Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
05/11/2023, 21:37
General
-
Target
empyra-setup.exe
-
Size
51.5MB
-
MD5
37ce00f8e12de66ae06cd62bf019bd99
-
SHA1
0b2dcd13bd84908c1f737de9e3f2cb9c7836a95e
-
SHA256
50f7819d7c68fa53847985279243b2cc8fe7489b9fef4354dddee05e57891361
-
SHA512
f15a1501af455cf1ce2a0591ac861eef33515b07e0ca92ee18043b37d72a640acab17d77a0813e60bab23fbb04c805288f6a21892280c959cc910280255829d0
-
SSDEEP
786432:b4wGjlJrrrK0WObuBKm4/3j1l62v7CkAwBMzD1BxtTVDLMiQP:Sl1rrEZlil62WkAoGZxdLMd
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
.NET Reactor proctector 7 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 13 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 17 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\empyra-setup.exe"C:\Users\Admin\AppData\Local\Temp\empyra-setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JN73G.tmp\empyra-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-JN73G.tmp\empyra-setup.tmp" /SL5="$70122,53193244,1047040,C:\Users\Admin\AppData\Local\Temp\empyra-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Empyra Defi\Installer.exe"C:\Program Files (x86)\Empyra Defi\Installer.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\VMware2⤵
-
-
C:\Users\Admin\AppData\Local\VMware\vmware.exe"C:\Users\Admin\AppData\Local\VMware\vmware.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming2⤵
-
-
C:\Users\Admin\AppData\Local\VMware\vmwarehost.exe"C:\Users\Admin\AppData\Local\VMware\vmwarehost.exe"2⤵
-
C:\Users\Admin\AppData\Local\VMware\vmwarehost.exeC:\Users\Admin\AppData\Local\VMware\vmwarehost.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172.7MB
MD5a018ce91c942a3fb149966a0ee51c738
SHA1120561064106e32c21d15711b93a9c0a09bda96c
SHA25644b12034203412af0b1e37aa4efc700c6329186a7e3e3ca1bd8a9852c0147fd8
SHA5127d324a07902319b4df5730341ea960b5fb1d959a7eb28a298839c26a1979a5f34e7ed5d762b6c8dc0a23b4b8205d2470e1f6c0c5657bb4be72486463a07a1d96
-
Filesize
136.5MB
MD50847291e81e75e0d507b319bcec64f06
SHA1af0d6ceadaeaba87e6a4c002cb7ae2601688988a
SHA2563889099e38c5dd0aaad2713cabbd91c48eaf72d4347bc4c798b812a2da11cb64
SHA5126394b3dc6bf0b6dc9b56c0ea98954b79b87778560604fdb2fa6985f8f80807ef678b6ee566c865d563f4aab77c045c9a1af7fe097679387630ae16a99f22ced5
-
Filesize
135.5MB
MD505185130342fe0a05e66d2f469f21efa
SHA1b9705b1b71d6e53e9481c8b6a2f9be53f51bded4
SHA2561f5f574ecbe8821fa1ca31a8d9e6f6c2692c89da3d53f33aaf9caac61e5e055d
SHA51294712314da4b20e509c77dcd9306f798d1666f000f9a4602ef51ac5c35de56eb9f0c3960914a207c55ffe4ec1e90eabc65dc708dc8b35c1855fa7e7718845290
-
Filesize
344B
MD59548e195191b3ce4967dbc3aaee01229
SHA1a09d563b08be82a932c011b7ae3e3ac0760cbc1e
SHA256317d22efce0440e7bc02e2136a08dd03a30a13bf8ec027156a8320599e5e7d01
SHA51222d4978fab7f0c4ccc52e9467b212195cdb24d897f4ded9df5c041eeef4e49f71e0c1d564b704e4d812002d84fb44c62df198a4dc74c0526024dd67fa2f2b39e
-
Filesize
344B
MD57203bf18c2f0341b0bbb0e80a3f8e2ec
SHA149ebf02fcec434f040bf71c5c99b1a579fb8cf8a
SHA25664562d723bb25aff6d689c885de9755c3e437cf29397161af27e7cf29b5422b4
SHA5121805c7cf77938c6192ab8c874c3118d00f94a39b0140344b51304136f38e6a7468bab2f129e63a581632e25685074f4e372cf2fe68fb3a9e10d01fca9714b0d8
-
Filesize
344B
MD5aec7938dccad7e19d37a364e4c0e0288
SHA199c92b98c0341a2f36f95bc9ff23da474729a570
SHA256ad916532b00695fd3947aafa81c3fed6895f7832acb1abf226fd744829baa5a9
SHA51260282923293196595d53ff256e43f5ff6859b21fa13fde42aa8c7bad9c3c16060dea5f67d661882e377c2d002e9b2a65f82dc19551f64f1870df71d4076bd466
-
Filesize
344B
MD57f6965d8d14c030c550399875d170cce
SHA13b6a9eec756b0518a7527b5a257220c3476d3588
SHA256baea4094c58e534ce325778ef61550c87dc3dea4213b386d869e7f61d745e4a3
SHA5125b274ce83bd4c0942e73240ffd74c9d137df4dce9360dbdef87e008b17a212ec599cee350a28bea80cb3cbf9e5efaff74a3581127b5a4b6100e3bb32fa6fad67
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
3.2MB
MD52651781ab0f18e494c67806c48ac1e7b
SHA19dfbcf98285a9be20abcf7a139610e7a7239eb6a
SHA256f7a17e81522dfadf4862ce5db15812e5f5c54f357dccdf44774c459d2e8f1f96
SHA512b02bc395bb5085285f7b6551a51b581dad1e4c8afd9fdca6ff3bb5277c4ad58ded5ecc6f2eef19451cad3d50f10c5c13e2ca971f631333292f91a4fce06876e4
-
Filesize
3.2MB
MD52651781ab0f18e494c67806c48ac1e7b
SHA19dfbcf98285a9be20abcf7a139610e7a7239eb6a
SHA256f7a17e81522dfadf4862ce5db15812e5f5c54f357dccdf44774c459d2e8f1f96
SHA512b02bc395bb5085285f7b6551a51b581dad1e4c8afd9fdca6ff3bb5277c4ad58ded5ecc6f2eef19451cad3d50f10c5c13e2ca971f631333292f91a4fce06876e4
-
Filesize
3.8MB
MD5311637067e7fcfffa6d906388dd8fb3d
SHA109616192e9be85eaf231b3f53a8b26ac63d5f4d5
SHA25673e1628a5fb070f76bdbef18c6b4602f6bc0edb7744384076ac565fd47fea202
SHA5124ea8c8708dc39d440c39c8c8a6f7bd756ea51ec9015e59994dec47a8e0ff646d216c601a9303c8c1637499facb9af2d0a83a91e62990e237b00ea275b5adfb2d
-
Filesize
3.8MB
MD5311637067e7fcfffa6d906388dd8fb3d
SHA109616192e9be85eaf231b3f53a8b26ac63d5f4d5
SHA25673e1628a5fb070f76bdbef18c6b4602f6bc0edb7744384076ac565fd47fea202
SHA5124ea8c8708dc39d440c39c8c8a6f7bd756ea51ec9015e59994dec47a8e0ff646d216c601a9303c8c1637499facb9af2d0a83a91e62990e237b00ea275b5adfb2d
-
Filesize
4.6MB
MD5589f9892387ec051b8e19dd84c017c76
SHA15c443715c10be47a29c80083890d5ad89f7daaed
SHA2560fe0dcd144ea2345471d0dc1a173396ec985102abacc7c247c7db3899a7ea1a4
SHA51292e4404c813852185a82c7a65adad1d1f703be5f32eaf7682937bddbc53e794d084877b01e38aba3ec9baa74f02016a97e33a3044cb7e0cd3158cbb22060432a
-
Filesize
4.6MB
MD5589f9892387ec051b8e19dd84c017c76
SHA15c443715c10be47a29c80083890d5ad89f7daaed
SHA2560fe0dcd144ea2345471d0dc1a173396ec985102abacc7c247c7db3899a7ea1a4
