Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    209s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2023, 18:58

General

  • Target

    ccd3a0864a7f159f1b1253a990224f7901459e7f3a85256edd391c1c9919fe74.exe

  • Size

    480KB

  • MD5

    00bc08db16053d06de3dde825bd163e2

  • SHA1

    38b0038120678226e437a0ee5e7517079a4dee0a

  • SHA256

    ccd3a0864a7f159f1b1253a990224f7901459e7f3a85256edd391c1c9919fe74

  • SHA512

    4d5cb9da4e0bb065ea2171aa1f33aa2638247ff48a07234880c341b0aa3488ae9fb8ed040b163ce6fd0527cbc81c8b799267adbffaacdef1e3f982821337b7c4

  • SSDEEP

    6144:Kgy+bnr+9p0yN90QEEaNE+p9YMLQ3TckMnpD2DPfwUI/AdP00NFB3wEQr2cDVAzH:AMrpy90zDDQ02DnrsQFBnQaKDPH+BMU

Malware Config

Extracted

Family

redline

Botnet

misar

C2

217.196.96.101:4132

Attributes
  • auth_value

    069dd9eeee8cff502b661416888f692a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccd3a0864a7f159f1b1253a990224f7901459e7f3a85256edd391c1c9919fe74.exe
    "C:\Users\Admin\AppData\Local\Temp\ccd3a0864a7f159f1b1253a990224f7901459e7f3a85256edd391c1c9919fe74.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4037480.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4037480.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8048361.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8048361.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3319523.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3319523.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3172
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8124573.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8124573.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3404
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1392
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4808
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:4696
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:2452
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4592
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:3412
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:1876
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:640

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8124573.exe

                Filesize

                209KB

                MD5

                993e3e6726b754566442bc28d240087e

                SHA1

                f9dc18a40f02b64b454d5d2243437b2848691bf9

                SHA256

                61731d72baec2af466f66f251580e064171728b4e31f3ceb47b7b8b80131d1f0

                SHA512

                db31e6b08f4abf8ee3296f7da08dc632f0eeae2629f08cfb35e490536e7874a936a168779cae6fa6af14ed72cee9f662cfefebdadf95177684884013a745d0fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8124573.exe

                Filesize

                209KB

                MD5

                993e3e6726b754566442bc28d240087e

                SHA1

                f9dc18a40f02b64b454d5d2243437b2848691bf9

                SHA256

                61731d72baec2af466f66f251580e064171728b4e31f3ceb47b7b8b80131d1f0

                SHA512

                db31e6b08f4abf8ee3296f7da08dc632f0eeae2629f08cfb35e490536e7874a936a168779cae6fa6af14ed72cee9f662cfefebdadf95177684884013a745d0fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4037480.exe

                Filesize

                309KB

                MD5

                b0d9c5db14ebf57b07af375813da394a

                SHA1

                6e3c1726068f781ff0edbd8c0a541027a997510a

                SHA256

                b8ae5739c680a408e911a73865bbfbb2343222e7ca4ee99b17a3859fb5c7b92e

                SHA512

                d1ff9dd9e3cd5fb5905575bed308db9291bcf502f4be083e907429e908be209e2ad1d20576b6ff20cb762514e12b90d1982184b0d5bee9178f3d09abbc0a6b1f

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4037480.exe

                Filesize

                309KB

                MD5

                b0d9c5db14ebf57b07af375813da394a

                SHA1

                6e3c1726068f781ff0edbd8c0a541027a997510a

                SHA256

                b8ae5739c680a408e911a73865bbfbb2343222e7ca4ee99b17a3859fb5c7b92e

                SHA512

                d1ff9dd9e3cd5fb5905575bed308db9291bcf502f4be083e907429e908be209e2ad1d20576b6ff20cb762514e12b90d1982184b0d5bee9178f3d09abbc0a6b1f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8048361.exe

                Filesize

                178KB

                MD5

                bd7f518fa23a0432f37446d6b10ec49f

                SHA1

                87fbc1d6fd374375b9ad81f9b823cdf209f3ffc7

                SHA256

                d1603d1eda764200c56ce006726e0f4828cf53bbc22916175a4eb7cb31cf0347

                SHA512

                ef9d15faf944fd9609cc4c998773b859e26899d70dcb8bbdc1df4c66ce05fceeafe95f3456ae28ef3228520bd04aa00da53546713847df4578b626f0bbf160fa

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8048361.exe

                Filesize

                178KB

                MD5

                bd7f518fa23a0432f37446d6b10ec49f

                SHA1

                87fbc1d6fd374375b9ad81f9b823cdf209f3ffc7

                SHA256

                d1603d1eda764200c56ce006726e0f4828cf53bbc22916175a4eb7cb31cf0347

                SHA512

                ef9d15faf944fd9609cc4c998773b859e26899d70dcb8bbdc1df4c66ce05fceeafe95f3456ae28ef3228520bd04aa00da53546713847df4578b626f0bbf160fa

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3319523.exe

                Filesize

                168KB

                MD5

                c51c784cff6af2fe897a414349779ed2

                SHA1

                3e15484c3d7b0927294bf0538af0e2983cc2c098

                SHA256

                ba854a6d676d16d249155e5d2b51b5843d67dc6b29761b9d29c73b9ef735a20d

                SHA512

                c6247e2ca4c3f9ead23d7168d926772f26bfbe571cc2d15a8408186723ac73bb06f415880289b10f240866de566df1924f73c937379b0794d2262f7417012851

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3319523.exe

                Filesize

                168KB

                MD5

                c51c784cff6af2fe897a414349779ed2

                SHA1

                3e15484c3d7b0927294bf0538af0e2983cc2c098

                SHA256

                ba854a6d676d16d249155e5d2b51b5843d67dc6b29761b9d29c73b9ef735a20d

                SHA512

                c6247e2ca4c3f9ead23d7168d926772f26bfbe571cc2d15a8408186723ac73bb06f415880289b10f240866de566df1924f73c937379b0794d2262f7417012851

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                209KB

                MD5

                993e3e6726b754566442bc28d240087e

                SHA1

                f9dc18a40f02b64b454d5d2243437b2848691bf9

                SHA256

                61731d72baec2af466f66f251580e064171728b4e31f3ceb47b7b8b80131d1f0

                SHA512

                db31e6b08f4abf8ee3296f7da08dc632f0eeae2629f08cfb35e490536e7874a936a168779cae6fa6af14ed72cee9f662cfefebdadf95177684884013a745d0fd

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                209KB

                MD5

                993e3e6726b754566442bc28d240087e

                SHA1

                f9dc18a40f02b64b454d5d2243437b2848691bf9

                SHA256

                61731d72baec2af466f66f251580e064171728b4e31f3ceb47b7b8b80131d1f0

                SHA512

                db31e6b08f4abf8ee3296f7da08dc632f0eeae2629f08cfb35e490536e7874a936a168779cae6fa6af14ed72cee9f662cfefebdadf95177684884013a745d0fd

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                209KB

                MD5

                993e3e6726b754566442bc28d240087e

                SHA1

                f9dc18a40f02b64b454d5d2243437b2848691bf9

                SHA256

                61731d72baec2af466f66f251580e064171728b4e31f3ceb47b7b8b80131d1f0

                SHA512

                db31e6b08f4abf8ee3296f7da08dc632f0eeae2629f08cfb35e490536e7874a936a168779cae6fa6af14ed72cee9f662cfefebdadf95177684884013a745d0fd

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                209KB

                MD5

                993e3e6726b754566442bc28d240087e

                SHA1

                f9dc18a40f02b64b454d5d2243437b2848691bf9

                SHA256

                61731d72baec2af466f66f251580e064171728b4e31f3ceb47b7b8b80131d1f0

                SHA512

                db31e6b08f4abf8ee3296f7da08dc632f0eeae2629f08cfb35e490536e7874a936a168779cae6fa6af14ed72cee9f662cfefebdadf95177684884013a745d0fd

              • memory/3172-197-0x000000000BD00000-0x000000000BEC2000-memory.dmp

                Filesize

                1.8MB

              • memory/3172-196-0x000000000B370000-0x000000000B3C0000-memory.dmp

                Filesize

                320KB

              • memory/3172-195-0x000000000A920000-0x000000000A986000-memory.dmp

                Filesize

                408KB

              • memory/3172-194-0x000000000A710000-0x000000000A7A2000-memory.dmp

                Filesize

                584KB

              • memory/3172-193-0x000000000A690000-0x000000000A706000-memory.dmp

                Filesize

                472KB

              • memory/3172-192-0x0000000005000000-0x0000000005010000-memory.dmp

                Filesize

                64KB

              • memory/3172-191-0x000000000A450000-0x000000000A48C000-memory.dmp

                Filesize

                240KB

              • memory/3172-190-0x000000000A3F0000-0x000000000A402000-memory.dmp

                Filesize

                72KB

              • memory/3172-189-0x0000000005000000-0x0000000005010000-memory.dmp

                Filesize

                64KB

              • memory/3172-188-0x000000000A4C0000-0x000000000A5CA000-memory.dmp

                Filesize

                1.0MB

              • memory/3172-187-0x000000000A9B0000-0x000000000AFC8000-memory.dmp

                Filesize

                6.1MB

              • memory/3172-186-0x0000000000680000-0x00000000006B0000-memory.dmp

                Filesize

                192KB

              • memory/3172-198-0x000000000C400000-0x000000000C92C000-memory.dmp

                Filesize

                5.2MB

              • memory/4052-154-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-181-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-179-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-177-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-175-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-173-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-171-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-169-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-167-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-165-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-161-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-163-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-159-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-157-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-155-0x0000000004A90000-0x0000000004AA2000-memory.dmp

                Filesize

                72KB

              • memory/4052-153-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/4052-152-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/4052-151-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/4052-150-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/4052-149-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/4052-148-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/4052-147-0x0000000004BE0000-0x0000000005184000-memory.dmp

                Filesize

                5.6MB