Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2023, 00:38
Static task
static1
Behavioral task
behavioral1
Sample
7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe
Resource
win10v2004-20230220-en
General
-
Target
7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe
-
Size
479KB
-
MD5
1e8aa5defe829fb9bb325db0ecbb9b01
-
SHA1
f510a04461d27116a13cc4a2e128f87ce4d667ad
-
SHA256
7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19
-
SHA512
f1639c63d76e764ca1644d75e46bd7b8deb21f59d78592101c66a37fbabf62b5f0b01d83b19534f06ce268bb96c8f938682720b40436e137c2f1a467015bf658
-
SSDEEP
12288:fMroy90RP81NWUVWQ1+STuzGjIIAVAMA:Pya814QWXST43IIAR
Malware Config
Extracted
redline
ditro
217.196.96.101:4132
-
auth_value
8f24ed370a9b24aa28d3d634ea57912e
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h8935958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h8935958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h8935958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h8935958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h8935958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h8935958.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation i7323435.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 392 x6599042.exe 2140 g8421837.exe 1856 h8935958.exe 3792 i7323435.exe 2304 oneetx.exe 3388 oneetx.exe 1352 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5088 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h8935958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h8935958.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x6599042.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x6599042.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1384 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2140 g8421837.exe 2140 g8421837.exe 1856 h8935958.exe 1856 h8935958.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2140 g8421837.exe Token: SeDebugPrivilege 1856 h8935958.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3792 i7323435.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1520 wrote to memory of 392 1520 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe 83 PID 1520 wrote to memory of 392 1520 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe 83 PID 1520 wrote to memory of 392 1520 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe 83 PID 392 wrote to memory of 2140 392 x6599042.exe 84 PID 392 wrote to memory of 2140 392 x6599042.exe 84 PID 392 wrote to memory of 2140 392 x6599042.exe 84 PID 392 wrote to memory of 1856 392 x6599042.exe 91 PID 392 wrote to memory of 1856 392 x6599042.exe 91 PID 392 wrote to memory of 1856 392 x6599042.exe 91 PID 1520 wrote to memory of 3792 1520 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe 92 PID 1520 wrote to memory of 3792 1520 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe 92 PID 1520 wrote to memory of 3792 1520 7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe 92 PID 3792 wrote to memory of 2304 3792 i7323435.exe 93 PID 3792 wrote to memory of 2304 3792 i7323435.exe 93 PID 3792 wrote to memory of 2304 3792 i7323435.exe 93 PID 2304 wrote to memory of 1384 2304 oneetx.exe 94 PID 2304 wrote to memory of 1384 2304 oneetx.exe 94 PID 2304 wrote to memory of 1384 2304 oneetx.exe 94 PID 2304 wrote to memory of 4692 2304 oneetx.exe 96 PID 2304 wrote to memory of 4692 2304 oneetx.exe 96 PID 2304 wrote to memory of 4692 2304 oneetx.exe 96 PID 4692 wrote to memory of 5068 4692 cmd.exe 98 PID 4692 wrote to memory of 5068 4692 cmd.exe 98 PID 4692 wrote to memory of 5068 4692 cmd.exe 98 PID 4692 wrote to memory of 2512 4692 cmd.exe 99 PID 4692 wrote to memory of 2512 4692 cmd.exe 99 PID 4692 wrote to memory of 2512 4692 cmd.exe 99 PID 4692 wrote to memory of 1364 4692 cmd.exe 100 PID 4692 wrote to memory of 1364 4692 cmd.exe 100 PID 4692 wrote to memory of 1364 4692 cmd.exe 100 PID 4692 wrote to memory of 4656 4692 cmd.exe 101 PID 4692 wrote to memory of 4656 