Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/09/2023, 03:00
Static task
static1
Behavioral task
behavioral1
Sample
a5d2a7d53aeeac4f0812340e159d8c66.exe
Resource
win7-20230831-en
General
-
Target
a5d2a7d53aeeac4f0812340e159d8c66.exe
-
Size
755KB
-
MD5
a5d2a7d53aeeac4f0812340e159d8c66
-
SHA1
5f1f46a6a557656ca04f562c07f2cb7084c6b094
-
SHA256
e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9
-
SHA512
0a6df7c1dc7b68574249b1c878c0be8ebe2ee3cd9161dff385139f33ec1ba54f07b0af3a6f426040926771060c5393aec177ad247ba5d46401a549fc9c8423f4
-
SSDEEP
12288:U9UPHFtND4ZIrsHWihcF4JJTnJQZgplDliDDmNGkMAJIJ6zcRSdiuVHJ/R/++Bm0:U9qFtp6xWFkJ2ZSDYDc9MAJdPV7+ymFm
Malware Config
Extracted
redline
cheat
45.137.22.116:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/1436-41-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1436-42-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1436-45-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1436-50-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1436-48-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 6 IoCs
resource yara_rule behavioral1/memory/1436-41-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1436-42-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1436-45-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1436-50-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1436-48-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/3008-55-0x00000000025E0000-0x0000000002620000-memory.dmp family_sectoprat -
Executes dropped EXE 2 IoCs
pid Process 2780 PO.exe 1436 PO.exe -
Loads dropped DLL 5 IoCs
pid Process 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 2780 PO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2780 set thread context of 1436 2780 PO.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2424 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3008 powershell.exe 1436 PO.exe 1436 PO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1436 PO.exe Token: SeDebugPrivilege 3008 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1360 DllHost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2780 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 29 PID 1992 wrote to memory of 2780 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 29 PID 1992 wrote to memory of 2780 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 29 PID 1992 wrote to memory of 2780 1992 a5d2a7d53aeeac4f0812340e159d8c66.exe 29 PID 2780 wrote to memory of 3008 2780 PO.exe 32 PID 2780 wrote to memory of 3008 2780 PO.exe 32 PID 2780 wrote to memory of 3008 2780 PO.exe 32 PID 2780 wrote to memory of 3008 2780 PO.exe 32 PID 2780 wrote to memory of 2424 2780 PO.exe 34 PID 2780 wrote to memory of 2424 2780 PO.exe 34 PID 2780 wrote to memory of 2424 2780 PO.exe 34 PID 2780 wrote to memory of 2424 2780 PO.exe 34 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36 PID 2780 wrote to memory of 1436 2780 PO.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d2a7d53aeeac4f0812340e159d8c66.exe"C:\Users\Admin\AppData\Local\Temp\a5d2a7d53aeeac4f0812340e159d8c66.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uWOFfhD.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uWOFfhD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5CD.tmp"3⤵
- Creates scheduled task(s)
PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
83KB
MD5016025125f3b479aaabf8a4246073856
SHA1123cf64214f2ba96dedc076d388ddf60d2ec5ce5
SHA25639f3195908d56ee6d4d0f6484c913bbb268e934121856c590b397bbf7a3573ca
SHA5124c83f010593e2ec86de367653a0c03aad7a41d1a7f6e26e302666ee81b6f4f4841e3395a026856e35ba9d092ef530af0756b4adb13e944dd7a0d5d5b64ddc62b
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD55f358a4b656915069dae00d3580004a1
SHA1c81e8b6f220818370d47464210c07f0148e36049
SHA2568917aa7c60dc0d81231fb4be80a0d7b0e934ea298fb486c4bad66ef77bebcf5a
SHA512d63ebd45d31f596a5c8f4fcc816359a24cbf2d060cb6e6a7648abaf14dc7cf76dda3721c9d19cb7e84eaeb113a3ee1f7be44b743f929de05c66da49c7ba7e97d
-
Filesize
1KB
MD5ff3974ec711230dacd8ae8073ba6eb90
SHA145e2d78574350998a1b2b9b50ba53b0f897f624c
SHA2568eeae62023facd2bfca115b40a9944f64358b8ca9b9934867d4cfe6e2c414ba5
SHA51208f76d6f1f10781810b4c89f6a79fa324a7207efce2ab5c51a5d1fd19145600c397f0f48800a835225a47a74d3e892e76f31c2c572b7ebf271e4599c011aa523
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf
-
Filesize
497KB
MD512c97a400062791db05e2f6324e648f8
SHA178cc96b66da815798467328126bbcb4c4cf4ea3b
SHA256d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3
SHA51292e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf