Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2023, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe
Resource
win10v2004-20230221-en
General
-
Target
2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe
-
Size
1.0MB
-
MD5
663f25aad82a5880dce8a850284db1ee
-
SHA1
9f30755695dda0e9c5f83b6144e641e6b581de77
-
SHA256
2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15
-
SHA512
71d6dd3d220877986f6855213cef3e350671b058ff8d9c016ff2de8cd412bd56b6fb3287295c6f7237fccf0dc23f45093f60bb73d833f8904e9c744c6344d222
-
SSDEEP
24576:dyT1V74WQUohqIj+lWlHJghaJfBEyTWYUH0uMV7Nnl:4jc1ThqwHJgofJTF4MV7
Malware Config
Extracted
redline
maxa
77.91.124.251:19065
-
auth_value
3c06ec6b3eea9db7536a57bcc13f5bef
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a9416342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a9416342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a9416342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a9416342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a9416342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a9416342.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 4544 v3014609.exe 2164 v3272786.exe 1276 a9416342.exe 4672 b8901319.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a9416342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a9416342.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3014609.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3014609.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3272786.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v3272786.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1276 a9416342.exe 1276 a9416342.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1276 a9416342.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4544 2348 2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe 82 PID 2348 wrote to memory of 4544 2348 2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe 82 PID 2348 wrote to memory of 4544 2348 2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe 82 PID 4544 wrote to memory of 2164 4544 v3014609.exe 83 PID 4544 wrote to memory of 2164 4544 v3014609.exe 83 PID 4544 wrote to memory of 2164 4544 v3014609.exe 83 PID 2164 wrote to memory of 1276 2164 v3272786.exe 84 PID 2164 wrote to memory of 1276 2164 v3272786.exe 84 PID 2164 wrote to memory of 1276 2164 v3272786.exe 84 PID 2164 wrote to memory of 4672 2164 v3272786.exe 85 PID 2164 wrote to memory of 4672 2164 v3272786.exe 85 PID 2164 wrote to memory of 4672 2164 v3272786.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe"C:\Users\Admin\AppData\Local\Temp\2ffc593536c148006089228f17ec90d9f794ba6797723555cbd4d9940d6eda15.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3014609.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3014609.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3272786.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3272786.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9416342.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9416342.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8901319.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8901319.exe4⤵
- Executes dropped EXE
PID:4672
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
751KB
MD5a344f1b3319584d3e84f14ad717870d6
SHA1ac3c7b7ef97d86fa4fd52bb1eeb64a25e9b01057
SHA256078f61aacf1a3ea4d622e60425e64b7dd891aa8e9160cc528dbda200a3aab06d
SHA51243e5c9bd9e145b8b2a896f85e396babc8289f15c7ab1463ee3256d1af03c39dc16ca8aad7975b871ef492b0e387e4c36879494926fb999d37d56c9846341cd0b
-
Filesize
751KB
MD5a344f1b3319584d3e84f14ad717870d6
SHA1ac3c7b7ef97d86fa4fd52bb1eeb64a25e9b01057
SHA256078f61aacf1a3ea4d622e60425e64b7dd891aa8e9160cc528dbda200a3aab06d
SHA51243e5c9bd9e145b8b2a896f85e396babc8289f15c7ab1463ee3256d1af03c39dc16ca8aad7975b871ef492b0e387e4c36879494926fb999d37d56c9846341cd0b
-
Filesize
305KB
MD5a3a97785fa1ccf6cf9438016791b92f3
SHA17516c603fd2826cbb3f3f40885ec9b8e3ccf5e1f
SHA256b26b8945da9330eb1815cf9c47e6732d7df81ec8eb516f5c44d37269937ec1c4
SHA512763fdc02e1b304f059ec4cfd2f04a95efe503486fb3cff5ae711c2344451cf7747fddd5415f3c448eca407d5ad66ce1ef2b702c359c0155d526cb2012fa02ad8
-
Filesize
305KB
MD5a3a97785fa1ccf6cf9438016791b92f3
SHA17516c603fd2826cbb3f3f40885ec9b8e3ccf5e1f
SHA256b26b8945da9330eb1815cf9c47e6732d7df81ec8eb516f5c44d37269937ec1c4
SHA512763fdc02e1b304f059ec4cfd2f04a95efe503486fb3cff5ae711c2344451cf7747fddd5415f3c448eca407d5ad66ce1ef2b702c359c0155d526cb2012fa02ad8
-
Filesize
184KB
MD52ceefc4686731187b8be2fc731207507
SHA1285db8ab25c9928d87ac65f641b2c507058f4486
SHA256a2d5549df795483eb88175f497c78cf3bd7ba95be55f1c8fe107f057b2eda9f5
SHA5120fc903ef97a423638acd44fbe59480edab18ba56d6e324d588057e74a585b5247950b757b9363f1ccb8a68d097870db893909971a6b6f600fe7e93ad62c9fa25
-
Filesize
184KB
MD52ceefc4686731187b8be2fc731207507
SHA1285db8ab25c9928d87ac65f641b2c507058f4486
SHA256a2d5549df795483eb88175f497c78cf3bd7ba95be55f1c8fe107f057b2eda9f5
SHA5120fc903ef97a423638acd44fbe59480edab18ba56d6e324d588057e74a585b5247950b757b9363f1ccb8a68d097870db893909971a6b6f600fe7e93ad62c9fa25
-
Filesize
145KB
MD5876a9648c5ef81adeab0e3150cd80115
SHA19521d9c0231c1d253840ef1d8552cdc966c02166
SHA256c28fa4cee88d9f862c2d6484dcc402156541b837b6a874d1a4848f2d08d2e0fe
SHA512321ee1a84abbe42d1efcfb556f851146c5917e6c45857ab691a5ceeed3fe361ec4b9fae60642d2c5b8ecf0cee624eedf0b60d5ba6af66f225d35551b532302ab
-
Filesize
145KB
MD5876a9648c5ef81adeab0e3150cd80115
SHA19521d9c0231c1d253840ef1d8552cdc966c02166
SHA256c28fa4cee88d9f862c2d6484dcc402156541b837b6a874d1a4848f2d08d2e0fe
SHA512321ee1a84abbe42d1efcfb556f851146c5917e6c45857ab691a5ceeed3fe361ec4b9fae60642d2c5b8ecf0cee624eedf0b60d5ba6af66f225d35551b532302ab