Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
20/08/2023, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe
Resource
win10-20230703-en
General
-
Target
cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe
-
Size
756KB
-
MD5
fd8bfcbed640416126eb2c433c4b8494
-
SHA1
333bcdcd8c71ebd19805528d8bc2718ee25f812a
-
SHA256
cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2
-
SHA512
9ea0b318c1f64231cce1e019ceb753521b9922a49bad58b1ab952d3bea12d91e372e2f83bd39a988899bb64ac675de0665705921e26c1dddb2e5d911e5a271f4
-
SSDEEP
12288:CMr/y90ew/dmwVWYm47t6+oDDO81Knvx+mRi67zsO79jzV7ZMqb:9yZw/dmmv41i84nvx+mcK7pzVp
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
jonka
77.91.124.73:19071
-
auth_value
c95bc30cd252fa6dff2a19fd78bfab4e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3044 y8066193.exe 4512 y7692551.exe 2204 m5235923.exe 3804 n4471330.exe 1912 saves.exe 4876 o5208646.exe 4976 saves.exe 808 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 2636 rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8066193.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y7692551.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3688 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 68 wrote to memory of 3044 68 cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe 69 PID 68 wrote to memory of 3044 68 cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe 69 PID 68 wrote to memory of 3044 68 cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe 69 PID 3044 wrote to memory of 4512 3044 y8066193.exe 70 PID 3044 wrote to memory of 4512 3044 y8066193.exe 70 PID 3044 wrote to memory of 4512 3044 y8066193.exe 70 PID 4512 wrote to memory of 2204 4512 y7692551.exe 71 PID 4512 wrote to memory of 2204 4512 y7692551.exe 71 PID 4512 wrote to memory of 2204 4512 y7692551.exe 71 PID 4512 wrote to memory of 3804 4512 y7692551.exe 72 PID 4512 wrote to memory of 3804 4512 y7692551.exe 72 PID 4512 wrote to memory of 3804 4512 y7692551.exe 72 PID 3804 wrote to memory of 1912 3804 n4471330.exe 73 PID 3804 wrote to memory of 1912 3804 n4471330.exe 73 PID 3804 wrote to memory of 1912 3804 n4471330.exe 73 PID 3044 wrote to memory of 4876 3044 y8066193.exe 74 PID 3044 wrote to memory of 4876 3044 y8066193.exe 74 PID 3044 wrote to memory of 4876 3044 y8066193.exe 74 PID 1912 wrote to memory of 3688 1912 saves.exe 75 PID 1912 wrote to memory of 3688 1912 saves.exe 75 PID 1912 wrote to memory of 3688 1912 saves.exe 75 PID 1912 wrote to memory of 1896 1912 saves.exe 77 PID 1912 wrote to memory of 1896 1912 saves.exe 77 PID 1912 wrote to memory of 1896 1912 saves.exe 77 PID 1896 wrote to memory of 2072 1896 cmd.exe 79 PID 1896 wrote to memory of 2072 1896 cmd.exe 79 PID 1896 wrote to memory of 2072 1896 cmd.exe 79 PID 1896 wrote to memory of 2732 1896 cmd.exe 80 PID 1896 wrote to memory of 2732 1896 cmd.exe 80 PID 1896 wrote to memory of 2732 1896 cmd.exe 80 PID 1896 wrote to memory of 2912 1896 cmd.exe 81 PID 1896 wrote to memory of 2912 1896 cmd.exe 81 PID 1896 wrote to memory of 2912 1896 cmd.exe 81 PID 1896 wrote to memory of 2020 1896 cmd.exe 82 PID 1896 wrote to memory of 2020 1896 cmd.exe 82 PID 1896 wrote to memory of 2020 1896 cmd.exe 82 PID 1896 wrote to memory of 440 1896 cmd.exe 83 PID 1896 wrote to memory of 440 1896 cmd.exe 83 PID 1896 wrote to memory of 440 1896 cmd.exe 83 PID 1896 wrote to memory of 200 1896 cmd.exe 84 PID 1896 wrote to memory of 200 1896 cmd.exe 84 PID 1896 wrote to memory of 200 1896 cmd.exe 84 PID 1912 wrote to memory of 2636 1912 saves.exe 86 PID 1912 wrote to memory of 2636 1912 saves.exe 86 PID 1912 wrote to memory of 2636 1912 saves.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe"C:\Users\Admin\AppData\Local\Temp\cb68b382c9d86ab41c766c68b07e9fc3923523355d2b5b74f921534fc00f72e2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:68 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8066193.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8066193.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7692551.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7692551.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5235923.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5235923.exe4⤵
- Executes dropped EXE
PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n4471330.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n4471330.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F6⤵
- Creates scheduled task(s)
PID:3688
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2072
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"7⤵PID:2732
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E7⤵PID:2912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2020
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"7⤵PID:440
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E7⤵PID:200
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2636
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5208646.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o5208646.exe3⤵
- Executes dropped EXE
PID:4876
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4976
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD590598a7aa2822cea4a16e57e2e12fbe4
SHA12c16272b77f88f55b8abe8f6958792f4a3252210
SHA2564a09461390ea86f2f326f7e9c1839aa47addbbd1c8c0eb9b04cb6f94dbf0b40b
SHA5128fc31397a48b40f3b73c81910bb00515f7f0a89deec1b429e3662aa8b0c39c5b7993a047dda40b1c42c28d9524fdeaf746b2defd43a0290d4f3837383df68dea
-
Filesize
476KB
MD590598a7aa2822cea4a16e57e2e12fbe4
SHA12c16272b77f88f55b8abe8f6958792f4a3252210
SHA2564a09461390ea86f2f326f7e9c1839aa47addbbd1c8c0eb9b04cb6f94dbf0b40b
SHA5128fc31397a48b40f3b73c81910bb00515f7f0a89deec1b429e3662aa8b0c39c5b7993a047dda40b1c42c28d9524fdeaf746b2defd43a0290d4f3837383df68dea
-
Filesize
174KB
MD5c20cf33abe83498648531d6a6d03da2e
SHA1f7abe5ab125cbeb0ee12c69c27f6beccac77d317
SHA256d1be3826f7c738c7be3d276912c7852f56bf8e43d99a7e7880d37a3dfd0fef71
SHA512a6704a7502e04ef695b130e448823dd0ce4d1aaf3b2823e3521fd97f5b681ecb98d2ceec6f49c37c30b034996da7370acd7732459d2d565f1770fe455c139cd8
-
Filesize
174KB
MD5c20cf33abe83498648531d6a6d03da2e
SHA1f7abe5ab125cbeb0ee12c69c27f6beccac77d317
SHA256d1be3826f7c738c7be3d276912c7852f56bf8e43d99a7e7880d37a3dfd0fef71
SHA512a6704a7502e04ef695b130e448823dd0ce4d1aaf3b2823e3521fd97f5b681ecb98d2ceec6f49c37c30b034996da7370acd7732459d2d565f1770fe455c139cd8
-
Filesize
320KB
MD5a6fec371d92c3e22569a3b3dbc9f02ed
SHA1e049c5f0d9eeaa1a357631523a483dc65c7ae3d2
SHA2568f3ef467b67864b3a464c5286a5a6a52de451b11eaa43928377f4136d5ce1715
SHA512708a21e6dacbf535afb74f6791cb97d1a1d6cafcb72473bdbf82db2f97bd4f60995f7cc602ddd67ca19f551112a54cc8d6174e28331a46721a105bf63d13ddbb
-
Filesize
320KB
MD5a6fec371d92c3e22569a3b3dbc9f02ed
SHA1e049c5f0d9eeaa1a357631523a483dc65c7ae3d2
SHA2568f3ef467b67864b3a464c5286a5a6a52de451b11eaa43928377f4136d5ce1715
SHA512708a21e6dacbf535afb74f6791cb97d1a1d6cafcb72473bdbf82db2f97bd4f60995f7cc602ddd67ca19f551112a54cc8d6174e28331a46721a105bf63d13ddbb
-
Filesize
140KB
MD58d5f17011509ea2a6f1334430c6fa664
SHA1dcae78973384c3b600af0f4c045b61cf62310907
SHA256566508cf56b529db924eeb1f99e33d7281088ec66655242fd5136ce4a25892ea
SHA5126e8f05ae41a27e865281819981aca8f5d2af9d4f86c089ca413db88bb4811504f19c7a2ed87698c91b8ba77aeb3752172064757591efed097f4ff250d18e27da
-
Filesize
140KB
MD58d5f17011509ea2a6f1334430c6fa664
SHA1dcae78973384c3b600af0f4c045b61cf62310907
SHA256566508cf56b529db924eeb1f99e33d7281088ec66655242fd5136ce4a25892ea
SHA5126e8f05ae41a27e865281819981aca8f5d2af9d4f86c089ca413db88bb4811504f19c7a2ed87698c91b8ba77aeb3752172064757591efed097f4ff250d18e27da
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b