Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2023, 19:07

General

  • Target

    7b62c8b404c03f37e87f09e47800e7263b19cc37ce6a3e43b1c0a0bfa7df957b.exe

  • Size

    805KB

  • MD5

    d7fde12dd76f21e91e3d95b410ca4828

  • SHA1

    1636900a3e8c242771c2f593ab1855bcdf80fd79

  • SHA256

    7b62c8b404c03f37e87f09e47800e7263b19cc37ce6a3e43b1c0a0bfa7df957b

  • SHA512

    a73e8c6b7a0e257fb64ffcb4268c52cd7fcb26892071f0f2f555a6972cf7c2a9337e3025055b3de7d17e66a99d9207cf369b3ef43adb81a0d139cc7f7b4049d5

  • SSDEEP

    24576:kyysvboVMMPPNf0eGaO2VGBKwBeBC61VtXVB:zyVqMPVRGaDwBuh

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.127:19045

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

metro

C2

83.97.73.127:19045

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b62c8b404c03f37e87f09e47800e7263b19cc37ce6a3e43b1c0a0bfa7df957b.exe
    "C:\Users\Admin\AppData\Local\Temp\7b62c8b404c03f37e87f09e47800e7263b19cc37ce6a3e43b1c0a0bfa7df957b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0976955.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0976955.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3580374.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3580374.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9656194.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9656194.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3212
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3312
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8436247.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8436247.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1692
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7894493.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7894493.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2336
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1260
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3608
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4020
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:1016
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:2192
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:5008
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:2212
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4860
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0657040.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0657040.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2784
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4368
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1992
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:760

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0657040.exe

                Filesize

                349KB

                MD5

                ef63d59029c5718b8607291265a5ae5e

                SHA1

                535985392a2930ca51abcacbbe080dbba93775a4

                SHA256

                fda8c58cf1fd867a8c06515d54c3e48cfe3931c3e9adf5c68b9b3af58d5b7d6e

                SHA512

                9e87d137f7a73cfdf29c82320170a3c0d170b637525d7ffb834a892d48c9263ac5bd152aad2cc4c40bc083a819c37c190738a24ee5355191802d6a64e689146d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0657040.exe

                Filesize

                349KB

                MD5

                ef63d59029c5718b8607291265a5ae5e

                SHA1

                535985392a2930ca51abcacbbe080dbba93775a4

                SHA256

                fda8c58cf1fd867a8c06515d54c3e48cfe3931c3e9adf5c68b9b3af58d5b7d6e

                SHA512

                9e87d137f7a73cfdf29c82320170a3c0d170b637525d7ffb834a892d48c9263ac5bd152aad2cc4c40bc083a819c37c190738a24ee5355191802d6a64e689146d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0976955.exe

                Filesize

                462KB

                MD5

                5ce897c3bad6f4dc53769dff302f6d3c

                SHA1

                20b5c01d6ed91a4d94137bfc976751d1fd66025f

                SHA256

                f82194b7337cc57a848d02fc7e48ebcc04f76029a79a92c344937ade5e4f9d18

                SHA512

                b81e09251a615aa685edc83cf2beb7796be1e609d1142ef14f5c7553b7240d80983b52bf0ad708e01a071bfd7adc85bf6437255bf191e85970556bd5421ee3f4

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0976955.exe

                Filesize

                462KB

                MD5

                5ce897c3bad6f4dc53769dff302f6d3c

                SHA1

                20b5c01d6ed91a4d94137bfc976751d1fd66025f

                SHA256

                f82194b7337cc57a848d02fc7e48ebcc04f76029a79a92c344937ade5e4f9d18

                SHA512

                b81e09251a615aa685edc83cf2beb7796be1e609d1142ef14f5c7553b7240d80983b52bf0ad708e01a071bfd7adc85bf6437255bf191e85970556bd5421ee3f4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7894493.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7894493.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3580374.exe

                Filesize

                290KB

                MD5

                fe897f5b457f9e90988b695b29f569cd

                SHA1

                affed189805ccf29a4ba0dd860c8a9b99a7d6e5a

                SHA256

                a9d0cb3109135e0e9c4153cf4f5b0031e5d7d923781a187fb23c813357bddd8b

                SHA512

                d30b55e653af1cd09a5a1e9df0892718140c6b70ba2d9ea9a59cb15b12d6f82267e6d0cfba57227e41811ee9a4e8d128630651586dde921c5285f43434fadf55

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3580374.exe

                Filesize

                290KB

                MD5

                fe897f5b457f9e90988b695b29f569cd

                SHA1

                affed189805ccf29a4ba0dd860c8a9b99a7d6e5a

                SHA256

                a9d0cb3109135e0e9c4153cf4f5b0031e5d7d923781a187fb23c813357bddd8b

                SHA512

                d30b55e653af1cd09a5a1e9df0892718140c6b70ba2d9ea9a59cb15b12d6f82267e6d0cfba57227e41811ee9a4e8d128630651586dde921c5285f43434fadf55

