Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2023, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe
Resource
win10v2004-20230220-en
General
-
Target
c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe
-
Size
479KB
-
MD5
b9a20ab11cf1128391d6809d2199e159
-
SHA1
b91ed9a3a63ed3b4619ce71a99170dd3d028d89e
-
SHA256
c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c
-
SHA512
fc2c4430fe90e220ef8466f6202fa054f3dcc5fe149e71dacf47cfa231d7d94a1038114fa71256a0921554b7cbbbce40a887e2d6aab2d90bf23facb9b44dfe56
-
SSDEEP
12288:rMrky90+0ttarh2oa1bH/0cuMF2MkyvtYu/HZlGoo0dudHoL:PyNAtarpQvtr2oL
Malware Config
Extracted
redline
morty
217.196.96.101:4132
-
auth_value
fe1a24c211cc8e5bf9ff11c737ce0e97
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a2114016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a2114016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a2114016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a2114016.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a2114016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a2114016.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation d3733636.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 3440 v5298421.exe 800 a2114016.exe 2572 b0633387.exe 5100 d3733636.exe 4288 oneetx.exe 4352 oneetx.exe 4624 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4768 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a2114016.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a2114016.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5298421.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v5298421.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3836 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 800 a2114016.exe 800 a2114016.exe 2572 b0633387.exe 2572 b0633387.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 800 a2114016.exe Token: SeDebugPrivilege 2572 b0633387.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5100 d3733636.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1988 wrote to memory of 3440 1988 c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe 83 PID 1988 wrote to memory of 3440 1988 c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe 83 PID 1988 wrote to memory of 3440 1988 c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe 83 PID 3440 wrote to memory of 800 3440 v5298421.exe 84 PID 3440 wrote to memory of 800 3440 v5298421.exe 84 PID 3440 wrote to memory of 800 3440 v5298421.exe 84 PID 3440 wrote to memory of 2572 3440 v5298421.exe 88 PID 3440 wrote to memory of 2572 3440 v5298421.exe 88 PID 3440 wrote to memory of 2572 3440 v5298421.exe 88 PID 1988 wrote to memory of 5100 1988 c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe 89 PID 1988 wrote to memory of 5100 1988 c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe 89 PID 1988 wrote to memory of 5100 1988 c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe 89 PID 5100 wrote to memory of 4288 5100 d3733636.exe 90 PID 5100 wrote to memory of 4288 5100 d3733636.exe 90 PID 5100 wrote to memory of 4288 5100 d3733636.exe 90 PID 4288 wrote to memory of 3836 4288 oneetx.exe 91 PID 4288 wrote to memory of 3836 4288 oneetx.exe 91 PID 4288 wrote to memory of 3836 4288 oneetx.exe 91 PID 4288 wrote to memory of 1428 4288 oneetx.exe 93 PID 4288 wrote to memory of 1428 4288 oneetx.exe 93 PID 4288 wrote to memory of 1428 4288 oneetx.exe 93 PID 1428 wrote to memory of 3436 1428 cmd.exe 95 PID 1428 wrote to memory of 3436 1428 cmd.exe 95 PID 1428 wrote to memory of 3436 1428 cmd.exe 95 PID 1428 wrote to memory of 4072 1428 cmd.exe 96 PID 1428 wrote to memory of 4072 1428 cmd.exe 96 PID 1428 wrote to memory of 4072 1428 cmd.exe 96 PID 1428 wrote to memory of 388 1428 cmd.exe 97 PID 1428 wrote to memory of 388 1428 cmd.exe 97 PID 1428 wrote to memory of 388 1428 cmd.exe 97 PID 1428 wrote to memory of 3820 1428 cmd.exe 98 PID 1428 wrote to memory of 3820 1428 cmd.exe 98 