Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

29/10/2024, 12:54

241029-p48ghawqgq 10

07/05/2023, 06:34

230507-hb2pxsbd61 10

Analysis

  • max time kernel
    185s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2023, 06:34

General

  • Target

    c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea.exe

  • Size

    1.2MB

  • MD5

    d29f991dff39fe56501f4e530f57f9fc

  • SHA1

    33613d88ffee18ce6240032e9134a1ca25e71832

  • SHA256

    c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea

  • SHA512

    bf9cf8a6e827986d52d49f31995aaa9b40fbfbbafb3624bd0dfe28c72cd1338bfab4e35e8c123c7fba13ce38b79bec6eb59b14c2ac89d934e8a8fb9780d4e581

  • SSDEEP

    24576:G8WP6XlIJGBLj1k9E8MK2MipAlFlQoqIhtjrzPnd+DHfsYbvtwgq:goqJG9d8knqlQoqIzPd8Hfsgvn

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea.exe
    "C:\Users\Admin\AppData\Local\Temp\c33a121a0a51f5538be4a3649f7c8d7f2965e5090f83d19030f56d7fbea07fea.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki334387.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki334387.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki099472.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki099472.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki127879.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki127879.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3312
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az975613.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az975613.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1540
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu200681.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu200681.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4192
            • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
              "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4584
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:2168
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4272
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:1432
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:N"
                    8⤵
                      PID:968
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "oneetx.exe" /P "Admin:R" /E
                      8⤵
                        PID:392
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:2912
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\cb7ae701b3" /P "Admin:N"
                          8⤵
                            PID:948
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\cb7ae701b3" /P "Admin:R" /E
                            8⤵
                              PID:444
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf107942.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf107942.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4988
              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:4284

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki334387.exe

                Filesize

                852KB

                MD5

                f4d5446b7526a88d296ff84e4bfa576e

                SHA1

                32adb32e235180b3b5c6af08258814db484a9ca6

                SHA256

                e5ebec2cbd517d24bce4c8ab411b51551ec1700cbc253db0acc9512d4f2fbaf1

                SHA512

                832ee4d62e735c16c447a00665eca7eac12cad02ebb0875fbbbc5a349bfc4fcebcbea69a2235f63311f688c1d5810b688d4e1fe425b1fbf69fd7c71a1bc6cc1d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki334387.exe

                Filesize

                852KB

                MD5

                f4d5446b7526a88d296ff84e4bfa576e

                SHA1

                32adb32e235180b3b5c6af08258814db484a9ca6

                SHA256

                e5ebec2cbd517d24bce4c8ab411b51551ec1700cbc253db0acc9512d4f2fbaf1

                SHA512

                832ee4d62e735c16c447a00665eca7eac12cad02ebb0875fbbbc5a349bfc4fcebcbea69a2235f63311f688c1d5810b688d4e1fe425b1fbf69fd7c71a1bc6cc1d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki099472.exe

                Filesize

                578KB

                MD5

                f97e5dc74a30ee94dcd9308c9a15d629

                SHA1

                aa6f4d56ef656fe46759455cd31c621c449c290c

                SHA256

                e35c7c46ffdb9c2c6fadaa6efa1023d434207e8001a6a6b1868904df955eb3e8

                SHA512

                4ed2494373693007585ff62aded6e5d08b1b081b37452d031dff4ef0fd9a8c3f4b0a45b0454c0d1519057596b50b05b51c8de901ae2cbe088ee286439da1ca85

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki099472.exe

                Filesize

                578KB

                MD5

                f97e5dc74a30ee94dcd9308c9a15d629

                SHA1

                aa6f4d56ef656fe46759455cd31c621c449c290c

                SHA256

                e35c7c46ffdb9c2c6fadaa6efa1023d434207e8001a6a6b1868904df955eb3e8

                SHA512

                4ed2494373693007585ff62aded6e5d08b1b081b37452d031dff4ef0fd9a8c3f4b0a45b0454c0d1519057596b50b05b51c8de901ae2cbe088ee286439da1ca85

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf107942.exe

                Filesize

                353KB

                MD5

                de8348a2854e7a051783fc14fb28b95e

                SHA1

                7cf59b54a2f5898b02c66d58899c7585e7423eac

                SHA256

                1c5ba61085c5579040b75e5c05357eb0f0f14ae0265b8941cd38f62a623ed57a

                SHA512

                233c668ca4f8df9e2d603e09fb69647465c1a00fb58c8277585fbd4983cf3c49480b892bc4288eae6d16d2e281c602d69da3fa82b03a249f45eaad16194621ad

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cf107942.exe

                Filesize

                353KB

                MD5

                de8348a2854e7a051783fc14fb28b95e

                SHA1

                7cf59b54a2f5898b02c66d58899c7585e7423eac

                SHA256

                1c5ba61085c5579040b75e5c05357eb0f0f14ae0265b8941cd38f62a623ed57a

                SHA512

                233c668ca4f8df9e2d603e09fb69647465c1a00fb58c8277585fbd4983cf3c49480b892bc4288eae6d16d2e281c602d69da3fa82b03a249f45eaad16194621ad

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki127879.exe

                Filesize

                223KB

                MD5

                14959501f275d4d39bb38ad94bc50210

                SHA1

                4203952ae7f7090a696ccb225a7b23d511887a6e

                SHA256

                7c81324faf9ef8d1dd51c2041f137a0f957f1a517f8a6b1864cac31839091252

                SHA512

                8cd9fc7e75a4c90806fc060c13c1cb844d0238f0a5ad2d73374aabde7a5dc2d97be8bc065eddb9254fefd59f963eb94617dd8e740cd74a013df945cc173b3ef3

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki127879.exe

                Filesize

                223KB

                MD5

                14959501f275d4d39bb38ad94bc50210

                SHA1

                4203952ae7f7090a696ccb225a7b23d511887a6e

                SHA256

                7c81324faf9ef8d1dd51c2041f137a0f957f1a517f8a6b1864cac31839091252

                SHA512

                8cd9fc7e75a4c90806fc060c13c1cb844d0238f0a5ad2d73374aabde7a5dc2d97be8bc065eddb9254fefd59f963eb94617dd8e740cd74a013df945cc173b3ef3

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az975613.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az975613.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu200681.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu200681.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • memory/1076-164-0x0000000000400000-0x0000000002C95000-memory.dmp

                Filesize

                40.6MB

              • memory/1076-138-0x0000000004A00000-0x0000000004B0C000-memory.dmp

                Filesize

                1.0MB

              • memory/1540-163-0x0000000000710000-0x000000000071A000-memory.dmp

                Filesize

                40KB

              • memory/4988-209-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-229-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-190-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-191-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-192-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-193-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-195-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-197-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-199-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-201-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-203-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-205-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-207-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-188-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

                Filesize

                280KB

              • memory/4988-211-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-213-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-215-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-217-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-219-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-221-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-223-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-225-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-227-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-189-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-231-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-233-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-235-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-237-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-239-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-241-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-243-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-245-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-247-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-249-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-251-0x0000000007180000-0x00000000071B5000-memory.dmp

                Filesize

                212KB

              • memory/4988-985-0x0000000009CD0000-0x000000000A2E8000-memory.dmp

                Filesize

                6.1MB

              • memory/4988-986-0x000000000A320000-0x000000000A332000-memory.dmp

                Filesize

                72KB

              • memory/4988-987-0x000000000A340000-0x000000000A44A000-memory.dmp

                Filesize

                1.0MB

              • memory/4988-988-0x000000000A460000-0x000000000A49C000-memory.dmp

                Filesize

                240KB

              • memory/4988-989-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-991-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-992-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-993-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-995-0x0000000007290000-0x00000000072A0000-memory.dmp

                Filesize

                64KB

              • memory/4988-187-0x00000000072A0000-0x0000000007844000-memory.dmp

                Filesize

                5.6MB