SHA51292e4404c813852185a82c7a65adad1d1f703be5f32eaf7682937bddbc53e794d084877b01e38aba3ec9baa74f02016a97e33a3044cb7e0cd3158cbb22060432a
-
Filesize
4.6MB
MD5589f9892387ec051b8e19dd84c017c76
SHA15c443715c10be47a29c80083890d5ad89f7daaed
SHA2560fe0dcd144ea2345471d0dc1a173396ec985102abacc7c247c7db3899a7ea1a4
SHA51292e4404c813852185a82c7a65adad1d1f703be5f32eaf7682937bddbc53e794d084877b01e38aba3ec9baa74f02016a97e33a3044cb7e0cd3158cbb22060432a
-
Filesize
7KB
MD57b66dd3b8caa6a5730193dd63dec8f4a
SHA1da2bbd8e690f801e4fc2777b4826a238b50d0a79
SHA2568bb92b93bc1bbcfa1b25f3dd7c054147213a3a94905cba5b7484504c13e04abb
SHA512b9ba597183cd499c2fec32ab3e2498529aeddc80614bfca61996d7d9166634b56b6dc84fa0da3816bbdde7f0ff080b5b3850f2ea84fea386eac480412c26d135
-
Filesize
7KB
MD57b66dd3b8caa6a5730193dd63dec8f4a
SHA1da2bbd8e690f801e4fc2777b4826a238b50d0a79
SHA2568bb92b93bc1bbcfa1b25f3dd7c054147213a3a94905cba5b7484504c13e04abb
SHA512b9ba597183cd499c2fec32ab3e2498529aeddc80614bfca61996d7d9166634b56b6dc84fa0da3816bbdde7f0ff080b5b3850f2ea84fea386eac480412c26d135
-
Filesize
158.2MB
MD58b3d4ae2005593ab8075fe7b5b282e3b
SHA19cfc438c3668ae31dc50db4c4fddaabfb30a50e0
SHA25626b9bbd3b69c8c175689d8091d683879198d6379c045b9e624901f1e0f750663
SHA512757185a5b3225d56d4f3fcca7a74e4e1db1e1c4cae5641680fd39d09018d40fa9ebf35431fcf7f43b7dddd381e7f0406faa01bd15a7c0088251d39af77a077e5
-
Filesize
154.3MB
MD5edfb09056074222e9d77e5be3350b64e
SHA1fe377e96c09c8ceb28e7f5c1ef0803a2d8fbd2d1
SHA256bcbba66875130c1a94284f203b46ec1f02f470ad6b32ba3dc563597ea1316aa5
SHA512878dec9266d5553d59a3d1cbe584e0138eef5aaab6199ec41c7f387e84da52f30c7c973daeff509bde7482409b323ecad050b99eb59ec2ceb065b6776db2834c
-
Filesize
152.2MB
MD524187e43588ef6c202e2f734d9acbcda
SHA1076253eda37d9f4cfbf19fc37bf83ee050fdc6bc
SHA2566b301f1f1e7ea035aaf3bd734971e6913068d63fcad3f71fe7a543fe47c884f7
SHA5128b3fac6107f59abd86ebe9108317a211a388464f32d29dbac9a65d2a78f83c6e544b14a8383a730f2ff0e5f77e21a450295b89b7211582c49aed75a96b62ab07
-
Filesize
151.1MB
MD5990efdf8385f3436a9b33bdf5659a69b
SHA107f84653a83249cfbf7d4bd964d1334c11489ae2
SHA2560ae85b529a926b142680d418f09687db89a45b28450d392351c6c95c1f0f8135
SHA5127de43a5e740b8d1735691b9413e720955089cb849b87af8a738f4fc395d66360aedd381ace21d3e622b2f92f5e972f884754316a42908073fd7ac33ea51d2eb6
-
Filesize
149.8MB
MD55120662e1fa5c4684b8c604d7ad3372b
SHA1b341a063f5b58066c4f451fe0b940628c01bba1e
SHA2568ced6c0d963c16e17accd6959569604a93641bd2fd032e135417e9f27777b1a8
SHA5128e6fdfbce4553a666d7056dac356acfb884a7f02cbc6c5e9ca9c5016f4e8985bb52ec99fe5c641be254d10d084664aa972ac7e7722089c9c74843c5b495f16bb
-
Filesize
151.1MB
MD5990efdf8385f3436a9b33bdf5659a69b
SHA107f84653a83249cfbf7d4bd964d1334c11489ae2
SHA2560ae85b529a926b142680d418f09687db89a45b28450d392351c6c95c1f0f8135
SHA5127de43a5e740b8d1735691b9413e720955089cb849b87af8a738f4fc395d66360aedd381ace21d3e622b2f92f5e972f884754316a42908073fd7ac33ea51d2eb6
-
Filesize
142.7MB
MD5c098299317b451fdae16751f79ac0c06
SHA15d0930dd8e00bb7a887835f923c27d2d14512998
SHA2563f2c9fc03e5d975cded639e6abc7827e3d5daaeb61a952522e38fa8fd4cb766f
SHA512d223df68b0907b4e85c8615aa303b25d7b515fb36a375b6a07d407721567c1e690387e37188f8b37f26ff6f1cf785524df311d539e41bc8090899174147d69f1
-
Filesize
141.6MB
MD54b211d9a8bdfe9243e950f41cf713996
SHA136edca15e81544f6055da2f5048a6327e7695486
SHA2561943c5fa6c56adc6724f65d6f56dfb0231764905547b2502a8cc5de96af4cce1
SHA5124862dd44a710f49cf8242da8308a6424146fc5fa7fd2e1a389494df0ed014d0e1f09a7a94cd2a37e129f427007daaf4487b69cc5cc66f6338a2a4157dfd9293e
-
Filesize
3.2MB
MD5d883b9cc961697a9c21a8358a772e731
SHA156c0c8f30577cf90031298bc5501608e335acaab
SHA256aea0b51e82b9595506b5ebd7a70f5fd94ba34bbd37f7bae29a6c0e413a5ca6be
SHA5121472cfa69c98631f57dfe9257847f960e61f084696327a8bdc2131db62931844f9be05eded23784b972edbed39b812d5489e5458823fd81638064a94d5718e3b
-
Filesize
4.7MB
MD503a60a6652caf4f49ea5912ce4e1b33c
SHA1a0d949d4af7b1048dc55e39d1d1260a1e0660c4f
SHA256b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3
SHA5126711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4
-
Filesize
1.2MB
MD5d55999f0c7253cb904ae1673929a22ea
SHA1cd8cfe2e50fec74bc89b10fd107f0d1c636b135f
SHA25652b9415d61f9d19eb33561512b100969fc7d261586b4b24e3a36baa416afce00
SHA51291efade068f125971b002d8e15592d6c56d8946dcceca879a7155769862ae3d00ea64623bb5a2857d95b7a75e77e5568b4e9815cc1a80be6b11d3db813d29d29
-
Filesize
1.9MB
MD5f2a012b7a561162524efdb2dcffc05de
SHA1732c4c23e6cbc9f331dc466bc7555fbdaa556837
SHA256e27478b5b977331c8de319d752f7f728501480c6de377fb78ea3ed48bfa92894
SHA5123b6165bf9361a60aa20f08a404f857727bc97cfa5f7de951c0fce0c8bc28474b8942f91bad2c0e0888a4253e2f9da204bf525c4492a1682a6f2b648d1b8a0ac4
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
3.2MB
MD52651781ab0f18e494c67806c48ac1e7b
SHA19dfbcf98285a9be20abcf7a139610e7a7239eb6a
SHA256f7a17e81522dfadf4862ce5db15812e5f5c54f357dccdf44774c459d2e8f1f96
SHA512b02bc395bb5085285f7b6551a51b581dad1e4c8afd9fdca6ff3bb5277c4ad58ded5ecc6f2eef19451cad3d50f10c5c13e2ca971f631333292f91a4fce06876e4
-
Filesize
392KB
-
Filesize
2.2MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1.6MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
3.8MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
320KB
-
Filesize
9.4MB
-
Filesize
320KB
-
Filesize
9.4MB
-
Filesize
84.1MB
-
Filesize
40KB
-
Filesize
128KB
-
Filesize
4.1MB
-
Filesize
5.8MB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
128KB
-
Filesize
3.3MB
-
Filesize
576KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4.6MB
-
Filesize
256KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB