

  • memory/616-75-0x0000000002280000-0x00000000022D6000-memory.dmp

    Filesize

    344KB

  • memory/1572-2222-0x00000000010E0000-0x00000000010EA000-memory.dmp

    Filesize

    40KB