Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
22/08/2023, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe
Resource
win10-20230703-en
General
-
Target
948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe
-
Size
591KB
-
MD5
e008139c1ea96bf93210e24a15736dcb
-
SHA1
49e7f45542c40c686223cb3cb6081a4a71394970
-
SHA256
948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d
-
SHA512
04f201142a50d71e97a593cf17d72ca58ecae166f949455983a02e07b0f5bf5426a3e78b01e15006980abccabc3833d9e7d7ba41c2067f59647cbf411114ae36
-
SSDEEP
12288:2MrTy90nHDBqPDBL0PPCkNtVHzQR7TaXOlR60hgGwBod:1y+jBqrSBdz4mXOl6G1
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
piter
77.91.124.73:19071
-
auth_value
7f92ff466423bb35edbfbc22f78b0bb9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 168 y1353814.exe 164 y1445275.exe 2680 m0696587.exe 4968 n6147469.exe 4508 saves.exe 5096 o0833682.exe 4436 saves.exe 3820 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4408 rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1353814.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y1445275.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4492 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4192 wrote to memory of 168 4192 948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe 68 PID 4192 wrote to memory of 168 4192 948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe 68 PID 4192 wrote to memory of 168 4192 948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe 68 PID 168 wrote to memory of 164 168 y1353814.exe 69 PID 168 wrote to memory of 164 168 y1353814.exe 69 PID 168 wrote to memory of 164 168 y1353814.exe 69 PID 164 wrote to memory of 2680 164 y1445275.exe 70 PID 164 wrote to memory of 2680 164 y1445275.exe 70 PID 164 wrote to memory of 2680 164 y1445275.exe 70 PID 164 wrote to memory of 4968 164 y1445275.exe 71 PID 164 wrote to memory of 4968 164 y1445275.exe 71 PID 164 wrote to memory of 4968 164 y1445275.exe 71 PID 4968 wrote to memory of 4508 4968 n6147469.exe 72 PID 4968 wrote to memory of 4508 4968 n6147469.exe 72 PID 4968 wrote to memory of 4508 4968 n6147469.exe 72 PID 168 wrote to memory of 5096 168 y1353814.exe 73 PID 168 wrote to memory of 5096 168 y1353814.exe 73 PID 168 wrote to memory of 5096 168 y1353814.exe 73 PID 4508 wrote to memory of 4492 4508 saves.exe 74 PID 4508 wrote to memory of 4492 4508 saves.exe 74 PID 4508 wrote to memory of 4492 4508 saves.exe 74 PID 4508 wrote to memory of 1372 4508 saves.exe 75 PID 4508 wrote to memory of 1372 4508 saves.exe 75 PID 4508 wrote to memory of 1372 4508 saves.exe 75 PID 1372 wrote to memory of 1508 1372 cmd.exe 78 PID 1372 wrote to memory of 1508 1372 cmd.exe 78 PID 1372 wrote to memory of 1508 1372 cmd.exe 78 PID 1372 wrote to memory of 3388 1372 cmd.exe 79 PID 1372 wrote to memory of 3388 1372 cmd.exe 79 PID 1372 wrote to memory of 3388 1372 cmd.exe 79 PID 1372 wrote to memory of 4136 1372 cmd.exe 80 PID 1372 wrote to memory of 4136 1372 cmd.exe 80 PID 1372 wrote to memory of 4136 1372 cmd.exe 80 PID 1372 wrote to memory of 4948 1372 cmd.exe 81 PID 1372 wrote to memory of 4948 1372 cmd.exe 81 PID 1372 wrote to memory of 4948 1372 cmd.exe 81 PID 1372 wrote to memory of 4624 1372 cmd.exe 82 PID 1372 wrote to memory of 4624 1372 cmd.exe 82 PID 1372 wrote to memory of 4624 1372 cmd.exe 82 PID 1372 wrote to memory of 2336 1372 cmd.exe 83 PID 1372 wrote to memory of 2336 1372 cmd.exe 83 PID 1372 wrote to memory of 2336 1372 cmd.exe 83 PID 4508 wrote to memory of 4408 4508 saves.exe 85 PID 4508 wrote to memory of 4408 4508 saves.exe 85 PID 4508 wrote to memory of 4408 4508 saves.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe"C:\Users\Admin\AppData\Local\Temp\948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1353814.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1353814.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:168 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1445275.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1445275.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:164 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0696587.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0696587.exe4⤵
