Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2023, 08:36

General

  • Target

    312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe

  • Size

    479KB

  • MD5

    f4b837d1e99b0d1c2472e260ebb82c3a

  • SHA1

    e29b983e1d429d69851efb852a4405b63a4470b5

  • SHA256

    312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787

  • SHA512

    0c57f63d4b0d2bfd802b1a8acc669d96c7e9d627d3284855d5350eff566e2ff3c60a86637f60de6531df1172ebce5d26d039534d67666e140c6a778ecf02f0b6

  • SSDEEP

    12288:8Mrfy909zkk0aLkHgpEDNLlc6nLaPsmCpr:7y266igCphFaELd

Malware Config

Extracted

Family

redline

Botnet

divan

C2

217.196.96.102:4132

Attributes
  • auth_value

    b414986bebd7f5a3ec9aee0341b8e769

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe
    "C:\Users\Admin\AppData\Local\Temp\312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3007532.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3007532.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0183561.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0183561.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7146645.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7146645.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3860
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m0434198.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m0434198.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2460
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3300
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:4028
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:1188
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3484
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:3488
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:3208
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:2324
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:4548
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:2012
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe start wuauserv
                1⤵
                • Launches sc.exe
                PID:4816

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m0434198.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m0434198.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3007532.exe

                Filesize

                307KB

                MD5

                318e327afcfdc0fd92c870d69bb34b3b

                SHA1

                57e65cc7f9a947813d3f11fa5ec0b5f8daa4c555

                SHA256

                4a98f1c95062d7eb9b403f36fe012c3c6b0485fc9602f6874a424d2ebfb913c5

                SHA512

                f4f218c192d7e19727801f769eb74557b76354a2ba6acfbd0f87f44c906226ab5e3bf26e7d4985de6568f5f0e5659700fe488c8bbdb26b676d381bef6fd6b351

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3007532.exe

                Filesize

                307KB

                MD5

                318e327afcfdc0fd92c870d69bb34b3b

                SHA1

                57e65cc7f9a947813d3f11fa5ec0b5f8daa4c555

                SHA256

                4a98f1c95062d7eb9b403f36fe012c3c6b0485fc9602f6874a424d2ebfb913c5

                SHA512

                f4f218c192d7e19727801f769eb74557b76354a2ba6acfbd0f87f44c906226ab5e3bf26e7d4985de6568f5f0e5659700fe488c8bbdb26b676d381bef6fd6b351

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0183561.exe

                Filesize

                182KB

                MD5

                694e75af3a8bc31c7ab3dd8abfccac57

                SHA1

                06a68dd92b837c3772c30717d5aa69ab6bd94cbb

                SHA256

                96f88769bd88a46c7a5111ea9cbefa10cd91ff026d3641b6e5466f1020a5cfea

                SHA512

                68bf51d1d5b65d6e5701d3ddf81380f4eafab781bc87a418d148930d9503a28f3d696bff5b09c4c4fb0d35e5a754da97d1749eed31b9e850991d832f380b2e37

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0183561.exe

                Filesize

                182KB

                MD5

                694e75af3a8bc31c7ab3dd8abfccac57

                SHA1

                06a68dd92b837c3772c30717d5aa69ab6bd94cbb

                SHA256

                96f88769bd88a46c7a5111ea9cbefa10cd91ff026d3641b6e5466f1020a5cfea

                SHA512

                68bf51d1d5b65d6e5701d3ddf81380f4eafab781bc87a418d148930d9503a28f3d696bff5b09c4c4fb0d35e5a754da97d1749eed31b9e850991d832f380b2e37

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7146645.exe

                Filesize

                168KB

                MD5

                92c3e8964595ed97648ff058331f9f2c

                SHA1

                39ca1d58a384b8113ea17405bda59d673c8d2fe5

                SHA256

                47beceaa9ac4405e1a4a6cbccdf4ad90397f0639ab799af8587e26b4ddfd1733

                SHA512

                4d83c5a555bc0495c93947078a7cb333d82b3f8a9d2692af6f22726d7f72500c0db0a316143023c1315270d2b00a399ff0764edaa19049160aa856b5cde25ab2

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7146645.exe

                Filesize

                168KB

                MD5

                92c3e8964595ed97648ff058331f9f2c

                SHA1

                39ca1d58a384b8113ea17405bda59d673c8d2fe5

                SHA256

                47beceaa9ac4405e1a4a6cbccdf4ad90397f0639ab799af8587e26b4ddfd1733

                SHA512

                4d83c5a555bc0495c93947078a7cb333d82b3f8a9d2692af6f22726d7f72500c0db0a316143023c1315270d2b00a399ff0764edaa19049160aa856b5cde25ab2

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                212KB

                MD5

                f4747d80d747c21ca263a13ccdfe70da

                SHA1

                63263cc0d01f6dff27728a2e2f49b4224ad5a157

                SHA256

                ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37

                SHA512

                b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/3860-194-0x000000000CBA0000-0x000000000D0CC000-memory.dmp

                Filesize

                5.2MB

              • memory/3860-187-0x000000000AB50000-0x000000000AB62000-memory.dmp

                Filesize

                72KB

              • memory/3860-195-0x000000000BE10000-0x000000000BE60000-memory.dmp

                Filesize

                320KB

              • memory/3860-193-0x000000000BEF0000-0x000000000C0B2000-memory.dmp

                Filesize

                1.8MB

              • memory/3860-192-0x000000000B030000-0x000000000B096000-memory.dmp

                Filesize

                408KB

              • memory/3860-191-0x000000000B770000-0x000000000B802000-memory.dmp

                Filesize

                584KB

              • memory/3860-190-0x000000000AEB0000-0x000000000AF26000-memory.dmp

                Filesize

                472KB

              • memory/3860-189-0x00000000056A0000-0x00000000056B0000-memory.dmp

                Filesize

                64KB

              • memory/3860-188-0x000000000ABB0000-0x000000000ABEC000-memory.dmp

                Filesize

                240KB

              • memory/3860-184-0x0000000000C90000-0x0000000000CBE000-memory.dmp

                Filesize

                184KB

              • memory/3860-185-0x000000000B150000-0x000000000B768000-memory.dmp

                Filesize

                6.1MB

              • memory/3860-186-0x000000000AC40000-0x000000000AD4A000-memory.dmp

                Filesize

                1.0MB

              • memory/4932-169-0x00000000026A0000-0x00000000026B0000-memory.dmp

                Filesize

                64KB

              • memory/4932-165-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-171-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-180-0x00000000026A0000-0x00000000026B0000-memory.dmp

                Filesize

                64KB

              • memory/4932-178-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-176-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-174-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-167-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-170-0x00000000026A0000-0x00000000026B0000-memory.dmp

                Filesize

                64KB

              • memory/4932-173-0x00000000026A0000-0x00000000026B0000-memory.dmp

                Filesize

                64KB

              • memory/4932-163-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-161-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-159-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-157-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-155-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-153-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-151-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-148-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-149-0x0000000002640000-0x0000000002652000-memory.dmp

                Filesize

                72KB

              • memory/4932-147-0x0000000004B10000-0x00000000050B4000-memory.dmp

                Filesize

                5.6MB