Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
7b76520e2f364efdf2d3ee2d6.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
7b76520e2f364efdf2d3ee2d6.exe
Resource
win10v2004-20230703-en
General
-
Target
7b76520e2f364efdf2d3ee2d6.exe
-
Size
528KB
-
MD5
7b76520e2f364efdf2d3ee2d632ce92b
-
SHA1
8eb41a2bf5318b77c68eb29573db33ce1697fd75
-
SHA256
65c758ae3a7552d5e41a153fe2dc8af896269ede3fedb6e653d815505ff372ad
-
SHA512
e29bbf0eaebe6c45f372e2fa6e5707153af0ea7680abfefebde197807b4d4b7e78e6f8b146a9d8dd79f0986f0081921f61517b2c54da3e5e6f4320c53cfe9be6
-
SSDEEP
12288:ShQPfveaRdnQgouHfYvCM58KOf/65hXffqH/E6kk0:ShQ3ve82gPSg+PCshZ
Malware Config
Extracted
redline
furod
77.91.68.70:19073
-
auth_value
d2386245fe11799b28b4521492a5879d
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral1/memory/2904-83-0x0000000000020000-0x000000000002A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k3959801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k3959801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k3959801.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k3959801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k3959801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k3959801.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 2292 y7204929.exe 2904 k3959801.exe 2100 l0096440.exe -
Loads dropped DLL 8 IoCs
pid Process 2380 7b76520e2f364efdf2d3ee2d6.exe 2292 y7204929.exe 2292 y7204929.exe 2292 y7204929.exe 2904 k3959801.exe 2292 y7204929.exe 2292 y7204929.exe 2100 l0096440.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features k3959801.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k3959801.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7b76520e2f364efdf2d3ee2d6.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y7204929.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y7204929.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7b76520e2f364efdf2d3ee2d6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2904 k3959801.exe 2904 k3959801.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2904 k3959801.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2380 wrote to memory of 2292 2380 7b76520e2f364efdf2d3ee2d6.exe 30 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2904 2292 y7204929.exe 31 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33 PID 2292 wrote to memory of 2100 2292 y7204929.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b76520e2f364efdf2d3ee2d6.exe"C:\Users\Admin\AppData\Local\Temp\7b76520e2f364efdf2d3ee2d6.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7204929.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7204929.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3959801.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3959801.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0096440.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0096440.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD5122e09911c41b12bc65b8a266824431d
SHA18968b2416993064235f5bde0ab12c7ba61d94f26
SHA256df198973dc86bcb8e5da4512912808b78146ab1799cec9a64338fc8a7f245bad
SHA51219f054e6b276987daac1ac43923d580d933e5c9b63d8d7419520a10384f52a73c50ef20bebd52ab67ff47113cfc9bc5126ee90e414eda2a923b0fd2a246de0cd
-
Filesize
260KB
MD5122e09911c41b12bc65b8a266824431d
SHA18968b2416993064235f5bde0ab12c7ba61d94f26
SHA256df198973dc86bcb8e5da4512912808b78146ab1799cec9a64338fc8a7f245bad
SHA51219f054e6b276987daac1ac43923d580d933e5c9b63d8d7419520a10384f52a73c50ef20bebd52ab67ff47113cfc9bc5126ee90e414eda2a923b0fd2a246de0cd
-
Filesize
96KB
MD57ef7c67056ba9e2836fd6b621fa44184
SHA1c7a4d2e2eb888709ac7c222d573c265ad6d37daa
SHA25671bf5d3fcaf5563347fbfb9383e4bc71e9230859dd70a1a31e12ffa19b3bb841
SHA5127b219c25ffeff09433481797c20a9e2ffde5cbf6690a6ce52998ad654db9d6c5da774f281dc2df7ad002bf416d10a165ceb97a5d19fbb110760b6d3bbc3be4b0
-
Filesize
96KB
MD57ef7c67056ba9e2836fd6b621fa44184
SHA1c7a4d2e2eb888709ac7c222d573c265ad6d37daa
SHA25671bf5d3fcaf5563347fbfb9383e4bc71e9230859dd70a1a31e12ffa19b3bb841
SHA5127b219c25ffeff09433481797c20a9e2ffde5cbf6690a6ce52998ad654db9d6c5da774f281dc2df7ad002bf416d10a165ceb97a5d19fbb110760b6d3bbc3be4b0
-
Filesize
96KB
MD57ef7c67056ba9e2836fd6b621fa44184
SHA1c7a4d2e2eb888709ac7c222d573c265ad6d37daa
SHA25671bf5d3fcaf5563347fbfb9383e4bc71e9230859dd70a1a31e12ffa19b3bb841
SHA5127b219c25ffeff09433481797c20a9e2ffde5cbf6690a6ce52998ad654db9d6c5da774f281dc2df7ad002bf416d10a165ceb97a5d19fbb110760b6d3bbc3be4b0
-
Filesize
257KB
MD511876ec1eee54ebe35b4b2e67919b591
SHA16379414df009f6df98660a580becdfbb4c092cea
SHA2568d19faa861a48ed9af5c5390f4943202c050fe82dfb26882a9342e9e187b9e9c
SHA512113cb68aa0a9dd0e6ab363ac1915708a2ed840c21f3f43d2aa2cf88ffdc001815154331daa970596875b4f307eda5d1711d19bb796c419e499304c4782b2b2d1
-
Filesize
257KB
MD511876ec1eee54ebe35b4b2e67919b591
SHA16379414df009f6df98660a580becdfbb4c092cea
SHA2568d19faa861a48ed9af5c5390f4943202c050fe82dfb26882a9342e9e187b9e9c
SHA512113cb68aa0a9dd0e6ab363ac1915708a2ed840c21f3f43d2aa2cf88ffdc001815154331daa970596875b4f307eda5d1711d19bb796c419e499304c4782b2b2d1
-
Filesize
257KB
MD511876ec1eee54ebe35b4b2e67919b591
SHA16379414df009f6df98660a580becdfbb4c092cea
SHA2568d19faa861a48ed9af5c5390f4943202c050fe82dfb26882a9342e9e187b9e9c
SHA512113cb68aa0a9dd0e6ab363ac1915708a2ed840c21f3f43d2aa2cf88ffdc001815154331daa970596875b4f307eda5d1711d19bb796c419e499304c4782b2b2d1
-
Filesize
260KB
MD5122e09911c41b12bc65b8a266824431d
SHA18968b2416993064235f5bde0ab12c7ba61d94f26
SHA256df198973dc86bcb8e5da4512912808b78146ab1799cec9a64338fc8a7f245bad
SHA51219f054e6b276987daac1ac43923d580d933e5c9b63d8d7419520a10384f52a73c50ef20bebd52ab67ff47113cfc9bc5126ee90e414eda2a923b0fd2a246de0cd
-
Filesize
260KB
MD5122e09911c41b12bc65b8a266824431d
SHA18968b2416993064235f5bde0ab12c7ba61d94f26
SHA256df198973dc86bcb8e5da4512912808b78146ab1799cec9a64338fc8a7f245bad
SHA51219f054e6b276987daac1ac43923d580d933e5c9b63d8d7419520a10384f52a73c50ef20bebd52ab67ff47113cfc9bc5126ee90e414eda2a923b0fd2a246de0cd
-
Filesize
96KB
MD57ef7c67056ba9e2836fd6b621fa44184
SHA1c7a4d2e2eb888709ac7c222d573c265ad6d37daa
SHA25671bf5d3fcaf5563347fbfb9383e4bc71e9230859dd70a1a31e12ffa19b3bb841
SHA5127b219c25ffeff09433481797c20a9e2ffde5cbf6690a6ce52998ad654db9d6c5da774f281dc2df7ad002bf416d10a165ceb97a5d19fbb110760b6d3bbc3be4b0
-
Filesize
96KB
MD57ef7c67056ba9e2836fd6b621fa44184
SHA1c7a4d2e2eb888709ac7c222d573c265ad6d37daa
SHA25671bf5d3fcaf5563347fbfb9383e4bc71e9230859dd70a1a31e12ffa19b3bb841
SHA5127b219c25ffeff09433481797c20a9e2ffde5cbf6690a6ce52998ad654db9d6c5da774f281dc2df7ad002bf416d10a165ceb97a5d19fbb110760b6d3bbc3be4b0
-
Filesize
96KB
MD57ef7c67056ba9e2836fd6b621fa44184
SHA1c7a4d2e2eb888709ac7c222d573c265ad6d37daa
SHA25671bf5d3fcaf5563347fbfb9383e4bc71e9230859dd70a1a31e12ffa19b3bb841
SHA5127b219c25ffeff09433481797c20a9e2ffde5cbf6690a6ce52998ad654db9d6c5da774f281dc2df7ad002bf416d10a165ceb97a5d19fbb110760b6d3bbc3be4b0
-
Filesize
257KB
MD511876ec1eee54ebe35b4b2e67919b591
SHA16379414df009f6df98660a580becdfbb4c092cea
SHA2568d19faa861a48ed9af5c5390f4943202c050fe82dfb26882a9342e9e187b9e9c
SHA512113cb68aa0a9dd0e6ab363ac1915708a2ed840c21f3f43d2aa2cf88ffdc001815154331daa970596875b4f307eda5d1711d19bb796c419e499304c4782b2b2d1
-
Filesize
257KB
MD511876ec1eee54ebe35b4b2e67919b591
SHA16379414df009f6df98660a580becdfbb4c092cea
SHA2568d19faa861a48ed9af5c5390f4943202c050fe82dfb26882a9342e9e187b9e9c
SHA512113cb68aa0a9dd0e6ab363ac1915708a2ed840c21f3f43d2aa2cf88ffdc001815154331daa970596875b4f307eda5d1711d19bb796c419e499304c4782b2b2d1
-
Filesize
257KB
MD511876ec1eee54ebe35b4b2e67919b591
SHA16379414df009f6df98660a580becdfbb4c092cea
SHA2568d19faa861a48ed9af5c5390f4943202c050fe82dfb26882a9342e9e187b9e9c
SHA512113cb68aa0a9dd0e6ab363ac1915708a2ed840c21f3f43d2aa2cf88ffdc001815154331daa970596875b4f307eda5d1711d19bb796c419e499304c4782b2b2d1