Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
305s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/08/2023, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe
Resource
win10-20230703-en
General
-
Target
e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe
-
Size
505KB
-
MD5
b7a20fbacb71191e0b100535dc4cccd6
-
SHA1
14fa425ee1f4391b96343cfe8cb4952d4e980d89
-
SHA256
e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42
-
SHA512
2794b55b4af5d67c3c08d147ed53982b924b546f82f314c15c8fc02b552eef8ae659860c9705030185f0c0d12d3744988fbc468d261ab2dc37ed9fd985099fa8
-
SSDEEP
12288:vMrdy90sGY0wPhbygF5EAhsSAX34//7K9fHHHuwcPg:SyK36V22sSAHE/qHcY
Malware Config
Extracted
redline
meson
77.91.124.54:19071
-
auth_value
47ca57ebe5c142c9ad4650f71bf57877
Signatures
-
Detects Healer an antivirus disabler dropper 4 IoCs
resource yara_rule behavioral1/files/0x0007000000016831-84.dat healer behavioral1/files/0x0007000000016831-86.dat healer behavioral1/files/0x0007000000016831-87.dat healer behavioral1/memory/2832-89-0x0000000000B20000-0x0000000000B2A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h3861945.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h3861945.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h3861945.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h3861945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h3861945.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h3861945.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 5 IoCs
pid Process 2208 x0145446.exe 2568 x2855565.exe 840 g3628899.exe 2832 h3861945.exe 3000 i4027710.exe -
Loads dropped DLL 9 IoCs
pid Process 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 2208 x0145446.exe 2208 x0145446.exe 2568 x2855565.exe 2568 x2855565.exe 840 g3628899.exe 2568 x2855565.exe 2208 x0145446.exe 3000 i4027710.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h3861945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features h3861945.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x2855565.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x0145446.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2832 h3861945.exe 2832 h3861945.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2832 h3861945.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 1688 wrote to memory of 2208 1688 e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe 28 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2208 wrote to memory of 2568 2208 x0145446.exe 29 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 840 2568 x2855565.exe 30 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2568 wrote to memory of 2832 2568 x2855565.exe 35 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36 PID 2208 wrote to memory of 3000 2208 x0145446.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe"C:\Users\Admin\AppData\Local\Temp\e7bbf078734a92a046d9652461b197077425ea9f611b3f805f07d4fe917a2a42.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0145446.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0145446.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2855565.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2855565.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3628899.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3628899.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h3861945.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h3861945.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i4027710.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i4027710.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
373KB
MD5e6bafc801a2bce19df66a60744ba9553
SHA147bf9df975b6de5ea54d7006530a3e76b8061e0d
SHA2564707aa2e16bb20ae5a9d0b3ced3676d64a4bc5eb43b71d2eb17a630763a5d337
SHA512264ce6b4bcb85e3a68f72ae11b47105c5776b4e3b92afe1856564271e0d854620061aa080d66f870d6c16fe82fec324a520865c0e9394947b356c8ef7db1ce13
-
Filesize
373KB
MD5e6bafc801a2bce19df66a60744ba9553
SHA147bf9df975b6de5ea54d7006530a3e76b8061e0d
SHA2564707aa2e16bb20ae5a9d0b3ced3676d64a4bc5eb43b71d2eb17a630763a5d337
SHA512264ce6b4bcb85e3a68f72ae11b47105c5776b4e3b92afe1856564271e0d854620061aa080d66f870d6c16fe82fec324a520865c0e9394947b356c8ef7db1ce13
-
Filesize
174KB
MD5b983a40f83bc4d5f4ce08bd1ce6509fc
SHA1b42854106bfe69a0c285aa631d24f23772eae6de
SHA2562a946a4909ed3e138dca8b29010ca1fdf142bf544ef4912fa0917708520bfdd6
SHA5121a09fbcd3137f68cd5146739bb5bd15836f60c5854b6e13f492e35bc6eb4ff9cbd8f632f58b98b803c2d69374f0bb6dbc9e97ec7c0a179e2293c98323d015656
-
Filesize
174KB
MD5b983a40f83bc4d5f4ce08bd1ce6509fc
SHA1b42854106bfe69a0c285aa631d24f23772eae6de
SHA2562a946a4909ed3e138dca8b29010ca1fdf142bf544ef4912fa0917708520bfdd6
SHA5121a09fbcd3137f68cd5146739bb5bd15836f60c5854b6e13f492e35bc6eb4ff9cbd8f632f58b98b803c2d69374f0bb6dbc9e97ec7c0a179e2293c98323d015656
-
Filesize
217KB
MD596cd4ba0cfa3f937830cb1c0f137f63e
SHA1369c6d96e5701db498422fa7771c15122354b2c0
SHA25668ac5937ba557da8497155631684109eea2b19355378f89ec7c34af0995e0481
SHA51259cad2c644c5752d4e8f016c3efcf67169eeb942c7bd0f7933706b2c152397d0366783f5905aaee38663cfd1ea6d273f01e7709c8456821cc491da406eaa176b
-
Filesize
217KB
MD596cd4ba0cfa3f937830cb1c0f137f63e
SHA1369c6d96e5701db498422fa7771c15122354b2c0
SHA25668ac5937ba557da8497155631684109eea2b19355378f89ec7c34af0995e0481
SHA51259cad2c644c5752d4e8f016c3efcf67169eeb942c7bd0f7933706b2c152397d0366783f5905aaee38663cfd1ea6d273f01e7709c8456821cc491da406eaa176b
-
Filesize
140KB
MD58f6cbd407dffba25f4bc8645d72d271c
SHA143bccbe1978f4026307dc0ef693ebd5c540d3de4
SHA25645aacafc3272cbf8f495c5531d6a6001c0f998b1f37ae6127e298d2e870a8d2a
SHA5128e7adf6e290613debe49367b7fec810d575ef0a6ea79cb0cc2f888e9012ae80e8fb4a84aa2de783d3ef5b73cced2a177af7dfea8d89f7f2734f4a53142d7cfa6
-
Filesize
140KB
MD58f6cbd407dffba25f4bc8645d72d271c
SHA143bccbe1978f4026307dc0ef693ebd5c540d3de4
SHA25645aacafc3272cbf8f495c5531d6a6001c0f998b1f37ae6127e298d2e870a8d2a
SHA5128e7adf6e290613debe49367b7fec810d575ef0a6ea79cb0cc2f888e9012ae80e8fb4a84aa2de783d3ef5b73cced2a177af7dfea8d89f7f2734f4a53142d7cfa6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
373KB
MD5e6bafc801a2bce19df66a60744ba9553
SHA147bf9df975b6de5ea54d7006530a3e76b8061e0d
SHA2564707aa2e16bb20ae5a9d0b3ced3676d64a4bc5eb43b71d2eb17a630763a5d337
SHA512264ce6b4bcb85e3a68f72ae11b47105c5776b4e3b92afe1856564271e0d854620061aa080d66f870d6c16fe82fec324a520865c0e9394947b356c8ef7db1ce13
-
Filesize
373KB
MD5e6bafc801a2bce19df66a60744ba9553
SHA147bf9df975b6de5ea54d7006530a3e76b8061e0d
SHA2564707aa2e16bb20ae5a9d0b3ced3676d64a4bc5eb43b71d2eb17a630763a5d337
SHA512264ce6b4bcb85e3a68f72ae11b47105c5776b4e3b92afe1856564271e0d854620061aa080d66f870d6c16fe82fec324a520865c0e9394947b356c8ef7db1ce13
-
Filesize
174KB
MD5b983a40f83bc4d5f4ce08bd1ce6509fc
SHA1b42854106bfe69a0c285aa631d24f23772eae6de
SHA2562a946a4909ed3e138dca8b29010ca1fdf142bf544ef4912fa0917708520bfdd6
SHA5121a09fbcd3137f68cd5146739bb5bd15836f60c5854b6e13f492e35bc6eb4ff9cbd8f632f58b98b803c2d69374f0bb6dbc9e97ec7c0a179e2293c98323d015656
-
Filesize
174KB
MD5b983a40f83bc4d5f4ce08bd1ce6509fc
SHA1b42854106bfe69a0c285aa631d24f23772eae6de
SHA2562a946a4909ed3e138dca8b29010ca1fdf142bf544ef4912fa0917708520bfdd6
SHA5121a09fbcd3137f68cd5146739bb5bd15836f60c5854b6e13f492e35bc6eb4ff9cbd8f632f58b98b803c2d69374f0bb6dbc9e97ec7c0a179e2293c98323d015656
-
Filesize
217KB
MD596cd4ba0cfa3f937830cb1c0f137f63e
SHA1369c6d96e5701db498422fa7771c15122354b2c0
SHA25668ac5937ba557da8497155631684109eea2b19355378f89ec7c34af0995e0481
SHA51259cad2c644c5752d4e8f016c3efcf67169eeb942c7bd0f7933706b2c152397d0366783f5905aaee38663cfd1ea6d273f01e7709c8456821cc491da406eaa176b
-
Filesize
217KB
MD596cd4ba0cfa3f937830cb1c0f137f63e
SHA1369c6d96e5701db498422fa7771c15122354b2c0
SHA25668ac5937ba557da8497155631684109eea2b19355378f89ec7c34af0995e0481
SHA51259cad2c644c5752d4e8f016c3efcf67169eeb942c7bd0f7933706b2c152397d0366783f5905aaee38663cfd1ea6d273f01e7709c8456821cc491da406eaa176b
-
Filesize
140KB
MD58f6cbd407dffba25f4bc8645d72d271c
SHA143bccbe1978f4026307dc0ef693ebd5c540d3de4
SHA25645aacafc3272cbf8f495c5531d6a6001c0f998b1f37ae6127e298d2e870a8d2a
SHA5128e7adf6e290613debe49367b7fec810d575ef0a6ea79cb0cc2f888e9012ae80e8fb4a84aa2de783d3ef5b73cced2a177af7dfea8d89f7f2734f4a53142d7cfa6
-
Filesize
140KB
MD58f6cbd407dffba25f4bc8645d72d271c
SHA143bccbe1978f4026307dc0ef693ebd5c540d3de4
SHA25645aacafc3272cbf8f495c5531d6a6001c0f998b1f37ae6127e298d2e870a8d2a
SHA5128e7adf6e290613debe49367b7fec810d575ef0a6ea79cb0cc2f888e9012ae80e8fb4a84aa2de783d3ef5b73cced2a177af7dfea8d89f7f2734f4a53142d7cfa6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91