Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    04/06/2023, 18:57

General

  • Target

    05661599.exe

  • Size

    581KB

  • MD5

    20fe8fbf9b55c637bbb62a34df4886f0

  • SHA1

    6cd1fdc64a25e290346280164806d4f7fb8783e2

  • SHA256

    d08d7b4165fce25e8099f696e0d600f2e737498add7d71bbe3a1466015eb542b

  • SHA512

    4b8bd6a624112e7723e5c4d451512b18dcfbc59e07923150e9e8a772ce72ffae46f978c91672ce27f604cd1da2aa07c36c3ce17aa2843b94be388a1494177942

  • SSDEEP

    12288:kMr2y90Nj5xQa0v7+WLGGnO5H60mydcqJ2MPHn/pD8AL:iyCjIvapGnOtdmydnQ4Hn/SAL

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19046

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05661599.exe
    "C:\Users\Admin\AppData\Local\Temp\05661599.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7826113.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7826113.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5763206.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5763206.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8807851.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8807851.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:304

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7826113.exe

    Filesize

    378KB

    MD5

    fefe0521422e7bb2c46021c6cd686fb0

    SHA1

    a0b4f424451806b18e6d40883e65ce30fbabae66

    SHA256

    f10f382f9b0c6f287327b1640bcaf8137c007674597f4745ed2351a6a2591051

    SHA512

    d1bf4452bc73df78b5d92538cd8dde8e797e7ae95b86b1b212ecb81ba94b88776482c04c01c1b44884b7dd1f805fdbf969f4a5639b8c5b22448ee4e0311e6964

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7826113.exe

    Filesize

    378KB

    MD5

    fefe0521422e7bb2c46021c6cd686fb0

    SHA1

    a0b4f424451806b18e6d40883e65ce30fbabae66

    SHA256

    f10f382f9b0c6f287327b1640bcaf8137c007674597f4745ed2351a6a2591051

    SHA512

    d1bf4452bc73df78b5d92538cd8dde8e797e7ae95b86b1b212ecb81ba94b88776482c04c01c1b44884b7dd1f805fdbf969f4a5639b8c5b22448ee4e0311e6964

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5763206.exe

    Filesize

    206KB

    MD5

    bf05f97db7f68fe0ad9c134b268e9dc5

    SHA1

    1a2381783177e6fbffa4a70c013606f34f5f01c4

    SHA256

    7736e753d618d2f99ea0bbfe76abdb43625a403b45446c5158637e5e5b977c96

    SHA512

    61cdab63ab8480b5bb414072322a882b7502317f0b169da7fa7f11b65bdd21bf8bdd5e605f8cfeea942b733515f9cde4e15bd483204477ca279d452176b74926

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5763206.exe

    Filesize

    206KB

    MD5

    bf05f97db7f68fe0ad9c134b268e9dc5

    SHA1

    1a2381783177e6fbffa4a70c013606f34f5f01c4

    SHA256

    7736e753d618d2f99ea0bbfe76abdb43625a403b45446c5158637e5e5b977c96

    SHA512

    61cdab63ab8480b5bb414072322a882b7502317f0b169da7fa7f11b65bdd21bf8bdd5e605f8cfeea942b733515f9cde4e15bd483204477ca279d452176b74926

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8807851.exe

    Filesize

    172KB

    MD5

    bf4a17699360beb0552835066f0ff1bd

    SHA1

    95df664c6ce7307d846709dd21c21d79b23bbc35

    SHA256

    adc88ce6d0c161220eb531b92254e661472cffc2680161d0264272c2da797882

    SHA512

    28f9c082faced3b4f3c16f1f3cf57205c3dc53ebb18d336d02b567e00a2357811ab9b875aed6e86883eb53594d49f4513ab0b71f00db147bd9e7b899e23c7b8f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8807851.exe

    Filesize

    172KB

    MD5

    bf4a17699360beb0552835066f0ff1bd

    SHA1

    95df664c6ce7307d846709dd21c21d79b23bbc35

    SHA256

    adc88ce6d0c161220eb531b92254e661472cffc2680161d0264272c2da797882

    SHA512

    28f9c082faced3b4f3c16f1f3cf57205c3dc53ebb18d336d02b567e00a2357811ab9b875aed6e86883eb53594d49f4513ab0b71f00db147bd9e7b899e23c7b8f

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x7826113.exe

    Filesize

    378KB

    MD5

    fefe0521422e7bb2c46021c6cd686fb0

    SHA1

    a0b4f424451806b18e6d40883e65ce30fbabae66

    SHA256

    f10f382f9b0c6f287327b1640bcaf8137c007674597f4745ed2351a6a2591051

    SHA512

    d1bf4452bc73df78b5d92538cd8dde8e797e7ae95b86b1b212ecb81ba94b88776482c04c01c1b44884b7dd1f805fdbf969f4a5639b8c5b22448ee4e0311e6964

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x7826113.exe

    Filesize

    378KB

    MD5

    fefe0521422e7bb2c46021c6cd686fb0

    SHA1

    a0b4f424451806b18e6d40883e65ce30fbabae66

    SHA256

    f10f382f9b0c6f287327b1640bcaf8137c007674597f4745ed2351a6a2591051

    SHA512

    d1bf4452bc73df78b5d92538cd8dde8e797e7ae95b86b1b212ecb81ba94b88776482c04c01c1b44884b7dd1f805fdbf969f4a5639b8c5b22448ee4e0311e6964

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x5763206.exe

    Filesize

    206KB

    MD5

    bf05f97db7f68fe0ad9c134b268e9dc5

    SHA1

    1a2381783177e6fbffa4a70c013606f34f5f01c4

    SHA256

    7736e753d618d2f99ea0bbfe76abdb43625a403b45446c5158637e5e5b977c96

    SHA512

    61cdab63ab8480b5bb414072322a882b7502317f0b169da7fa7f11b65bdd21bf8bdd5e605f8cfeea942b733515f9cde4e15bd483204477ca279d452176b74926

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x5763206.exe

    Filesize

    206KB

    MD5

    bf05f97db7f68fe0ad9c134b268e9dc5

    SHA1

    1a2381783177e6fbffa4a70c013606f34f5f01c4

    SHA256

    7736e753d618d2f99ea0bbfe76abdb43625a403b45446c5158637e5e5b977c96

    SHA512

    61cdab63ab8480b5bb414072322a882b7502317f0b169da7fa7f11b65bdd21bf8bdd5e605f8cfeea942b733515f9cde4e15bd483204477ca279d452176b74926

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\f8807851.exe

    Filesize

    172KB

    MD5

    bf4a17699360beb0552835066f0ff1bd

    SHA1

    95df664c6ce7307d846709dd21c21d79b23bbc35

    SHA256

    adc88ce6d0c161220eb531b92254e661472cffc2680161d0264272c2da797882

    SHA512

    28f9c082faced3b4f3c16f1f3cf57205c3dc53ebb18d336d02b567e00a2357811ab9b875aed6e86883eb53594d49f4513ab0b71f00db147bd9e7b899e23c7b8f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\f8807851.exe

    Filesize

    172KB

    MD5

    bf4a17699360beb0552835066f0ff1bd

    SHA1

    95df664c6ce7307d846709dd21c21d79b23bbc35

    SHA256

    adc88ce6d0c161220eb531b92254e661472cffc2680161d0264272c2da797882

    SHA512

    28f9c082faced3b4f3c16f1f3cf57205c3dc53ebb18d336d02b567e00a2357811ab9b875aed6e86883eb53594d49f4513ab0b71f00db147bd9e7b899e23c7b8f

  • memory/304-84-0x00000000000C0000-0x00000000000F0000-memory.dmp

    Filesize

    192KB

  • memory/304-85-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB

  • memory/304-86-0x0000000004AE0000-0x0000000004B20000-memory.dmp

    Filesize

    256KB

  • memory/304-87-0x0000000004AE0000-0x0000000004B20000-memory.dmp

    Filesize

    256KB