Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe
Resource
win10v2004-20230221-en
General
-
Target
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe
-
Size
479KB
-
MD5
f4b837d1e99b0d1c2472e260ebb82c3a
-
SHA1
e29b983e1d429d69851efb852a4405b63a4470b5
-
SHA256
312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787
-
SHA512
0c57f63d4b0d2bfd802b1a8acc669d96c7e9d627d3284855d5350eff566e2ff3c60a86637f60de6531df1172ebce5d26d039534d67666e140c6a778ecf02f0b6
-
SSDEEP
12288:8Mrfy909zkk0aLkHgpEDNLlc6nLaPsmCpr:7y266igCphFaELd
Malware Config
Extracted
redline
divan
217.196.96.102:4132
-
auth_value
b414986bebd7f5a3ec9aee0341b8e769
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k0183561.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k0183561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k0183561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k0183561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k0183561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k0183561.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation m0434198.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 2336 y3007532.exe 4932 k0183561.exe 3860 l7146645.exe 4644 m0434198.exe 4400 oneetx.exe 4548 oneetx.exe 2012 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2324 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k0183561.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k0183561.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y3007532.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3007532.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4816 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4932 k0183561.exe 4932 k0183561.exe 3860 l7146645.exe 3860 l7146645.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4932 k0183561.exe Token: SeDebugPrivilege 3860 l7146645.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4644 m0434198.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2336 4480 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe 83 PID 4480 wrote to memory of 2336 4480 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe 83 PID 4480 wrote to memory of 2336 4480 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe 83 PID 2336 wrote to memory of 4932 2336 y3007532.exe 84 PID 2336 wrote to memory of 4932 2336 y3007532.exe 84 PID 2336 wrote to memory of 4932 2336 y3007532.exe 84 PID 2336 wrote to memory of 3860 2336 y3007532.exe 88 PID 2336 wrote to memory of 3860 2336 y3007532.exe 88 PID 2336 wrote to memory of 3860 2336 y3007532.exe 88 PID 4480 wrote to memory of 4644 4480 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe 89 PID 4480 wrote to memory of 4644 4480 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe 89 PID 4480 wrote to memory of 4644 4480 312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe 89 PID 4644 wrote to memory of 4400 4644 m0434198.exe 90 PID 4644 wrote to memory of 4400 4644 m0434198.exe 90 PID 4644 wrote to memory of 4400 4644 m0434198.exe 90 PID 4400 wrote to memory of 2460 4400 oneetx.exe 91 PID 4400 wrote to memory of 2460 4400 oneetx.exe 91 PID 4400 wrote to memory of 2460 4400 oneetx.exe 91 PID 4400 wrote to memory of 3616 4400 oneetx.exe 93 PID 4400 wrote to memory of 3616 4400 oneetx.exe 93 PID 4400 wrote to memory of 3616 4400 oneetx.exe 93 PID 3616 wrote to memory of 3300 3616 cmd.exe 95 PID 3616 wrote to memory of 3300 3616 cmd.exe 95 PID 3616 wrote to memory of 3300 3616 cmd.exe 95 PID 3616 wrote to memory of 4028 3616 cmd.exe 96 PID 3616 wrote to memory of 4028 3616 cmd.exe 96 PID 3616 wrote to memory of 4028 3616 cmd.exe 96 PID 3616 wrote to memory of 1188 3616 cmd.exe 97 PID 3616 wrote to memory of 1188 3616 cmd.exe 97 PID 3616 wrote to memory of 1188 3616 cmd.exe 97 PID 3616 wrote to memory of 3484 3616 cmd.exe 98 PID 3616 wrote to memory of 3484 3616 cmd.exe 98 PID 3616 wrote to memory of 3484 3616 cmd.exe 98 PID 3616 wrote to memory of 3488 3616 cmd.exe 99 PID 3616 wrote to memory of 3488 3616 cmd.exe 99 PID 3616 wrote to memory of 3488 3616 cmd.exe 99 PID 3616 wrote to memory of 3208 3616 cmd.exe 100 PID 3616 wrote to memory of 3208 3616 cmd.exe 100 PID 3616 wrote to memory of 3208 3616 cmd.exe 100 PID 4400 wrote to memory of 2324 4400 oneetx.exe 106 PID 4400 wrote to memory of 2324 4400 oneetx.exe 106 PID 4400 wrote to memory of 2324 4400 oneetx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe"C:\Users\Admin\AppData\Local\Temp\312fb271db5b9ac082ad3705d4c33d6c37141aeb24f277743212193137531787.