4692 cmd.exe 101 PID 4692 wrote to memory of 4656 4692 cmd.exe 101 PID 4692 wrote to memory of 2076 4692 cmd.exe 102 PID 4692 wrote to memory of 2076 4692 cmd.exe 102 PID 4692 wrote to memory of 2076 4692 cmd.exe 102 PID 4692 wrote to memory of 4648 4692 cmd.exe 103 PID 4692 wrote to memory of 4648 4692 cmd.exe 103 PID 4692 wrote to memory of 4648 4692 cmd.exe 103 PID 2304 wrote to memory of 5088 2304 oneetx.exe 105 PID 2304 wrote to memory of 5088 2304 oneetx.exe 105 PID 2304 wrote to memory of 5088 2304 oneetx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe"C:\Users\Admin\AppData\Local\Temp\7bb12c2ea8e4979e55eb23e838c9040d169b69565557906dba775e0eeba16e19.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6599042.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6599042.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g8421837.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g8421837.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8935958.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8935958.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7323435.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7323435.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1384
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5068
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2512
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4656
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:2076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4648
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5088
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:3388
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:1352
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
307KB
MD5baf650375833fb92aea27c8d49a5cbbf
SHA1a9897c1c96109658726e2fc9907e492d008eb810
SHA256b16b487610247f0966d6da2e463176f4319cfbd32793fda2247b6a763a19316c
SHA512d319144f4a9fd158ab93c83cf1998cc646f244b5118753f51a89e6755bdaf8dd9c95eebcbf7a9685eae8452df3a489946bacebc4a5bcc0438d43b2a40e7421f7
-
Filesize
307KB
MD5baf650375833fb92aea27c8d49a5cbbf
SHA1a9897c1c96109658726e2fc9907e492d008eb810
SHA256b16b487610247f0966d6da2e463176f4319cfbd32793fda2247b6a763a19316c
SHA512d319144f4a9fd158ab93c83cf1998cc646f244b5118753f51a89e6755bdaf8dd9c95eebcbf7a9685eae8452df3a489946bacebc4a5bcc0438d43b2a40e7421f7
-
Filesize
168KB
MD509932477476113faeb510a4c4008e166
SHA1b56ed17e09928c91952bd8b387320d9855a5c6f7
SHA25680e25f33ff1aad43c6295f88b47aceba8f055288650d0bafb45c77d3519eb147
SHA5126f29b862b31a66c5dc3ccc394e7e061131fc362e1fd47174755a7a3ce3db05d3f291a07daee581df4caf8f46ae9a1b131dde83b77214f7a5572765cf0639258a
-
Filesize
168KB
MD509932477476113faeb510a4c4008e166
SHA1b56ed17e09928c91952bd8b387320d9855a5c6f7
SHA25680e25f33ff1aad43c6295f88b47aceba8f055288650d0bafb45c77d3519eb147
SHA5126f29b862b31a66c5dc3ccc394e7e061131fc362e1fd47174755a7a3ce3db05d3f291a07daee581df4caf8f46ae9a1b131dde83b77214f7a5572765cf0639258a
-
Filesize
178KB
MD54752b6dab3222242f0b86d08aee93299
SHA186d511589ca1bc71af65c160fb3324feb207536b
SHA2562e19a760a7dec25906fe652e94cbb342fd52f9794de94259a3078a142b00eae2
SHA51217bc9efa711dab0abae4d5c536bfc3fdd91bc980475f5ad1e55a78abfb6409548a39cc66593f804bef791175e3335d573e753b9b56d3c58abec20a731657fcfe
-
Filesize
178KB
MD54752b6dab3222242f0b86d08aee93299
SHA186d511589ca1bc71af65c160fb3324feb207536b
SHA2562e19a760a7dec25906fe652e94cbb342fd52f9794de94259a3078a142b00eae2
SHA51217bc9efa711dab0abae4d5c536bfc3fdd91bc980475f5ad1e55a78abfb6409548a39cc66593f804bef791175e3335d573e753b9b56d3c58abec20a731657fcfe
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
209KB
MD5a1582b8d193bf49d62703cdf452bd699
SHA1a331c9995ffd75ec36a6781e1381c28064c022ff
SHA256cfaa74ba0f68f561c3aa25064a62cc387cbf7c540c2dab301c7f09162ed29955
SHA512cb5b9a48f2fd8aef826528387c2e95ae9e39c3de88a7c27ceab4816a50db227f85a7b5ddac58032a7b70595966ddfaf811d1a9b2822a782de304d6696c134e76
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5