PID 1428 wrote to memory of 3820 1428 cmd.exe 98 PID 1428 wrote to memory of 3996 1428 cmd.exe 99 PID 1428 wrote to memory of 3996 1428 cmd.exe 99 PID 1428 wrote to memory of 3996 1428 cmd.exe 99 PID 1428 wrote to memory of 3884 1428 cmd.exe 100 PID 1428 wrote to memory of 3884 1428 cmd.exe 100 PID 1428 wrote to memory of 3884 1428 cmd.exe 100 PID 4288 wrote to memory of 4768 4288 oneetx.exe 106 PID 4288 wrote to memory of 4768 4288 oneetx.exe 106 PID 4288 wrote to memory of 4768 4288 oneetx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe"C:\Users\Admin\AppData\Local\Temp\c39bcda1643a9b9a4dad0bb7e3a8c66df8865619a3e3d1212aa61effdf3a4c7c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5298421.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5298421.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2114016.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2114016.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0633387.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0633387.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3733636.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3733636.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3836
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3436
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4072
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:388
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3820
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:3996
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:3884
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4768
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4352
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
307KB
MD5fa2fa554d6977c5f864b67ac8a0ea544
SHA124d8a848439d3a15de74f990cecab3fc8608bf16
SHA256321a5a1021e4b5295617882f288b1a98e85df364624a560849060dd4b41afd05
SHA512fc1c52623597e7945a8bfc7a84de2fb20010706eda870cc70de755b521ec8b5c82c41b869d9bc74515ce57d57c9599b9bec88c5c481700bc95792ed38583a7d1
-
Filesize
307KB
MD5fa2fa554d6977c5f864b67ac8a0ea544
SHA124d8a848439d3a15de74f990cecab3fc8608bf16
SHA256321a5a1021e4b5295617882f288b1a98e85df364624a560849060dd4b41afd05
SHA512fc1c52623597e7945a8bfc7a84de2fb20010706eda870cc70de755b521ec8b5c82c41b869d9bc74515ce57d57c9599b9bec88c5c481700bc95792ed38583a7d1
-
Filesize
178KB
MD50a6093c054c86fbe5db6ae39039a3a9a
SHA1e69e4fb74b868e917dfa72aa836f17814b6c3568
SHA25647da73d177d6774ab9a2581768d70cf3ff32a6f5fdb17c23f44036c6e6ff10bb
SHA512f90ac9ada0e68b64f692b12072ef1c4ca9789a122cf315360979ed6a4363bfd475faf25a3bd37ae8c7a9cec47c759ce3dc2cb61bfb0c8303d645b622282ffa56
-
Filesize
178KB
MD50a6093c054c86fbe5db6ae39039a3a9a
SHA1e69e4fb74b868e917dfa72aa836f17814b6c3568
SHA25647da73d177d6774ab9a2581768d70cf3ff32a6f5fdb17c23f44036c6e6ff10bb
SHA512f90ac9ada0e68b64f692b12072ef1c4ca9789a122cf315360979ed6a4363bfd475faf25a3bd37ae8c7a9cec47c759ce3dc2cb61bfb0c8303d645b622282ffa56
-
Filesize
168KB
MD51fa4413854d10fabf6f1586b87846516
SHA15876ffdc7325562da212bfb0bb33c0768af1141a
SHA256bef2d359e9757379d16c348c8b7348f7603a29857873bc4defbbb33e0cc924fa
SHA5128b3546f3ea79067b63cb5d6ce75397ba9d2b1e481a459d4cd72e2f7490f4a78b8e736654ff03320e8ceac3c47efec7b7b61097211f47906498bb4f4a8ba5ff8c
-
Filesize
168KB
MD51fa4413854d10fabf6f1586b87846516
SHA15876ffdc7325562da212bfb0bb33c0768af1141a
SHA256bef2d359e9757379d16c348c8b7348f7603a29857873bc4defbbb33e0cc924fa
SHA5128b3546f3ea79067b63cb5d6ce75397ba9d2b1e481a459d4cd72e2f7490f4a78b8e736654ff03320e8ceac3c47efec7b7b61097211f47906498bb4f4a8ba5ff8c
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
209KB
MD54c71cbdc82c8ff83ef729b8081c24b2b
SHA1e48cd1915908f131e40f91fff203073470d16388
SHA256c9b88fd87f10311a254a7857cd76f6a44fb3869b7bf7a73b2bf4cdf4495e17c8
SHA5121087c33a22aeb00877f4e9d2c54fe5b73ed011dde8a6c85841f75644fb2a06746fe8aa86f86dd4f3df4a6ef74f59dc285a8b8b588eb9f02691098ad549f008e4
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5