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9656194.exe

                Filesize

                192KB

                MD5

                06476183f55cd518ae4c231e6933069b

                SHA1

                cec3c6f4ae6e577704beec12ea0764c9f79168cf

                SHA256

                738c44c4a6f677bb56fa5e46238157f8d9a2f22371e7e38f8db0ac5523444cea

                SHA512

                2bc7925b9a3993d88503c3c0f44196f8da1b34c08c8f486cdd05b963f7748d60fd10e581ecbe40b7b448978e0930145e3b257979a3fd0b4317d47fe7f77a2cd8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9656194.exe

                Filesize

                192KB

                MD5

                06476183f55cd518ae4c231e6933069b

                SHA1

                cec3c6f4ae6e577704beec12ea0764c9f79168cf

                SHA256

                738c44c4a6f677bb56fa5e46238157f8d9a2f22371e7e38f8db0ac5523444cea

                SHA512

                2bc7925b9a3993d88503c3c0f44196f8da1b34c08c8f486cdd05b963f7748d60fd10e581ecbe40b7b448978e0930145e3b257979a3fd0b4317d47fe7f77a2cd8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8436247.exe

                Filesize

                168KB

                MD5

                94ff004fe27b2b863f81278079957fe2

                SHA1

                4115577be0347f6c77dfd0a8bff5e64b0c5dfea8

                SHA256

                a34bcb64446e205b77e2d4a1336aa82bfd977a7300e1dda9d05f3be719a16bb4

                SHA512

                56adeb296b066117e54d178a84f2aa06c86a191794de96f7c79562c782a5249b918458105b98c31bda68b7cfd8ee5b0295c110cc58468158e7332b07b411e517

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8436247.exe

                Filesize

                168KB

                MD5

                94ff004fe27b2b863f81278079957fe2

                SHA1

                4115577be0347f6c77dfd0a8bff5e64b0c5dfea8

                SHA256

                a34bcb64446e205b77e2d4a1336aa82bfd977a7300e1dda9d05f3be719a16bb4

                SHA512

                56adeb296b066117e54d178a84f2aa06c86a191794de96f7c79562c782a5249b918458105b98c31bda68b7cfd8ee5b0295c110cc58468158e7332b07b411e517

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                208KB

                MD5

                616cc8c1c7c9301674a4657bd925b58b

                SHA1

                a39c1591b5da1a05862773e35b9691f287c372c8

                SHA256

                838f6ca660fef359c4acff2121375029cff53f896f490360d0451dc7945eb80e

                SHA512

                06d323f99359b03491bd8a08dcd325cd3ae2f3728ec457c2cdddd3ee0f6e45de28950dfe0d9a8e01aaec550006aca9bcef9b29f0d5cc91772912152cfe606456

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1692-163-0x0000000000FD0000-0x0000000000FFE000-memory.dmp

                Filesize

                184KB

              • memory/1692-169-0x000000000B1F0000-0x000000000B266000-memory.dmp

                Filesize

                472KB

              • memory/1692-176-0x0000000005880000-0x0000000005890000-memory.dmp

                Filesize

                64KB

              • memory/1692-175-0x000000000CEE0000-0x000000000D40C000-memory.dmp

                Filesize

                5.2MB

              • memory/1692-174-0x000000000C1E0000-0x000000000C3A2000-memory.dmp

                Filesize

                1.8MB

              • memory/1692-172-0x000000000C400000-0x000000000C9A4000-memory.dmp

                Filesize

                5.6MB

              • memory/1692-171-0x000000000B270000-0x000000000B2D6000-memory.dmp

                Filesize

                408KB

              • memory/1692-170-0x000000000B310000-0x000000000B3A2000-memory.dmp

                Filesize

                584KB

              • memory/1692-164-0x000000000B430000-0x000000000BA48000-memory.dmp

                Filesize

                6.1MB

              • memory/1692-177-0x000000000C130000-0x000000000C180000-memory.dmp

                Filesize

                320KB

              • memory/1692-165-0x000000000AF50000-0x000000000B05A000-memory.dmp

                Filesize

                1.0MB

              • memory/1692-168-0x0000000005880000-0x0000000005890000-memory.dmp

                Filesize

                64KB

              • memory/1692-167-0x000000000AEE0000-0x000000000AF1C000-memory.dmp

                Filesize

                240KB

              • memory/1692-166-0x000000000AE80000-0x000000000AE92000-memory.dmp

                Filesize

                72KB

              • memory/3312-155-0x00000000003D0000-0x00000000003DA000-memory.dmp

                Filesize

                40KB

              • memory/4368-202-0x0000000004F20000-0x0000000004F30000-memory.dmp

                Filesize

                64KB

              • memory/4368-196-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB