Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2023, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe
Resource
win10v2004-20230220-en
General
-
Target
290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe
-
Size
480KB
-
MD5
aa66098e9f891d6c13053e7170c0b323
-
SHA1
94a442f3b1445151e7b658f35a9ff0b27b7e658a
-
SHA256
290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c
-
SHA512
6d88c3e1dace0c74e64b82a46b0d25bf8973136001589d6379e7034b7956a37b03087906d2634468e452bbc04aa7fa07b6cd7fc80077f145f40c5753d921d39a
-
SSDEEP
12288:IMrXy90Mw67SLPr6S9XjqOG7INlfAI3WRaqAFlNR:PyxO+S9RfNlfA8WRt2T
Malware Config
Extracted
redline
mihan
217.196.96.101:4132
-
auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a9687394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a9687394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a9687394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a9687394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a9687394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a9687394.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation d4401267.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 1128 v4932365.exe 2284 a9687394.exe 3992 b4078943.exe 4144 d4401267.exe 4560 oneetx.exe 5072 oneetx.exe 4432 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4464 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a9687394.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a9687394.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4932365.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v4932365.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2860 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2872 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2284 a9687394.exe 2284 a9687394.exe 3992 b4078943.exe 3992 b4078943.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2284 a9687394.exe Token: SeDebugPrivilege 3992 b4078943.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4144 d4401267.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 676 wrote to memory of 1128 676 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe 85 PID 676 wrote to memory of 1128 676 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe 85 PID 676 wrote to memory of 1128 676 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe 85 PID 1128 wrote to memory of 2284 1128 v4932365.exe 86 PID 1128 wrote to memory of 2284 1128 v4932365.exe 86 PID 1128 wrote to memory of 2284 1128 v4932365.exe 86 PID 1128 wrote to memory of 3992 1128 v4932365.exe 90 PID 1128 wrote to memory of 3992 1128 v4932365.exe 90 PID 1128 wrote to memory of 3992 1128 v4932365.exe 90 PID 676 wrote to memory of 4144 676 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe 91 PID 676 wrote to memory of 4144 676 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe 91 PID 676 wrote to memory of 4144 676 290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe 91 PID 4144 wrote to memory of 4560 4144 d4401267.exe 92 PID 4144 wrote to memory of 4560 4144 d4401267.exe 92 PID 4144 wrote to memory of 4560 4144 d4401267.exe 92 PID 4560 wrote to memory of 2872 4560 oneetx.exe 93 PID 4560 wrote to memory of 2872 4560 oneetx.exe 93 PID 4560 wrote to memory of 2872 4560 oneetx.exe 93 PID 4560 wrote to memory of 4640 4560 oneetx.exe 95 PID 4560 wrote to memory of 4640 4560 oneetx.exe 95 PID 4560 wrote to memory of 4640 4560 oneetx.exe 95 PID 4640 wrote to memory of 2480 4640 cmd.exe 97 PID 4640 wrote to memory of 2480 4640 cmd.exe 97 PID 4640 wrote to memory of 2480 4640 cmd.exe 97 PID 4640 wrote to memory of 4292 4640 cmd.exe 98 PID 4640 wrote to memory of 4292 4640 cmd.exe 98 PID 4640 wrote to memory of 4292 4640 cmd.exe 98 PID 4640 wrote to memory of 1596 4640 cmd.exe 99 PID 4640 wrote to memory of 1596 4640 cmd.exe 99 PID 4640 wrote to memory of 1596 4640 cmd.exe 99 PID 4640 wrote to memory of 2940 4640 cmd.exe 100 PID 4640 wrote to memory of 2940 4640 cmd.exe 100 PID 4640 wrote to memory of 2940 4640 cmd.exe 100 PID 4640 wrote to memory of 4828 4640 cmd.exe 101 PID 4640 wrote to memory of 4828 4640 cmd.exe 101 PID 4640 wrote to memory of 4828 4640 cmd.exe 101 PID 4640 wrote to memory of 4044 4640 cmd.exe 102 PID 4640 wrote to memory of 4044 4640 cmd.exe 102 PID 4640 wrote to memory of 4044 4640 cmd.exe 102 PID 4560 wrote to memory of 4464 4560 oneetx.exe 109 PID 4560 wrote to memory of 4464 4560 oneetx.exe 109 PID 4560 wrote to memory of 4464 4560 oneetx.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe"C:\Users\Admin\AppData\Local\Temp\290dba13865fe0b5fd9519b5aeb8333f3c2a980bcf1e826cd8bff09da8c4b60c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4932365.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4932365.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a9687394.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a9687394.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4078943.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4078943.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4401267.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4401267.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2872
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2480
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4292
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2940
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4828
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4044
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4464
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:5072
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4432
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:2860
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
309KB
MD5205ffc99a74c4ffa8e5d18be11c5d739
SHA1f35db221a80f20c533d38a7aec7d9df2059ec499
SHA256004e901ef74328e3589b75a40d33e39af34cdbb40c9b8621424db4274e0d759a
SHA5127bfe644a5d09f13f58e5c8b98c2f9176c36e0c854633e62fb0d37a8101f471527ede8286bceb1a1ef2c07bf3b24ecf8e90dc712d5ea35fca1bd4336399cbe350
-
Filesize
309KB
MD5205ffc99a74c4ffa8e5d18be11c5d739
SHA1f35db221a80f20c533d38a7aec7d9df2059ec499
SHA256004e901ef74328e3589b75a40d33e39af34cdbb40c9b8621424db4274e0d759a
SHA5127bfe644a5d09f13f58e5c8b98c2f9176c36e0c854633e62fb0d37a8101f471527ede8286bceb1a1ef2c07bf3b24ecf8e90dc712d5ea35fca1bd4336399cbe350
-
Filesize
179KB
MD57fc586905334fff9cb3e3896b2b9a6d1
SHA120176720c780ac43637e5bd52c62cd3da1c0a6cd
SHA25617007e0d706918208ab79a636b714fc43d999bd40dc9b6f99b308131079813ba
SHA5123d0012e161796c3507cf143f8152382b9a366eb85395981256349eac95df50e200615d5f706f64f498ac52334b50cb850b0c1510cf5d96c20c822e5d1b97588b
-
Filesize
179KB
MD57fc586905334fff9cb3e3896b2b9a6d1
SHA120176720c780ac43637e5bd52c62cd3da1c0a6cd
SHA25617007e0d706918208ab79a636b714fc43d999bd40dc9b6f99b308131079813ba
SHA5123d0012e161796c3507cf143f8152382b9a366eb85395981256349eac95df50e200615d5f706f64f498ac52334b50cb850b0c1510cf5d96c20c822e5d1b97588b
-
Filesize
168KB
MD5962a97b92200305c8615657417bff5e1
SHA1ce7d14434ace644534ab19f74d30cc491a33c1a4
SHA25608adedd9905812592e778b45da954ebf197c00bce551583a5cdaa6d7e1e5f797
SHA512c61590563e0c8ed9d1840ce0e5c8bedc53aa2f9105fae3741fc2c818eb4fc9e470180da5e465b7165331ae359caaf4d48954ca556cddbcdfa0492cc9a78c48f2
-
Filesize
168KB
MD5962a97b92200305c8615657417bff5e1
SHA1ce7d14434ace644534ab19f74d30cc491a33c1a4
SHA25608adedd9905812592e778b45da954ebf197c00bce551583a5cdaa6d7e1e5f797
SHA512c61590563e0c8ed9d1840ce0e5c8bedc53aa2f9105fae3741fc2c818eb4fc9e470180da5e465b7165331ae359caaf4d48954ca556cddbcdfa0492cc9a78c48f2
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
210KB
MD5f51c513b14e879a3e0c68a7268aa8669
SHA13f3f8242c311a882a255bc825357e4557643f686
SHA256c83c5b2128f9e2c464c020b0f708bb940871614b1174ec5a12d933fec462fadf
SHA512ef172f6f38c9274b5bc63458b39d509ea61b13e86e7da06b5af74818c029958f66b3b74446512a9652de62320aa81d3120e0d0495af2a775be96b592a49bd23a
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5