Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2023, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe
Resource
win10v2004-20230220-en
General
-
Target
7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe
-
Size
480KB
-
MD5
657d1e9975ebea448a66980929bddf94
-
SHA1
df0f4abf41edd303ebd02fedc8ebbb7961bf555d
-
SHA256
7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8
-
SHA512
a629b71e92054777b0e3ea2972d4709262ee8c9b8fcca2f72d17697c2ffe679c05978e3ce94e9630483f15205d60d68b5e135ed5cd832e511cd5e5d80f3fd18a
-
SSDEEP
12288:5Mrqy90pzfJckCreXfnjzdikJqQLksMGdOmkE4rAC:vyUjJZCCPHA8LjMOOmf47
Malware Config
Extracted
redline
domor
217.196.96.101:4132
-
auth_value
39471bda00546bb0435bc7adfd6881dc
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h0296664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h0296664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h0296664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h0296664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h0296664.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h0296664.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation i0828558.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 6 IoCs
pid Process 1744 x1406412.exe 1476 g5333641.exe 2384 h0296664.exe 4744 i0828558.exe 3584 oneetx.exe 964 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3736 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h0296664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h0296664.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x1406412.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1406412.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1476 g5333641.exe 1476 g5333641.exe 2384 h0296664.exe 2384 h0296664.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1476 g5333641.exe Token: SeDebugPrivilege 2384 h0296664.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4744 i0828558.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4680 wrote to memory of 1744 4680 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe 84 PID 4680 wrote to memory of 1744 4680 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe 84 PID 4680 wrote to memory of 1744 4680 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe 84 PID 1744 wrote to memory of 1476 1744 x1406412.exe 85 PID 1744 wrote to memory of 1476 1744 x1406412.exe 85 PID 1744 wrote to memory of 1476 1744 x1406412.exe 85 PID 1744 wrote to memory of 2384 1744 x1406412.exe 89 PID 1744 wrote to memory of 2384 1744 x1406412.exe 89 PID 1744 wrote to memory of 2384 1744 x1406412.exe 89 PID 4680 wrote to memory of 4744 4680 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe 90 PID 4680 wrote to memory of 4744 4680 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe 90 PID 4680 wrote to memory of 4744 4680 7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe 90 PID 4744 wrote to memory of 3584 4744 i0828558.exe 91 PID 4744 wrote to memory of 3584 4744 i0828558.exe 91 PID 4744 wrote to memory of 3584 4744 i0828558.exe 91 PID 3584 wrote to memory of 1484 3584 oneetx.exe 92 PID 3584 wrote to memory of 1484 3584 oneetx.exe 92 PID 3584 wrote to memory of 1484 3584 oneetx.exe 92 PID 3584 wrote to memory of 2540 3584 oneetx.exe 94 PID 3584 wrote to memory of 2540 3584 oneetx.exe 94 PID 3584 wrote to memory of 2540 3584 oneetx.exe 94 PID 2540 wrote to memory of 1420 2540 cmd.exe 96 PID 2540 wrote to memory of 1420 2540 cmd.exe 96 PID 2540 wrote to memory of 1420 2540 cmd.exe 96 PID 2540 wrote to memory of 4328 2540 cmd.exe 97 PID 2540 wrote to memory of 4328 2540 cmd.exe 97 PID 2540 wrote to memory of 4328 2540 cmd.exe 97 PID 2540 wrote to memory of 4316 2540 cmd.exe 98 PID 2540 wrote to memory of 4316 2540 cmd.exe 98 PID 2540 wrote to memory of 4316 2540 cmd.exe 98 PID 2540 wrote to memory of 4612 2540 cmd.exe 99 PID 2540 wrote to memory of 4612 2540 cmd.exe 99 PID 2540 wrote to memory of 4612 2540 cmd.exe 99 PID 2540 wrote to memory of 4324 2540 cmd.exe 100 PID 2540 wrote to memory of 4324 2540 cmd.exe 100 PID 2540 wrote to memory of 4324 2540 cmd.exe 100 PID 2540 wrote to memory of 960 2540 cmd.exe 101 PID 2540 wrote to memory of 960 2540 cmd.exe 101 PID 2540 wrote to memory of 960 2540 cmd.exe 101 PID 3584 wrote to memory of 3736 3584 oneetx.exe 103 PID 3584 wrote to memory of 3736 3584 oneetx.exe 103 PID 3584 wrote to memory of 3736 3584 oneetx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe"C:\Users\Admin\AppData\Local\Temp\7e6665203416fda3a8a6a1d9c2da6937987ac28beae804e7458709ac7ca574d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1406412.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1406412.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5333641.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5333641.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0296664.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0296664.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0828558.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0828558.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1484
