Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2023, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe
Resource
win10v2004-20230220-en
General
-
Target
d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe
-
Size
872KB
-
MD5
c49efa26968f3fd42e137fc67165627e
-
SHA1
20f9a5cdc2a18b3f8547a96529e46a458e3e0596
-
SHA256
d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b
-
SHA512
6583197391fe879a311d0f31d967c3b29362fc7a236ab42b67d58d542405d454e6173fa67681fa99d7dbafe303cfc3c9b4dcba6b9f47f95566371b39a30b3ca7
-
SSDEEP
12288:AMrwy900EgqYwKha9isr3ueSVeovoitevqkBImOu3YpnmMUo02GnQK09:AynEiNh6Zr3PioqBmOu3qbcQb9
Malware Config
Extracted
redline
maxi
83.97.73.122:19062
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
mesu
83.97.73.122:19062
-
auth_value
8ede6a157d1d9509a21427d10e999ba2
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 220 v9573103.exe 1192 v1705726.exe 644 a3352897.exe 4756 b1070128.exe 4772 c3454719.exe 2956 d3994649.exe 1140 oneetx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v9573103.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v9573103.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v1705726.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v1705726.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 644 set thread context of 4328 644 a3352897.exe 88 PID 4772 set thread context of 3112 4772 c3454719.exe 92 PID 2956 set thread context of 1872 2956 d3994649.exe 95 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4328 AppLaunch.exe 4328 AppLaunch.exe 4756 b1070128.exe 4756 b1070128.exe 1872 AppLaunch.exe 1872 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4328 AppLaunch.exe Token: SeDebugPrivilege 4756 b1070128.exe Token: SeDebugPrivilege 1872 AppLaunch.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3112 AppLaunch.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 408 wrote to memory of 220 408 d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe 84 PID 408 wrote to memory of 220 408 d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe 84 PID 408 wrote to memory of 220 408 d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe 84 PID 220 wrote to memory of 1192 220 v9573103.exe 85 PID 220 wrote to memory of 1192 220 v9573103.exe 85 PID 220 wrote to memory of 1192 220 v9573103.exe 85 PID 1192 wrote to memory of 644 1192 v1705726.exe 86 PID 1192 wrote to memory of 644 1192 v1705726.exe 86 PID 1192 wrote to memory of 644 1192 v1705726.exe 86 PID 644 wrote to memory of 4328 644 a3352897.exe 88 PID 644 wrote to memory of 4328 644 a3352897.exe 88 PID 644 wrote to memory of 4328 644 a3352897.exe 88 PID 644 wrote to memory of 4328 644 a3352897.exe 88 PID 644 wrote to memory of 4328 644 a3352897.exe 88 PID 1192 wrote to memory of 4756 1192 v1705726.exe 89 PID 1192 wrote to memory of 4756 1192 v1705726.exe 89 PID 1192 wrote to memory of 4756 1192 v1705726.exe 89 PID 220 wrote to memory of 4772 220 v9573103.exe 90 PID 220 wrote to memory of 4772 220 v9573103.exe 90 PID 220 wrote to memory of 4772 220 v9573103.exe 90 PID 4772 wrote to memory of 3112 4772 c3454719.exe 92 PID 4772 wrote to memory of 3112 4772 c3454719.exe 92 PID 4772 wrote to memory of 3112 4772 c3454719.exe 92 PID 4772 wrote to memory of 3112 4772 c3454719.exe 92 PID 4772 wrote to memory of 3112 4772 c3454719.exe 92 PID 408 wrote to memory of 2956 408 d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe 93 PID 408 wrote to memory of 2956 408 d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe 93 PID 408 wrote to memory of 2956 408 d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe 93 PID 2956 wrote to memory of 1872 2956 d3994649.exe 95 PID 2956 wrote to memory of 1872 2956 d3994649.exe 95 PID 2956 wrote to memory of 1872 2956 d3994649.exe 95 PID 2956 wrote to memory of 1872 2956 d3994649.exe 95 PID 2956 wrote to memory of 1872 2956 d3994649.exe 95 PID 3112 wrote to memory of 1140 3112 AppLaunch.exe 96 PID 3112 wrote to memory of 1140 3112 AppLaunch.exe 96 PID 3112 wrote to memory of 1140 3112 AppLaunch.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe"C:\Users\Admin\AppData\Local\Temp\d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9573103.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9573103.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1705726.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1705726.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3352897.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3352897.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1070128.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1070128.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3454719.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3454719.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"5⤵
- Executes dropped EXE
PID:1140
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3994649.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3994649.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
328KB
MD5151c24359e1de2213f0c21580fc2cc82
SHA1212549f0f5b8897e182be80972f506fc684ed7d2
SHA256a611bc889867cc2cea2c9816cf85f320efa4057b2853b8cfc8e22c4bf0d80b09
SHA512834850b422424fc5924c90590ce9e38a561c4ce0e6b7df9b3ef46ba1bf643e5c56db799c27dd27d4f8d10da4d9bafced3d46093e39205e411e7a8618e7b1b3b0
-
Filesize
328KB
MD5151c24359e1de2213f0c21580fc2cc82
SHA1212549f0f5b8897e182be80972f506fc684ed7d2
SHA256a611bc889867cc2cea2c9816cf85f320efa4057b2853b8cfc8e22c4bf0d80b09
SHA512834850b422424fc5924c90590ce9e38a561c4ce0e6b7df9b3ef46ba1bf643e5c56db799c27dd27d4f8d10da4d9bafced3d46093e39205e411e7a8618e7b1b3b0
-
Filesize
601KB
MD54417e2376479cc5d966c88946edaa8df
SHA183b5d9fd1a2b3615466b543a4a20ae03bd22fe2a
SHA25600905fc8a380eee4d80e0a6e073f4097641f4d3f243de17c7f8cd3c5a2159508
SHA512e55d43810528daefe555287d7cfe747ebb37010a68e17ac4007325a1b02d7d16bcf1d105b55068ecc62523827473b60238f730f1acf394276267ef3dd00ee0fc
-
Filesize
601KB
MD54417e2376479cc5d966c88946edaa8df
SHA183b5d9fd1a2b3615466b543a4a20ae03bd22fe2a
SHA25600905fc8a380eee4d80e0a6e073f4097641f4d3f243de17c7f8cd3c5a2159508
SHA512e55d43810528daefe555287d7cfe747ebb37010a68e17ac4007325a1b02d7d16bcf1d105b55068ecc62523827473b60238f730f1acf394276267ef3dd00ee0fc
-
Filesize
387KB
MD5f2ee764aa6b9542c8676fcc91de2cd30
SHA1f20298bf57dfcf25ec757384335eae2bd4d990ba
SHA2563e8dcbba9df94690fb8a9e50538a665a5bb3e2ad9886fc4ab91d4cd3eb5ca038
SHA5128381578e5c01a4fd408a541a51672530744d28c709c63eddb9b694782f7e3aff2f6003bb442600d1d3e00be207660cc2820aec8d68dbb0f4ccfb5e096f912432
-
Filesize
387KB
MD5f2ee764aa6b9542c8676fcc91de2cd30
SHA1f20298bf57dfcf25ec757384335eae2bd4d990ba
SHA2563e8dcbba9df94690fb8a9e50538a665a5bb3e2ad9886fc4ab91d4cd3eb5ca038
SHA5128381578e5c01a4fd408a541a51672530744d28c709c63eddb9b694782f7e3aff2f6003bb442600d1d3e00be207660cc2820aec8d68dbb0f4ccfb5e096f912432
-
Filesize
276KB
MD58d6941d9069d06551414676978e60296
SHA1f7546b1c90763ab6843d7968b469471931e015c4
SHA256d77295c73bf5a90d082d4fd0dd4a3d552426fc1a019e2b3c1745a9bdf5337728
SHA512e7ebcbf871af3a93bf1a49650822ab989b16350d57e7ee4ddc11d620627c228316cfba59af8c40dd400c1d2e1fa18582d8a7f63685cdfecdf66f1a0535b8e307
-
Filesize
276KB
MD58d6941d9069d06551414676978e60296
SHA1f7546b1c90763ab6843d7968b469471931e015c4
SHA256d77295c73bf5a90d082d4fd0dd4a3d552426fc1a019e2b3c1745a9bdf5337728
SHA512e7ebcbf871af3a93bf1a49650822ab989b16350d57e7ee4ddc11d620627c228316cfba59af8c40dd400c1d2e1fa18582d8a7f63685cdfecdf66f1a0535b8e307
-
Filesize
194KB
MD52c341bec658809b8a24e68d4aa2574e7
SHA1f20f3f328b773befb879f0d8906787ef7373590e
SHA256bde380ea75ab49e6a9ba8adc5463148f1bf0516d48a58aee7d0ebd8aadfa8aa5
SHA512a566038cb8adf3c26c372dec8314f1ad7c03fb34d8142841ed82921458a896b4a285908b091faaccb4496b47c8bc5cea1b25dd4c8b0c32f935df19b2b2d9848e
-
Filesize
194KB
MD52c341bec658809b8a24e68d4aa2574e7
SHA1f20f3f328b773befb879f0d8906787ef7373590e
SHA256bde380ea75ab49e6a9ba8adc5463148f1bf0516d48a58aee7d0ebd8aadfa8aa5
SHA512a566038cb8adf3c26c372dec8314f1ad7c03fb34d8142841ed82921458a896b4a285908b091faaccb4496b47c8bc5cea1b25dd4c8b0c32f935df19b2b2d9848e
-
Filesize
145KB
MD5df6aa1427910e983167b5de082f93b7a
SHA1253db508c327a7d81145295a146fe448fe91d47e
SHA2565248c87f5e7c3d9acd920073145eb54c0f653d95ad63f8adc1764aedb2223f19
SHA5120901c57d2d70f6cf79636b116da48fd3d4d514e47a8d1544dc77cecd431154ec77a0c5605be7f7baa1495878fb9fb002a216e9cf694e3538d6f2643d9090383b
-
Filesize
145KB
MD5df6aa1427910e983167b5de082f93b7a
SHA1253db508c327a7d81145295a146fe448fe91d47e
SHA2565248c87f5e7c3d9acd920073145eb54c0f653d95ad63f8adc1764aedb2223f19
SHA5120901c57d2d70f6cf79636b116da48fd3d4d514e47a8d1544dc77cecd431154ec77a0c5605be7f7baa1495878fb9fb002a216e9cf694e3538d6f2643d9090383b
-
Filesize
101KB
MD589d41e1cf478a3d3c2c701a27a5692b2
SHA1691e20583ef80cb9a2fd3258560e7f02481d12fd
SHA256dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac
SHA5125c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc
-
Filesize
101KB
MD589d41e1cf478a3d3c2c701a27a5692b2
SHA1691e20583ef80cb9a2fd3258560e7f02481d12fd
SHA256dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac
SHA5125c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc
-
Filesize
101KB
MD589d41e1cf478a3d3c2c701a27a5692b2
SHA1691e20583ef80cb9a2fd3258560e7f02481d12fd
SHA256dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac
SHA5125c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc