Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2023, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe
Resource
win10v2004-20230221-en
General
-
Target
844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe
-
Size
580KB
-
MD5
f0847f9859792ea3f7138a6d8b958ea5
-
SHA1
fc8d49204c7be0a62b62700513e3596a6074852c
-
SHA256
844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae
-
SHA512
8e0e06712a628ef4289d998c72819c636338baab0ecf482f3510f4f3e35888ef1c56dfd6914f35829d1c2e12ac73b5f94534da9ecc839929e0321adcee232fd0
-
SSDEEP
12288:qMrcy907AAs7hmNR0jyg+PZhQzEgFFrNbcDAPJGI64F:SymAAYUWjOZhEEgFF1cUA4F
Malware Config
Extracted
redline
diza
83.97.73.126:19046
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k2928851.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k2928851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k2928851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k2928851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k2928851.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k2928851.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 2672 y8075178.exe 2516 y4564900.exe 2064 k2928851.exe 1548 l3235075.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k2928851.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8075178.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y4564900.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y4564900.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y8075178.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2064 k2928851.exe 2064 k2928851.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2064 k2928851.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2672 2648 844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe 82 PID 2648 wrote to memory of 2672 2648 844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe 82 PID 2648 wrote to memory of 2672 2648 844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe 82 PID 2672 wrote to memory of 2516 2672 y8075178.exe 83 PID 2672 wrote to memory of 2516 2672 y8075178.exe 83 PID 2672 wrote to memory of 2516 2672 y8075178.exe 83 PID 2516 wrote to memory of 2064 2516 y4564900.exe 84 PID 2516 wrote to memory of 2064 2516 y4564900.exe 84 PID 2516 wrote to memory of 1548 2516 y4564900.exe 85 PID 2516 wrote to memory of 1548 2516 y4564900.exe 85 PID 2516 wrote to memory of 1548 2516 y4564900.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe"C:\Users\Admin\AppData\Local\Temp\844a6bfd00c1759876a543a463f3827091151583bd18c65514cce3e68c5471ae.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8075178.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8075178.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4564900.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4564900.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2928851.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2928851.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3235075.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3235075.exe4⤵
- Executes dropped EXE
PID:1548
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5ebf0eb697e2eb9a2fd48acd1df407477
SHA1b320bc35321f1845cd617dfddcb6a3ecb50d8f69
SHA2563006f4c7b146e01c9a9818fc7c64cfeed526d279b7cc68684c1cd1b72a717fce
SHA51272b53c6b33b99bf9821a8adafac3b535f18024cf25a458b9a745c7a6b46ad862c74227174f8fd700e99079edd03b46828ee186ca535ce7eb6580cffa1e244b8b
-
Filesize
377KB
MD5ebf0eb697e2eb9a2fd48acd1df407477
SHA1b320bc35321f1845cd617dfddcb6a3ecb50d8f69
SHA2563006f4c7b146e01c9a9818fc7c64cfeed526d279b7cc68684c1cd1b72a717fce
SHA51272b53c6b33b99bf9821a8adafac3b535f18024cf25a458b9a745c7a6b46ad862c74227174f8fd700e99079edd03b46828ee186ca535ce7eb6580cffa1e244b8b
-
Filesize
206KB
MD5b7fe6928880d76f33b0bab88fbe140ca
SHA1c164d64f078ee915e6a9af2982a519fa48533247
SHA256a33284f985b4e1177be56bdc71e1102fd09735a019028eff3def79b713962fcc
SHA5129f405293e496ce0b3de60bdef216f20e924fb9835a664ff3707457a620370b7527415fe1a7bd2b92031cb256cc3d3fe219880898be3665a922a06c39616c0eb8
-
Filesize
206KB
MD5b7fe6928880d76f33b0bab88fbe140ca
SHA1c164d64f078ee915e6a9af2982a519fa48533247
SHA256a33284f985b4e1177be56bdc71e1102fd09735a019028eff3def79b713962fcc
SHA5129f405293e496ce0b3de60bdef216f20e924fb9835a664ff3707457a620370b7527415fe1a7bd2b92031cb256cc3d3fe219880898be3665a922a06c39616c0eb8
-
Filesize
11KB
MD53b416a1b882466bd99311dbab98fb42d
SHA1286eaf9931732e12f2ba571d44e4bb20e20d0022
SHA2569810f5b05ccbee3d0d4dc6368bbafdb3fd80eb506f5f443969dd98747febe29d
SHA5125903569d34bced97c27426313c309f243d5eb145bf496eccd2ee598a61154da0057b4753a6a1de1fa9a8f76bb51b6a7c53937d91456abda15cce93ac9554baad
-
Filesize
11KB
MD53b416a1b882466bd99311dbab98fb42d
SHA1286eaf9931732e12f2ba571d44e4bb20e20d0022
SHA2569810f5b05ccbee3d0d4dc6368bbafdb3fd80eb506f5f443969dd98747febe29d
SHA5125903569d34bced97c27426313c309f243d5eb145bf496eccd2ee598a61154da0057b4753a6a1de1fa9a8f76bb51b6a7c53937d91456abda15cce93ac9554baad
-
Filesize
172KB
MD519f2f5c9fbc01659e46de13a208ec5f2
SHA1dbdfc856bea346c0f98800d79b85ad3b956d9461
SHA256f7c3a4db658ca825b3b70722154f7701c6debb37c097ff818401add7675b2cc1
SHA5125bba834d41a28ed4dcc0bcaeae2e85f547d326616d4636aeede64ab733e301fd5510d2edf6ca08b0f50b9d63b3de2fb1c6316b63fe193c807997bb64925e4d11
-
Filesize
172KB
MD519f2f5c9fbc01659e46de13a208ec5f2
SHA1dbdfc856bea346c0f98800d79b85ad3b956d9461
SHA256f7c3a4db658ca825b3b70722154f7701c6debb37c097ff818401add7675b2cc1
SHA5125bba834d41a28ed4dcc0bcaeae2e85f547d326616d4636aeede64ab733e301fd5510d2edf6ca08b0f50b9d63b3de2fb1c6316b63fe193c807997bb64925e4d11