Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2023, 21:26

General

  • Target

    38fd236b9e5e0d284be0bc7e1cc8c77aac470fa982e0a45f497e32b282ccf464.exe

  • Size

    752KB

  • MD5

    4a0c182882a703422d61d22cdefaf002

  • SHA1

    d9ac862415d1db4dc24f538a228ad5a6a92b23b9

  • SHA256

    38fd236b9e5e0d284be0bc7e1cc8c77aac470fa982e0a45f497e32b282ccf464

  • SHA512

    55267aea773a8de91d02f1512df9acb2582bcdeeb7e72ac9c4a58144917cdf3b196d1ef5f42b126b678d4cf935ab82190b25ad8d3627fabcb1e579130034bd5e

  • SSDEEP

    12288:lMrzy90+qlduvdr97OJOz4JyuUgCdvvG3czYYRDzrmaw3XcXLJa2o5SuHMzjuF:ayU7uvdJikzqnSvvn8YpE3XcXLv1jCF

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.127:19045

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

metro

C2

83.97.73.127:19045

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38fd236b9e5e0d284be0bc7e1cc8c77aac470fa982e0a45f497e32b282ccf464.exe
    "C:\Users\Admin\AppData\Local\Temp\38fd236b9e5e0d284be0bc7e1cc8c77aac470fa982e0a45f497e32b282ccf464.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1976757.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1976757.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5734753.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5734753.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9605163.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9605163.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4040
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2416
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9977329.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9977329.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1988
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6917646.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6917646.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:5108
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4660
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:908
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4844
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:2700
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:424
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:4044
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:4404
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9411816.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9411816.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1260
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1296

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9411816.exe

                Filesize

                327KB

                MD5

                bd194fa924d632466c6e6d53161c4e85

                SHA1

                f6e7222f021e8d3ec35d0f62429b664ed5d5b55f

                SHA256

                ea12221dbdc3afb96185df9a017df581d64d29e178ef78aae4dc1b9a9bf40025

                SHA512

                260514a8f3c15d88b97a55da404694d9fbbc266fdf7339767f46005282d1892f67e5360b386642afdb0f614ae9b88883a2e60cc1948542d8cf8fe3d635c31ec1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d9411816.exe

                Filesize

                327KB

                MD5

                bd194fa924d632466c6e6d53161c4e85

                SHA1

                f6e7222f021e8d3ec35d0f62429b664ed5d5b55f

                SHA256

                ea12221dbdc3afb96185df9a017df581d64d29e178ef78aae4dc1b9a9bf40025

                SHA512

                260514a8f3c15d88b97a55da404694d9fbbc266fdf7339767f46005282d1892f67e5360b386642afdb0f614ae9b88883a2e60cc1948542d8cf8fe3d635c31ec1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1976757.exe

                Filesize

                453KB

                MD5

                4564c5775bd50f98b6002e6ad624033c

                SHA1

                96d0e70b721cbdc5e404cdd1772d6c356fa4e4cc

                SHA256

                f99b6fb75ffe05d612922521003cae9b831333b13a8c22700c2683406c452fad

                SHA512

                1d7476a1f67321913ff82ec227074d09b17b6fe5cefabe2eaea89645b2aceec803c26d114bb1924d44f7a3182621a432aeae175bd809d72d1551bc2027aa006d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1976757.exe

                Filesize

                453KB

                MD5

                4564c5775bd50f98b6002e6ad624033c

                SHA1

                96d0e70b721cbdc5e404cdd1772d6c356fa4e4cc

                SHA256

                f99b6fb75ffe05d612922521003cae9b831333b13a8c22700c2683406c452fad

                SHA512

                1d7476a1f67321913ff82ec227074d09b17b6fe5cefabe2eaea89645b2aceec803c26d114bb1924d44f7a3182621a432aeae175bd809d72d1551bc2027aa006d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6917646.exe

                Filesize

                210KB

                MD5

                f1beed89d94a88ea58dfde7e622fc1c0

                SHA1

                ace1444e02365d3e5df8c50485e750ed005f80d9

                SHA256

                a5c30c891bb250aa0c4d1ff31779b222421c1c9865a71cb4183792c2f25a22eb

                SHA512

                a77009165478c61276218ddf422ebc8215dbef327ffd0f711025b84a0faf26558fdc77a0378a8b984eb6abbcd62028644b2229f72600673176e844445ddc740e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c6917646.exe

                Filesize

                210KB

                MD5

                f1beed89d94a88ea58dfde7e622fc1c0

                SHA1

                ace1444e02365d3e5df8c50485e750ed005f80d9

                SHA256

                a5c30c891bb250aa0c4d1ff31779b222421c1c9865a71cb4183792c2f25a22eb

                SHA512

                a77009165478c61276218ddf422ebc8215dbef327ffd0f711025b84a0faf26558fdc77a0378a8b984eb6abbcd62028644b2229f72600673176e844445ddc740e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5734753.exe

                Filesize

                281KB

                MD5

                a3b47fb218db6fa3572a5af14b5f4b07

                SHA1

                452b46abb5a3661bf4ceabccbf434b9220362240

                SHA256

                a53fee4b79f99324e5310e5beae514a1d5bab8d8005d5f9288fb9d7425a9c65b

                SHA512

                f6dc6b87dcba3f2a46762ada47e182b1cca524cdd1458ae07c41e487f66a29419631b18d3cdc4b91cc50ae70fcac7c06719e75c549fd92580292bdfde350080a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5734753.exe

                Filesize

                281KB

                MD5

                a3b47fb218db6fa3572a5af14b5f4b07

                SHA1

                452b46abb5a3661bf4ceabccbf434b9220362240

                SHA256

                a53fee4b79f99324e5310e5beae514a1d5bab8d8005d5f9288fb9d7425a9c65b

                SHA512

                f6dc6b87dcba3f2a46762ada47e182b1cca524cdd1458ae07c41e487f66a29419631b18d3cdc4b91cc50ae70fcac7c06719e75c549fd92580292bdfde350080a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9605163.exe

                Filesize

                169KB

                MD5

                2f893d643824713272c1d7286b04203c

                SHA1

                12b562d45cc4094aca9058721234f76630d778a8

                SHA256

                5bc79c4eb59ff48bdc9b7a32b5d312bf27e10ae2159705ae316f6d821ccd0bf3

                SHA512

                3d4417f11ad7e95ac0359e47f49dabdf4571e607606a9f93b042353393083927a5548a2e14b60b4e51e86f88611ea9792f85a463286ee152840304e621f0612f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9605163.exe

                Filesize

                169KB

                MD5

                2f893d643824713272c1d7286b04203c

                SHA1

                12b562d45cc4094aca9058721234f76630d778a8

                SHA256

                5bc79c4eb59ff48bdc9b7a32b5d312bf27e10ae2159705ae316f6d821ccd0bf3

                SHA512

                3d4417f11ad7e95ac0359e47f49dabdf4571e607606a9f93b042353393083927a5548a2e14b60b4e51e86f88611ea9792f85a463286ee152840304e621f0612f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9977329.exe

                Filesize

                168KB

                MD5

                76ee6644b1c6dafd758f80dd2e4acd25

                SHA1

                a508be6aee6ff6d735345fbe2ac7c8273918b5f8

                SHA256

                54e858715d15043b38400a05c230004581a1e65de5bb69e0cdd099430c6cc265

                SHA512

                46098a8bc94fed1cf44244b9ba7db805babdb13f99f132a4cb6592e8b7fd96a0529cb4aa4e8027145106e947a9857d24b5d832c7652661658eba84e84807d182

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9977329.exe

                Filesize

                168KB

                MD5

                76ee6644b1c6dafd758f80dd2e4acd25

                SHA1

                a508be6aee6ff6d735345fbe2ac7c8273918b5f8

                SHA256

                54e858715d15043b38400a05c230004581a1e65de5bb69e0cdd099430c6cc265

                SHA512

                46098a8bc94fed1cf44244b9ba7db805babdb13f99f132a4cb6592e8b7fd96a0529cb4aa4e8027145106e947a9857d24b5d832c7652661658eba84e84807d182

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                210KB

                MD5

                f1beed89d94a88ea58dfde7e622fc1c0

                SHA1

                ace1444e02365d3e5df8c50485e750ed005f80d9

                SHA256

                a5c30c891bb250aa0c4d1ff31779b222421c1c9865a71cb4183792c2f25a22eb

                SHA512

                a77009165478c61276218ddf422ebc8215dbef327ffd0f711025b84a0faf26558fdc77a0378a8b984eb6abbcd62028644b2229f72600673176e844445ddc740e

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                210KB

                MD5

                f1beed89d94a88ea58dfde7e622fc1c0

                SHA1

                ace1444e02365d3e5df8c50485e750ed005f80d9

                SHA256

                a5c30c891bb250aa0c4d1ff31779b222421c1c9865a71cb4183792c2f25a22eb

                SHA512

                a77009165478c61276218ddf422ebc8215dbef327ffd0f711025b84a0faf26558fdc77a0378a8b984eb6abbcd62028644b2229f72600673176e844445ddc740e

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                210KB

                MD5

                f1beed89d94a88ea58dfde7e622fc1c0

                SHA1

                ace1444e02365d3e5df8c50485e750ed005f80d9

                SHA256

                a5c30c891bb250aa0c4d1ff31779b222421c1c9865a71cb4183792c2f25a22eb

                SHA512

                a77009165478c61276218ddf422ebc8215dbef327ffd0f711025b84a0faf26558fdc77a0378a8b984eb6abbcd62028644b2229f72600673176e844445ddc740e

              • memory/1296-202-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

                Filesize

                64KB

              • memory/1296-196-0x0000000000400000-0x000000000042E000-memory.dmp

                Filesize

                184KB

              • memory/1988-172-0x00000000053B0000-0x0000000005442000-memory.dmp

                Filesize

                584KB

              • memory/1988-173-0x0000000006610000-0x0000000006BB4000-memory.dmp

                Filesize

                5.6MB

              • memory/1988-175-0x0000000006060000-0x00000000060B0000-memory.dmp

                Filesize

                320KB

              • memory/1988-176-0x0000000006280000-0x0000000006442000-memory.dmp

                Filesize

                1.8MB

              • memory/1988-177-0x00000000087E0000-0x0000000008D0C000-memory.dmp

                Filesize

                5.2MB

              • memory/1988-165-0x0000000005040000-0x000000000514A000-memory.dmp

                Filesize

                1.0MB

              • memory/1988-164-0x0000000005550000-0x0000000005B68000-memory.dmp

                Filesize

                6.1MB

              • memory/1988-174-0x0000000005B70000-0x0000000005BD6000-memory.dmp

                Filesize

                408KB

              • memory/1988-166-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

                Filesize

                72KB

              • memory/1988-171-0x00000000023D0000-0x0000000002446000-memory.dmp

                Filesize

                472KB

              • memory/1988-163-0x0000000000420000-0x000000000044E000-memory.dmp

                Filesize

                184KB

              • memory/1988-170-0x0000000004E20000-0x0000000004E30000-memory.dmp

                Filesize

                64KB

              • memory/1988-168-0x0000000004E20000-0x0000000004E30000-memory.dmp

                Filesize

                64KB

              • memory/1988-167-0x0000000004F30000-0x0000000004F6C000-memory.dmp

                Filesize

                240KB

              • memory/2416-155-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB