Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2023, 18:34
Static task
static1
Behavioral task
behavioral1
Sample
c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe
Resource
win10v2004-20230220-en
General
-
Target
c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe
-
Size
479KB
-
MD5
1e332bf2f450ec03f8af4bf4d167ecc0
-
SHA1
15d3f160079ff0287835743092449cc3bf73ad24
-
SHA256
c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338
-
SHA512
c7231d02677d01471a1b4ea4e1976f312483853132cfbe302c2b5c7ea6f96f7abb7b15e39569d373f20f1cf489de1e15ea6b668c5cc60e67ec0584b0b38cb8b7
-
SSDEEP
12288:5MrWy90cALnqt8n+Qr5f/8oV97WvFV8Zx:Dy3hq+Qh/PY0
Malware Config
Extracted
redline
murka
217.196.96.101:4132
-
auth_value
878a0681ac6ad0e4eb10ef9db07abdd9
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a7239400.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a7239400.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a7239400.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a7239400.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a7239400.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a7239400.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation d3348966.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 1112 v4118595.exe 4404 a7239400.exe 1072 b3647477.exe 1876 d3348966.exe 220 oneetx.exe 2076 oneetx.exe 5024 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4868 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a7239400.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a7239400.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v4118595.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v4118595.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4404 a7239400.exe 4404 a7239400.exe 1072 b3647477.exe 1072 b3647477.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4404 a7239400.exe Token: SeDebugPrivilege 1072 b3647477.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1876 d3348966.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3888 wrote to memory of 1112 3888 c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe 80 PID 3888 wrote to memory of 1112 3888 c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe 80 PID 3888 wrote to memory of 1112 3888 c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe 80 PID 1112 wrote to memory of 4404 1112 v4118595.exe 81 PID 1112 wrote to memory of 4404 1112 v4118595.exe 81 PID 1112 wrote to memory of 4404 1112 v4118595.exe 81 PID 1112 wrote to memory of 1072 1112 v4118595.exe 84 PID 1112 wrote to memory of 1072 1112 v4118595.exe 84 PID 1112 wrote to memory of 1072 1112 v4118595.exe 84 PID 3888 wrote to memory of 1876 3888 c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe 85 PID 3888 wrote to memory of 1876 3888 c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe 85 PID 3888 wrote to memory of 1876 3888 c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe 85 PID 1876 wrote to memory of 220 1876 d3348966.exe 86 PID 1876 wrote to memory of 220 1876 d3348966.exe 86 PID 1876 wrote to memory of 220 1876 d3348966.exe 86 PID 220 wrote to memory of 4672 220 oneetx.exe 87 PID 220 wrote to memory of 4672 220 oneetx.exe 87 PID 220 wrote to memory of 4672 220 oneetx.exe 87 PID 220 wrote to memory of 4364 220 oneetx.exe 89 PID 220 wrote to memory of 4364 220 oneetx.exe 89 PID 220 wrote to memory of 4364 220 oneetx.exe 89 PID 4364 wrote to memory of 4956 4364 cmd.exe 91 PID 4364 wrote to memory of 4956 4364 cmd.exe 91 PID 4364 wrote to memory of 4956 4364 cmd.exe 91 PID 4364 wrote to memory of 1456 4364 cmd.exe 92 PID 4364 wrote to memory of 1456 4364 cmd.exe 92 PID 4364 wrote to memory of 1456 4364 cmd.exe 92 PID 4364 wrote to memory of 4996 4364 cmd.exe 93 PID 4364 wrote to memory of 4996 4364 cmd.exe 93 PID 4364 wrote to memory of 4996 4364 cmd.exe 93 PID 