Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
278s -
max time network
255s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 04:37
Behavioral task
behavioral1
Sample
t5489145.exe
Resource
win7-20230712-en
General
-
Target
t5489145.exe
-
Size
314KB
-
MD5
5ebd49060b21946157c3340c680769d0
-
SHA1
435b9e144da84d8ffa40b490d081e1d20947ee0b
-
SHA256
b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
-
SHA512
5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
SSDEEP
6144:zR/tsQnf6X0M6+koYhXMxjwigfwfgbePu97rrAOQ322222KTq:zRlHVckoaXMxcePu97Hg22222iq
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
metafile
91.103.252.39:7899
-
auth_value
9ac6dc6d653e5268fd38b21a0ec2b458
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
pid Process 740 legosa.exe 3016 crypted158158.exe 2476 fasfqwrqweqw.exe 2380 legosa.exe 904 legosa.exe 1912 legosa.exe 1772 legosa.exe 936 legosa.exe -
Loads dropped DLL 7 IoCs
pid Process 2572 t5489145.exe 740 legosa.exe 740 legosa.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3016 set thread context of 2848 3016 crypted158158.exe 41 PID 2476 set thread context of 1376 2476 fasfqwrqweqw.exe 44 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2624 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 2848 AppLaunch.exe 1376 vbc.exe 1376 vbc.exe 1376 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1376 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 740 2572 t5489145.exe 28 PID 2572 wrote to memory of 740 2572 t5489145.exe 28 PID 2572 wrote to memory of 740 2572 t5489145.exe 28 PID 2572 wrote to memory of 740 2572 t5489145.exe 28 PID 740 wrote to memory of 2624 740 legosa.exe 29 PID 740 wrote to memory of 2624 740 legosa.exe 29 PID 740 wrote to memory of 2624 740 legosa.exe 29 PID 740 wrote to memory of 2624 740 legosa.exe 29 PID 740 wrote to memory of 2520 740 legosa.exe 31 PID 740 wrote to memory of 2520 740 legosa.exe 31 PID 740 wrote to memory of 2520 740 legosa.exe 31 PID 740 wrote to memory of 2520 740 legosa.exe 31 PID 2520 wrote to memory of 2772 2520 cmd.exe 33 PID 2520 wrote to memory of 2772 2520 cmd.exe 33 PID 2520 wrote to memory of 2772 2520 cmd.exe 33 PID 2520 wrote to memory of 2772 2520 cmd.exe 33 PID 2520 wrote to memory of 1572 2520 cmd.exe 34 PID 2520 wrote to memory of 1572 2520 cmd.exe 34 PID 2520 wrote to memory of 1572 2520 cmd.exe 34 PID 2520 wrote to memory of 1572 2520 cmd.exe 34 PID 2520 wrote to memory of 2952 2520 cmd.exe 35 PID 2520 wrote to memory of 2952 2520 cmd.exe 35 PID 2520 wrote to memory of 2952 2520 cmd.exe 35 PID 2520 wrote to memory of 2952 2520 cmd.exe 35 PID 2520 wrote to memory of 2132 2520 cmd.exe 36 PID 2520 wrote to memory of 2132 2520 cmd.exe 36 PID 2520 wrote to memory of 2132 2520 cmd.exe 36 PID 2520 wrote to memory of 2132 2520 cmd.exe 36 PID 2520 wrote to memory of 2832 2520 cmd.exe 37 PID 2520 wrote to memory of 2832 2520 cmd.exe 37 PID 2520 wrote to memory of 2832 2520 cmd.exe 37 PID 2520 wrote to memory of 2832 2520 cmd.exe 37 PID 2520 wrote to memory of 3008 2520 cmd.exe 38 PID 2520 wrote to memory of 3008 2520 cmd.exe 38 PID 2520 wrote to memory of 3008 2520 cmd.exe 38 PID 2520 wrote to memory of 3008 2520 cmd.exe 38 PID 740 wrote to memory of 3016 740 legosa.exe 39 PID 740 wrote to memory of 3016 740 legosa.exe 39 PID 740 wrote to memory of 3016 740 legosa.exe 39 PID 740 wrote to memory of 3016 740 legosa.exe 39 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 3016 wrote to memory of 2848 3016 crypted158158.exe 41 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 740 wrote to memory of 2476 740 legosa.exe 43 PID 2476 wrote to memory of 1376 2476 fasfqwrqweqw.exe 44 PID 2476 wrote to memory of 1376 2476 fasfqwrqweqw.exe 44 PID 2476 wrote to memory of 1376 2476 fasfqwrqweqw.exe 44 PID 2476 wrote to memory of 1376 2476 fasfqwrqweqw.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\t5489145.exe"C:\Users\Admin\AppData\Local\Temp\t5489145.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F3⤵
- Creates scheduled task(s)
PID:2624
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2772
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"4⤵PID:1572
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E4⤵PID:2952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2132
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"4⤵PID:2832
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E4⤵PID:3008
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe"C:\Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe"C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Loads dropped DLL
PID:2480
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {76241F75-0964-4313-B50E-E802ECD20994} S-1-5-21-4159544280-4273523227-683900707-1000:UMAXQRGK\Admin:Interactive:[1]1⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD57db9dd5aa17476727fa4321088a26fc3
SHA1798e8db4d86bc714553ee5b715a2e49ae14887cc
SHA25684630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b
SHA5120b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b
-
Filesize
1.6MB
MD57db9dd5aa17476727fa4321088a26fc3
SHA1798e8db4d86bc714553ee5b715a2e49ae14887cc
SHA25684630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b
SHA5120b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b
-
Filesize
7.3MB
MD57278b6ce3ddda7dba2473e0392e54ea6
SHA13b406f221237fe9bfce48daa9033eda93ecc9b94
SHA2566b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49
SHA51202a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72
-
Filesize
7.3MB
MD57278b6ce3ddda7dba2473e0392e54ea6
SHA13b406f221237fe9bfce48daa9033eda93ecc9b94
SHA2566b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49
SHA51202a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72
-
Filesize
7.3MB
MD57278b6ce3ddda7dba2473e0392e54ea6
SHA13b406f221237fe9bfce48daa9033eda93ecc9b94
SHA2566b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49
SHA51202a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
1.6MB
MD57db9dd5aa17476727fa4321088a26fc3
SHA1798e8db4d86bc714553ee5b715a2e49ae14887cc
SHA25684630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b
SHA5120b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b
-
Filesize
7.3MB
MD57278b6ce3ddda7dba2473e0392e54ea6
SHA13b406f221237fe9bfce48daa9033eda93ecc9b94
SHA2566b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49
SHA51202a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72
-
Filesize
314KB
MD55ebd49060b21946157c3340c680769d0
SHA1435b9e144da84d8ffa40b490d081e1d20947ee0b
SHA256b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8
SHA5125b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651