Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2023, 03:00

General

  • Target

    a5d2a7d53aeeac4f0812340e159d8c66.exe

  • Size

    755KB

  • MD5

    a5d2a7d53aeeac4f0812340e159d8c66

  • SHA1

    5f1f46a6a557656ca04f562c07f2cb7084c6b094

  • SHA256

    e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9

  • SHA512

    0a6df7c1dc7b68574249b1c878c0be8ebe2ee3cd9161dff385139f33ec1ba54f07b0af3a6f426040926771060c5393aec177ad247ba5d46401a549fc9c8423f4

  • SSDEEP

    12288:U9UPHFtND4ZIrsHWihcF4JJTnJQZgplDliDDmNGkMAJIJ6zcRSdiuVHJ/R/++Bm0:U9qFtp6xWFkJ2ZSDYDc9MAJdPV7+ymFm

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.116:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5d2a7d53aeeac4f0812340e159d8c66.exe
    "C:\Users\Admin\AppData\Local\Temp\a5d2a7d53aeeac4f0812340e159d8c66.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uWOFfhD.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3008
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uWOFfhD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5CD.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2424
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1436
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabA40.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

    Filesize

    83KB

    MD5

    016025125f3b479aaabf8a4246073856

    SHA1

    123cf64214f2ba96dedc076d388ddf60d2ec5ce5

    SHA256

    39f3195908d56ee6d4d0f6484c913bbb268e934121856c590b397bbf7a3573ca

    SHA512

    4c83f010593e2ec86de367653a0c03aad7a41d1a7f6e26e302666ee81b6f4f4841e3395a026856e35ba9d092ef530af0756b4adb13e944dd7a0d5d5b64ddc62b

  • C:\Users\Admin\AppData\Local\Temp\TarA81.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Local\Temp\tmp1527.tmp

    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

  • C:\Users\Admin\AppData\Local\Temp\tmp154D.tmp

    Filesize

    92KB

    MD5

    5f358a4b656915069dae00d3580004a1

    SHA1

    c81e8b6f220818370d47464210c07f0148e36049

    SHA256

    8917aa7c60dc0d81231fb4be80a0d7b0e934ea298fb486c4bad66ef77bebcf5a

    SHA512

    d63ebd45d31f596a5c8f4fcc816359a24cbf2d060cb6e6a7648abaf14dc7cf76dda3721c9d19cb7e84eaeb113a3ee1f7be44b743f929de05c66da49c7ba7e97d

  • C:\Users\Admin\AppData\Local\Temp\tmpE5CD.tmp

    Filesize

    1KB

    MD5

    ff3974ec711230dacd8ae8073ba6eb90

    SHA1

    45e2d78574350998a1b2b9b50ba53b0f897f624c

    SHA256

    8eeae62023facd2bfca115b40a9944f64358b8ca9b9934867d4cfe6e2c414ba5

    SHA512

    08f76d6f1f10781810b4c89f6a79fa324a7207efce2ab5c51a5d1fd19145600c397f0f48800a835225a47a74d3e892e76f31c2c572b7ebf271e4599c011aa523

  • \Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • \Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • \Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • \Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • \Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

    Filesize

    497KB

    MD5

    12c97a400062791db05e2f6324e648f8

    SHA1

    78cc96b66da815798467328126bbcb4c4cf4ea3b

    SHA256

    d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

    SHA512

    92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

  • memory/1360-5-0x0000000000120000-0x0000000000122000-memory.dmp

    Filesize

    8KB

  • memory/1360-26-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1360-6-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1436-58-0x0000000073490000-0x0000000073B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/1436-42-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1436-54-0x0000000073490000-0x0000000073B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/1436-56-0x0000000004B70000-0x0000000004BB0000-memory.dmp

    Filesize

    256KB

  • memory/1436-39-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1436-40-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1436-41-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1436-66-0x0000000004B70000-0x0000000004BB0000-memory.dmp

    Filesize

    256KB

  • memory/1436-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1436-175-0x0000000073490000-0x0000000073B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/1436-45-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1436-50-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1436-48-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1992-4-0x0000000000DD0000-0x0000000000DD2000-memory.dmp

    Filesize

    8KB

  • memory/2780-22-0x0000000000910000-0x0000000000992000-memory.dmp

    Filesize

    520KB

  • memory/2780-52-0x0000000073490000-0x0000000073B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2780-30-0x00000000021C0000-0x0000000002218000-memory.dmp

    Filesize

    352KB

  • memory/2780-29-0x00000000004B0000-0x00000000004BE000-memory.dmp

    Filesize

    56KB

  • memory/2780-28-0x0000000004650000-0x0000000004690000-memory.dmp

    Filesize

    256KB

  • memory/2780-27-0x0000000073490000-0x0000000073B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2780-25-0x00000000003D0000-0x00000000003E4000-memory.dmp

    Filesize

    80KB

  • memory/2780-24-0x0000000004650000-0x0000000004690000-memory.dmp

    Filesize

    256KB

  • memory/2780-21-0x0000000073490000-0x0000000073B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/3008-53-0x000000006E300000-0x000000006E8AB000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-55-0x00000000025E0000-0x0000000002620000-memory.dmp

    Filesize

    256KB

  • memory/3008-51-0x000000006E300000-0x000000006E8AB000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-57-0x000000006E300000-0x000000006E8AB000-memory.dmp

    Filesize

    5.7MB