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3007532.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3007532.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0183561.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0183561.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7146645.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7146645.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m0434198.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m0434198.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2460
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3300
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4028
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3484
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:3488
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:3208
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2324
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4548
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2012
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:4816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
307KB
MD5318e327afcfdc0fd92c870d69bb34b3b
SHA157e65cc7f9a947813d3f11fa5ec0b5f8daa4c555
SHA2564a98f1c95062d7eb9b403f36fe012c3c6b0485fc9602f6874a424d2ebfb913c5
SHA512f4f218c192d7e19727801f769eb74557b76354a2ba6acfbd0f87f44c906226ab5e3bf26e7d4985de6568f5f0e5659700fe488c8bbdb26b676d381bef6fd6b351
-
Filesize
307KB
MD5318e327afcfdc0fd92c870d69bb34b3b
SHA157e65cc7f9a947813d3f11fa5ec0b5f8daa4c555
SHA2564a98f1c95062d7eb9b403f36fe012c3c6b0485fc9602f6874a424d2ebfb913c5
SHA512f4f218c192d7e19727801f769eb74557b76354a2ba6acfbd0f87f44c906226ab5e3bf26e7d4985de6568f5f0e5659700fe488c8bbdb26b676d381bef6fd6b351
-
Filesize
182KB
MD5694e75af3a8bc31c7ab3dd8abfccac57
SHA106a68dd92b837c3772c30717d5aa69ab6bd94cbb
SHA25696f88769bd88a46c7a5111ea9cbefa10cd91ff026d3641b6e5466f1020a5cfea
SHA51268bf51d1d5b65d6e5701d3ddf81380f4eafab781bc87a418d148930d9503a28f3d696bff5b09c4c4fb0d35e5a754da97d1749eed31b9e850991d832f380b2e37
-
Filesize
182KB
MD5694e75af3a8bc31c7ab3dd8abfccac57
SHA106a68dd92b837c3772c30717d5aa69ab6bd94cbb
SHA25696f88769bd88a46c7a5111ea9cbefa10cd91ff026d3641b6e5466f1020a5cfea
SHA51268bf51d1d5b65d6e5701d3ddf81380f4eafab781bc87a418d148930d9503a28f3d696bff5b09c4c4fb0d35e5a754da97d1749eed31b9e850991d832f380b2e37
-
Filesize
168KB
MD592c3e8964595ed97648ff058331f9f2c
SHA139ca1d58a384b8113ea17405bda59d673c8d2fe5
SHA25647beceaa9ac4405e1a4a6cbccdf4ad90397f0639ab799af8587e26b4ddfd1733
SHA5124d83c5a555bc0495c93947078a7cb333d82b3f8a9d2692af6f22726d7f72500c0db0a316143023c1315270d2b00a399ff0764edaa19049160aa856b5cde25ab2
-
Filesize
168KB
MD592c3e8964595ed97648ff058331f9f2c
SHA139ca1d58a384b8113ea17405bda59d673c8d2fe5
SHA25647beceaa9ac4405e1a4a6cbccdf4ad90397f0639ab799af8587e26b4ddfd1733
SHA5124d83c5a555bc0495c93947078a7cb333d82b3f8a9d2692af6f22726d7f72500c0db0a316143023c1315270d2b00a399ff0764edaa19049160aa856b5cde25ab2
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
212KB
MD5f4747d80d747c21ca263a13ccdfe70da
SHA163263cc0d01f6dff27728a2e2f49b4224ad5a157
SHA256ededd7a869d15326a059a53f42355905a5b238c204e7b91dbccd719199258d37
SHA512b068d22512890514935bf6a51c07789daf221ce38d15c382cb6943cfd59edce4d216f518b7eb7d2f0ba30a2bba290e7afefd9dc943508a33748d7b9d34608d78
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5