Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2023, 22:29

General

  • Target

    15fc0928d728f1e35514d6aba845cb769975d0fbe44efb8aa4bf78add4428c94.exe

  • Size

    806KB

  • MD5

    2d115789ab31628e89290f1833bc24f3

  • SHA1

    8021637fbef80db1239a56ad47d0c4a66da88567

  • SHA256

    15fc0928d728f1e35514d6aba845cb769975d0fbe44efb8aa4bf78add4428c94

  • SHA512

    5b1056a412a0313791d703bcb58fb315dc99d5cfd55dee1a9e9274c6761f2baa405230529e7df46d835527edf4abfe9611614ee04783fb26fa662aa92cdd8959

  • SSDEEP

    24576:jy6qc96Zf4MLxsmWvDqlYTi1eenv6USkMW2h:2BZfnoieenvl

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.127:19045

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

metro

C2

83.97.73.127:19045

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15fc0928d728f1e35514d6aba845cb769975d0fbe44efb8aa4bf78add4428c94.exe
    "C:\Users\Admin\AppData\Local\Temp\15fc0928d728f1e35514d6aba845cb769975d0fbe44efb8aa4bf78add4428c94.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2659136.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2659136.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7782105.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7782105.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9050762.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9050762.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4352
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3836
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8140071.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8140071.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1308
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3209218.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3209218.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4024
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3472
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4972
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:1288
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4776
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:4540
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\a9e2a16078" /P "Admin:N"
                    6⤵
                      PID:2932
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:452
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:2244
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3644
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5220895.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5220895.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1948
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:532
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:2116
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:816

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5220895.exe

                Filesize

                342KB

                MD5

                cf1b90d21f1569e79f621573e6de9522

                SHA1

                e21a961bfd4fc5344bb270ecf5b86eebcc756a8f

                SHA256

                2e38b98140990d353c0aed23135fab6ed69cd5b0764861d0ca18f1a37ad5b726

                SHA512

                918b17d615b1551f5947424294ee0295abdb884fe28f8eda12586d0d785c3a76336afa5203a13065f02fb2c9c225e13ea357c2d1f9a18bb2a82e3417a0f1ddd8

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5220895.exe

                Filesize

                342KB

                MD5

                cf1b90d21f1569e79f621573e6de9522

                SHA1

                e21a961bfd4fc5344bb270ecf5b86eebcc756a8f

                SHA256

                2e38b98140990d353c0aed23135fab6ed69cd5b0764861d0ca18f1a37ad5b726

                SHA512

                918b17d615b1551f5947424294ee0295abdb884fe28f8eda12586d0d785c3a76336afa5203a13065f02fb2c9c225e13ea357c2d1f9a18bb2a82e3417a0f1ddd8

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2659136.exe

                Filesize

                462KB

                MD5

                ae5663e6004232d3f9d07427d6ae353b

                SHA1

                bcc6602b4c2959e8f35ed2c88c54600dacfaf7ab

                SHA256

                f95737c41c382087e3137defd99894eb6688770f0160006330f2120b1eefa031

                SHA512

                54f073a617fb91efc8c61232ae50122d1e05f47effb3edaa140506eb09266feb431ef63a943c52137f834336f8460ae90f0a959ebcd350a0a6410489b43d3c5d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2659136.exe

                Filesize

                462KB

                MD5

                ae5663e6004232d3f9d07427d6ae353b

                SHA1

                bcc6602b4c2959e8f35ed2c88c54600dacfaf7ab

                SHA256

                f95737c41c382087e3137defd99894eb6688770f0160006330f2120b1eefa031

                SHA512

                54f073a617fb91efc8c61232ae50122d1e05f47effb3edaa140506eb09266feb431ef63a943c52137f834336f8460ae90f0a959ebcd350a0a6410489b43d3c5d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3209218.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3209218.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7782105.exe

                Filesize

                290KB

                MD5

                10b93d3408ca57e33f1c642d713e9466

                SHA1

                b7cf13e5370a68cb7c5c1a40203348685d1be42a

                SHA256

                3dd974fb0383549dcafd78d2828603943284afa7f2663baaa371489d84cf86a3

                SHA512

                30ca25b8644a23d270b3dfe559de43f61884fc4c2085bf2eb94429b3352c16a588b8454a7184bdadf0ae7608bba310825ed1a77747a799978033801bfaf8d5b6

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7782105.exe

                Filesize

                290KB

                MD5

                10b93d3408ca57e33f1c642d713e9466

                SHA1

                b7cf13e5370a68cb7c5c1a40203348685d1be42a

                SHA256

                3dd974fb0383549dcafd78d2828603943284afa7f2663baaa371489d84cf86a3

                SHA512

                30ca25b8644a23d270b3dfe559de43f61884fc4c2085bf2eb94429b3352c16a588b8454a7184bdadf0ae7608bba310825ed1a77747a799978033801bfaf8d5b6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9050762.exe