- Executes dropped EXE
PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6147469.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6147469.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F6⤵
- Creates scheduled task(s)
PID:4492
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1508
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"7⤵PID:3388
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E7⤵PID:4136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4948
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"7⤵PID:4624
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E7⤵PID:2336
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4408
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0833682.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0833682.exe3⤵
- Executes dropped EXE
PID:5096
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4436
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
475KB
MD5c25cca3ef87f295b6c2e7c325249e7ab
SHA14d0eb4e66f13fef823f2043699466c1bc16bbc1c
SHA256799b85d426953f94a60dc552fa250f27d73dc3e73992e4225bd5206d71443917
SHA51236fa9fd9f8b42efdd74cf6c9dbdbbe06487d9bc70f4342d7fd7747522d61340ffcf4adde954c8ddb91c62c2ac6cea4cee65e65cc5fee9018969935ce3ee48704
-
Filesize
475KB
MD5c25cca3ef87f295b6c2e7c325249e7ab
SHA14d0eb4e66f13fef823f2043699466c1bc16bbc1c
SHA256799b85d426953f94a60dc552fa250f27d73dc3e73992e4225bd5206d71443917
SHA51236fa9fd9f8b42efdd74cf6c9dbdbbe06487d9bc70f4342d7fd7747522d61340ffcf4adde954c8ddb91c62c2ac6cea4cee65e65cc5fee9018969935ce3ee48704
-
Filesize
174KB
MD5ff5f2dba0f830ac52876f63ae4edf73f
SHA1e39704f2dd77d8a63c4ea6ae2a49428370f3fb84
SHA256f0b378b4d6b139502cbac7595903fcb06e600d1cd9f9c0a730b80d442d46185a
SHA512db952bab7bfce383e61c4ad32af786c1f23f0944a5a668a91f24f4a7e778f70fd9fcf26f8f74eecc8f39984eb78ad994b66c422db155e36b33b520f7d9e44753
-
Filesize
174KB
MD5ff5f2dba0f830ac52876f63ae4edf73f
SHA1e39704f2dd77d8a63c4ea6ae2a49428370f3fb84
SHA256f0b378b4d6b139502cbac7595903fcb06e600d1cd9f9c0a730b80d442d46185a
SHA512db952bab7bfce383e61c4ad32af786c1f23f0944a5a668a91f24f4a7e778f70fd9fcf26f8f74eecc8f39984eb78ad994b66c422db155e36b33b520f7d9e44753
-
Filesize
320KB
MD5d58e131e154db359cd4d95a09fbfc004
SHA1215284f9b27f06ac9a0de5996b0cd6839bca4b19
SHA2565aa94f1ccdfc36128e4baeb0d28154416ab9a2af2261c3d114a818c4e26487b2
SHA51237ab71393663946bf20f94d14249089c55c6386314c9125626ffc95c24a48386ee1fffd617fba155385f949d918768071ea4b2bec34107aa098fbf2c1959db66
-
Filesize
320KB
MD5d58e131e154db359cd4d95a09fbfc004
SHA1215284f9b27f06ac9a0de5996b0cd6839bca4b19
SHA2565aa94f1ccdfc36128e4baeb0d28154416ab9a2af2261c3d114a818c4e26487b2
SHA51237ab71393663946bf20f94d14249089c55c6386314c9125626ffc95c24a48386ee1fffd617fba155385f949d918768071ea4b2bec34107aa098fbf2c1959db66
-
Filesize
140KB
MD5535a2ecc3ff2bc180b9306ba5d92a4dc
SHA1eba928e198e32616af7c80669b4a8a65d363fbd7
SHA256c04a2b6712cdbac32e1429f3b09a8c9fc9d50cbeb295b36e7b7b2c70d958e765
SHA51223ccc45fe53dff5bffe5f2ab65d22756ca270736d3f36bfb027ca214ac990d451f8afc503493aad1c745c0811bb3d70b990ea50e01dd8e7cf9b25dd66ca007e8
-
Filesize
140KB
MD5535a2ecc3ff2bc180b9306ba5d92a4dc
SHA1eba928e198e32616af7c80669b4a8a65d363fbd7
SHA256c04a2b6712cdbac32e1429f3b09a8c9fc9d50cbeb295b36e7b7b2c70d958e765
SHA51223ccc45fe53dff5bffe5f2ab65d22756ca270736d3f36bfb027ca214ac990d451f8afc503493aad1c745c0811bb3d70b990ea50e01dd8e7cf9b25dd66ca007e8
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
315KB
MD5236b3b00cabd6dff003fa9d47e22aa4a
SHA1fe9bb3795796ed7b61ccc29e4859e2f41acb8583
SHA256a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7
SHA512dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b