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1420
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4328
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4316
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4612
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4324
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:960
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3736
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD53f4b3de0da48d53bb3b9090ac31e210f
SHA10304c04d056e398a337991b6240e2513addc083f
SHA2567f55a6c81be186b58beacdb1c5b71c9c84cbcac698deee6d10146c6ff74e48a4
SHA512021a73284d7fc0c580a20175d8f0c5b1fb16691e7cc9749e3a7751dbd3a13f85ec9ef4b05388dc664ef7d19277f5f61feec5672e29d3cb8a10026ee266aa2cab
-
Filesize
209KB
MD53f4b3de0da48d53bb3b9090ac31e210f
SHA10304c04d056e398a337991b6240e2513addc083f
SHA2567f55a6c81be186b58beacdb1c5b71c9c84cbcac698deee6d10146c6ff74e48a4
SHA512021a73284d7fc0c580a20175d8f0c5b1fb16691e7cc9749e3a7751dbd3a13f85ec9ef4b05388dc664ef7d19277f5f61feec5672e29d3cb8a10026ee266aa2cab
-
Filesize
307KB
MD5f086425643c027f8b74acf8026676371
SHA1e5721e1b33719518b6a73b5a84176de83540eb4e
SHA2568bad959a1c43b65f68be234ef94154f9e14e6f65f99653eb75b242c44fe39ecf
SHA5128182592485fd1bc970dc9d2fb1a0d027d0f1e45bad35129c2bb351c21e80a2df106ba16eae5ccb62e1038e1ef551b5845e4018238f9ec695724fd090c211727e
-
Filesize
307KB
MD5f086425643c027f8b74acf8026676371
SHA1e5721e1b33719518b6a73b5a84176de83540eb4e
SHA2568bad959a1c43b65f68be234ef94154f9e14e6f65f99653eb75b242c44fe39ecf
SHA5128182592485fd1bc970dc9d2fb1a0d027d0f1e45bad35129c2bb351c21e80a2df106ba16eae5ccb62e1038e1ef551b5845e4018238f9ec695724fd090c211727e
-
Filesize
168KB
MD5524272d8d9a521b3425fb182fce63723
SHA1b8d4ad38dc51b68efd2d9b8cce2aec5ec74ff39d
SHA2566f359d8420a9b115ddf843749aea837670b9be79dcc2801c114ce33dbb8ce01f
SHA5124ec4caf88b404a26ae67cc0536698b5ca37fe3107a1875848b6ae1334e96cbcc4f60115121cc25f163d319e1e055cf4ec788f3b4cec06f154cf34b48a7fb0179
-
Filesize
168KB
MD5524272d8d9a521b3425fb182fce63723
SHA1b8d4ad38dc51b68efd2d9b8cce2aec5ec74ff39d
SHA2566f359d8420a9b115ddf843749aea837670b9be79dcc2801c114ce33dbb8ce01f
SHA5124ec4caf88b404a26ae67cc0536698b5ca37fe3107a1875848b6ae1334e96cbcc4f60115121cc25f163d319e1e055cf4ec788f3b4cec06f154cf34b48a7fb0179
-
Filesize
177KB
MD58e899b2e7115587d882c9efa6dc7d59b
SHA185db8ba7773179a60959087ed6ec14c0af1015f7
SHA256181419482cd465a3d9560ea7436c1c4f9d5ac215dab19f9e1b2fb97d74454f64
SHA51255280099aae37b545151d8b9f78b53cd33fc6a69b58a45706ef220abae22f4dadc7061f7b741ef27ca1e76e09c06e1f181cc2c547d70f3c8c32d4be1219781e5
-
Filesize
177KB
MD58e899b2e7115587d882c9efa6dc7d59b
SHA185db8ba7773179a60959087ed6ec14c0af1015f7
SHA256181419482cd465a3d9560ea7436c1c4f9d5ac215dab19f9e1b2fb97d74454f64
SHA51255280099aae37b545151d8b9f78b53cd33fc6a69b58a45706ef220abae22f4dadc7061f7b741ef27ca1e76e09c06e1f181cc2c547d70f3c8c32d4be1219781e5
-
Filesize
209KB
MD53f4b3de0da48d53bb3b9090ac31e210f
SHA10304c04d056e398a337991b6240e2513addc083f
SHA2567f55a6c81be186b58beacdb1c5b71c9c84cbcac698deee6d10146c6ff74e48a4
SHA512021a73284d7fc0c580a20175d8f0c5b1fb16691e7cc9749e3a7751dbd3a13f85ec9ef4b05388dc664ef7d19277f5f61feec5672e29d3cb8a10026ee266aa2cab
-
Filesize
209KB
MD53f4b3de0da48d53bb3b9090ac31e210f
SHA10304c04d056e398a337991b6240e2513addc083f
SHA2567f55a6c81be186b58beacdb1c5b71c9c84cbcac698deee6d10146c6ff74e48a4
SHA512021a73284d7fc0c580a20175d8f0c5b1fb16691e7cc9749e3a7751dbd3a13f85ec9ef4b05388dc664ef7d19277f5f61feec5672e29d3cb8a10026ee266aa2cab
-
Filesize
209KB
MD53f4b3de0da48d53bb3b9090ac31e210f
SHA10304c04d056e398a337991b6240e2513addc083f
SHA2567f55a6c81be186b58beacdb1c5b71c9c84cbcac698deee6d10146c6ff74e48a4
SHA512021a73284d7fc0c580a20175d8f0c5b1fb16691e7cc9749e3a7751dbd3a13f85ec9ef4b05388dc664ef7d19277f5f61feec5672e29d3cb8a10026ee266aa2cab
-
Filesize
209KB
MD53f4b3de0da48d53bb3b9090ac31e210f
SHA10304c04d056e398a337991b6240e2513addc083f
SHA2567f55a6c81be186b58beacdb1c5b71c9c84cbcac698deee6d10146c6ff74e48a4
SHA512021a73284d7fc0c580a20175d8f0c5b1fb16691e7cc9749e3a7751dbd3a13f85ec9ef4b05388dc664ef7d19277f5f61feec5672e29d3cb8a10026ee266aa2cab
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5