                Filesize

                185KB

                MD5

                9be1051e1f00edf0a92fce9bb0fde951

                SHA1

                30b146455ddbe7bbc6577b156eca02e14e9a1381

                SHA256

                713032692f27283743a9d1adc50d9101eb6b1984e3e912284ab2581a3862c9bb

                SHA512

                9e2337fe389a1477cfd00d726b33e0b1583112244e4ec8111ce57d52b96eafeddb0bb9de1577e835b288edb976e5c02f39d2e2326f45312b2208f47273936e82

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9050762.exe

                Filesize

                185KB

                MD5

                9be1051e1f00edf0a92fce9bb0fde951

                SHA1

                30b146455ddbe7bbc6577b156eca02e14e9a1381

                SHA256

                713032692f27283743a9d1adc50d9101eb6b1984e3e912284ab2581a3862c9bb

                SHA512

                9e2337fe389a1477cfd00d726b33e0b1583112244e4ec8111ce57d52b96eafeddb0bb9de1577e835b288edb976e5c02f39d2e2326f45312b2208f47273936e82

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8140071.exe

                Filesize

                167KB

                MD5

                0d7afa3193f5a4131e074739a7a919c4

                SHA1

                f4aebccdca063a0c980c176dbc49bda879e08651

                SHA256

                8ad63a96b7b11db0fe3a8a0730a9aee3459139f40e2455da4b7f25e1ad546649

                SHA512

                2777739800f83f4438777d1ef319721171a2afd8150c877aec9518f9af67557dc07b98a68536711bff676adeefb09b03e75b3ca1428a61ee24dc837e2abe59d8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8140071.exe

                Filesize

                167KB

                MD5

                0d7afa3193f5a4131e074739a7a919c4

                SHA1

                f4aebccdca063a0c980c176dbc49bda879e08651

                SHA256

                8ad63a96b7b11db0fe3a8a0730a9aee3459139f40e2455da4b7f25e1ad546649

                SHA512

                2777739800f83f4438777d1ef319721171a2afd8150c877aec9518f9af67557dc07b98a68536711bff676adeefb09b03e75b3ca1428a61ee24dc837e2abe59d8

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                209KB

                MD5

                27960992e0ddf60e1b7f350ba33d19ed

                SHA1

                bad90a909f97305eb822b3eb552d1d68fd78fdfe

                SHA256

                931abb33033e2e2ec7ae03bf41f2db10d2de7c773567d77ba5010f74e4900068

                SHA512

                04c379b56762d9f0565a86265322c7693f78ecee5d233bfb8c120ffde0b46860683618c4b6b56c2c6331488c340c8a92b72aba595d474e0245071f7679329b6c

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/532-196-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB

              • memory/532-202-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

                Filesize

                64KB

              • memory/1308-163-0x00000000008F0000-0x000000000091E000-memory.dmp

                Filesize

                184KB

              • memory/1308-177-0x00000000066D0000-0x0000000006720000-memory.dmp

                Filesize

                320KB

              • memory/1308-176-0x0000000005220000-0x0000000005230000-memory.dmp

                Filesize

                64KB

              • memory/1308-174-0x0000000008BE0000-0x000000000910C000-memory.dmp

                Filesize

                5.2MB

              • memory/1308-173-0x0000000006730000-0x00000000068F2000-memory.dmp

                Filesize

                1.8MB

              • memory/1308-172-0x00000000058B0000-0x0000000005916000-memory.dmp

                Filesize

                408KB

              • memory/1308-171-0x0000000006A10000-0x0000000006FB4000-memory.dmp

                Filesize

                5.6MB

              • memory/1308-170-0x0000000005810000-0x00000000058A2000-memory.dmp

                Filesize

                584KB

              • memory/1308-169-0x00000000056F0000-0x0000000005766000-memory.dmp

                Filesize

                472KB

              • memory/1308-168-0x00000000053E0000-0x000000000541C000-memory.dmp

                Filesize

                240KB

              • memory/1308-167-0x0000000005220000-0x0000000005230000-memory.dmp

                Filesize

                64KB

              • memory/1308-166-0x0000000005380000-0x0000000005392000-memory.dmp

                Filesize

                72KB

              • memory/1308-165-0x0000000005450000-0x000000000555A000-memory.dmp

                Filesize

                1.0MB

              • memory/1308-164-0x0000000005950000-0x0000000005F68000-memory.dmp

                Filesize

                6.1MB

              • memory/3836-155-0x0000000000580000-0x000000000058A000-memory.dmp

                Filesize

                40KB