4364 wrote to memory of 5000 4364 cmd.exe 94 PID 4364 wrote to memory of 5000 4364 cmd.exe 94 PID 4364 wrote to memory of 5000 4364 cmd.exe 94 PID 4364 wrote to memory of 3904 4364 cmd.exe 95 PID 4364 wrote to memory of 3904 4364 cmd.exe 95 PID 4364 wrote to memory of 3904 4364 cmd.exe 95 PID 4364 wrote to memory of 4416 4364 cmd.exe 96 PID 4364 wrote to memory of 4416 4364 cmd.exe 96 PID 4364 wrote to memory of 4416 4364 cmd.exe 96 PID 220 wrote to memory of 4868 220 oneetx.exe 98 PID 220 wrote to memory of 4868 220 oneetx.exe 98 PID 220 wrote to memory of 4868 220 oneetx.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe"C:\Users\Admin\AppData\Local\Temp\c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4118595.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4118595.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7239400.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7239400.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3647477.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3647477.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3348966.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3348966.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4672
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4956
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1456
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5000
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:3904
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4416
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4868
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2076
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:5024
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
307KB
MD51efa290b73fb39731bebaee08a850f1b
SHA16821b1fe18a46f9f1a1aa3035dbd8a86b767781f
SHA256c039f39a928a977f885935a55f092d1b7067373c1271901bf2ef38a0836c16a2
SHA512dd2a35be6135ce254272463c8c37d93c25c8e32dfd892f2215449748e3ed37d59cf4dcbc29f31039d44e1c1d3d5ff8b30a5584129f2e33b6900679ad11b9e0f4
-
Filesize
307KB
MD51efa290b73fb39731bebaee08a850f1b
SHA16821b1fe18a46f9f1a1aa3035dbd8a86b767781f
SHA256c039f39a928a977f885935a55f092d1b7067373c1271901bf2ef38a0836c16a2
SHA512dd2a35be6135ce254272463c8c37d93c25c8e32dfd892f2215449748e3ed37d59cf4dcbc29f31039d44e1c1d3d5ff8b30a5584129f2e33b6900679ad11b9e0f4
-
Filesize
181KB
MD5ef8f4bef6490a940b23c702ed8bb53c2
SHA1f04d31230b3d75bcff14ad9142963317cb3c7eed
SHA2560e18b78490fb2362e37ece4ae7f5a6dcdea7742a0f7abb66352c08f63c7157a4
SHA512a4378730b274b7b15db2a14c246bb5f64889540ed0611cab2a02be9ae473ea175798db1e19e4cfe05bbb89773dc659f681be8bc907e2d4ee89660142440bd15b
-
Filesize
181KB
MD5ef8f4bef6490a940b23c702ed8bb53c2
SHA1f04d31230b3d75bcff14ad9142963317cb3c7eed
SHA2560e18b78490fb2362e37ece4ae7f5a6dcdea7742a0f7abb66352c08f63c7157a4
SHA512a4378730b274b7b15db2a14c246bb5f64889540ed0611cab2a02be9ae473ea175798db1e19e4cfe05bbb89773dc659f681be8bc907e2d4ee89660142440bd15b
-
Filesize
168KB
MD520ce3f79e6e81d7cce0fc80cf38ebe7b
SHA11a0f6a77a43cbaeaa7928ba9e3d4e4792a8c853e
SHA2561d7365524aded881b100ef8b747254dcc83a1470bb22c61cf29a2b919051c48b
SHA5123068ea11e21c6b528558de8ed1602e165a2e65209eee22cfec0cb96d3cced2b98c78e691e6c1e50c78de8114acd5a332ae6b720409dcb81ba7012a1ee0d088ab
-
Filesize
168KB
MD520ce3f79e6e81d7cce0fc80cf38ebe7b
SHA11a0f6a77a43cbaeaa7928ba9e3d4e4792a8c853e
SHA2561d7365524aded881b100ef8b747254dcc83a1470bb22c61cf29a2b919051c48b
SHA5123068ea11e21c6b528558de8ed1602e165a2e65209eee22cfec0cb96d3cced2b98c78e691e6c1e50c78de8114acd5a332ae6b720409dcb81ba7012a1ee0d088ab
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
211KB
MD5eaaf8479a31099a0e38c1135ea543ca8
SHA13b3ad9dbca4148ee4371ccf9dc91e63e711c0c13
SHA256fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37
SHA5125da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5