Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2023, 03:09

General

  • Target

    0x0007000000014970-113.exe

  • Size

    37KB

  • MD5

    cc479b599784116184dd5528c2903adb

  • SHA1

    4331d7dc0fdeb8ff344862928f0d1f0d02b05ccc

  • SHA256

    a898b42ab81022e5adc0d8d69dc7b0a0eec30eb122d0024f3e28334bd134e3eb

  • SHA512

    a0fd422cae04b37242362f941b048d3b3e7526a2ff1dcfe7702bd815b97c759909e9c5fcbcd11aca3b67a0595a2e6e87f25c71ad4906d460f3481e0a24ad9ef5

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0007000000014970-113.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0007000000014970-113.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2852
  • C:\Users\Admin\AppData\Local\Temp\EE45.exe
    C:\Users\Admin\AppData\Local\Temp\EE45.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2680
  • C:\Users\Admin\AppData\Local\Temp\F2F7.exe
    C:\Users\Admin\AppData\Local\Temp\F2F7.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
      2⤵
      • Executes dropped EXE
      PID:2260
      • C:\Users\Admin\AppData\Local\Temp\Broom.exe
        C:\Users\Admin\AppData\Local\Temp\Broom.exe
        3⤵
          PID:1940
      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
        2⤵
        • Executes dropped EXE
        PID:752
        • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
          "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
          3⤵
            PID:320
        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
          2⤵
            PID:2796
          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
            "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
            2⤵
              PID:2032
              • C:\Users\Admin\AppData\Local\Temp\is-TIC7J.tmp\tuc3.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-TIC7J.tmp\tuc3.tmp" /SL5="$801F0,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                3⤵
                  PID:1044
              • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                2⤵
                  PID:956
              • C:\Users\Admin\AppData\Local\Temp\F910.exe
                C:\Users\Admin\AppData\Local\Temp\F910.exe
                1⤵
                • Executes dropped EXE
                PID:2248
              • C:\Users\Admin\AppData\Local\Temp\4637.exe
                C:\Users\Admin\AppData\Local\Temp\4637.exe
                1⤵
                  PID:2692
                • C:\Windows\system32\makecab.exe
                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231211031134.log C:\Windows\Logs\CBS\CbsPersist_20231211031134.cab
                  1⤵
                    PID:2536
                  • C:\Users\Admin\AppData\Local\Temp\5008.exe
                    C:\Users\Admin\AppData\Local\Temp\5008.exe
                    1⤵
                      PID:2612

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                      Filesize

                      4.2MB

                      MD5

                      f81be07058935d224ab3843bff94fec0

                      SHA1

                      1a7360901f8cb5017f7a41ca1a6984227b712b16

                      SHA256

                      8d4df79cf6bf1cb8285b7358a7c6d92c7f665065999934b24c1175311d99fb6c

                      SHA512

                      342b2c767af972819c57091e9d9d65578522fa48549b6c40aad6791b0c65e186b377e3f095458e8b5d873ffdadd73897252a13bead652bd74a09540d2c27c96e

                    • C:\Users\Admin\AppData\Local\Temp\4637.exe

                      Filesize

                      1024KB

                      MD5

                      e27d09606853bd7cc337c2d338854824

                      SHA1

                      8a91c95ff2e6b5983c936c5a0ee11586d1dfeb70

                      SHA256

                      17acc7dd07b27037a73924112cc45711d2c6659d5101c0e8606957f2f36303d7

                      SHA512

                      5ed4e4510731c31cf34cf14628b7ac997b4d445bda754084f79e24df2e2d2118ff49ad3de1125f2fd8011b2a7161e3c14a3b658dc15f03a9eb572996c80631b2

                    • C:\Users\Admin\AppData\Local\Temp\4637.exe

                      Filesize

                      2.1MB

                      MD5

                      f46fcdf3b8d78523a59981d45ad725f1

                      SHA1

                      06507e670624f3a363ef4e1c1271d784e82e0d07

                      SHA256

                      e716d2e4f1d37f5d9be93b3ecc8a7c5e1621344988ddc34729f2ac2505f940d0

                      SHA512

                      1d765b8c013b26b636430f318f519168e5914734e999efffe4d5d7fa30e35d39adabd91f86192449e2a2b5e93bcf49d34f28995b5f56158725d3223969d14b64

                    • C:\Users\Admin\AppData\Local\Temp\EE45.exe

                      Filesize

                      401KB

                      MD5

                      f88edad62a7789c2c5d8047133da5fa7

                      SHA1

                      41b1f056cdda764a1c7c402c6fa4f8ab2f3ce5f9

                      SHA256

                      eb2b1ce5574096b91eb9e0482117d2518ab188c0747a209dc77e88d30bb970dc

                      SHA512

                      e2d5b0ace5dfd3bd2321b2a42b7e7725071ca440389dc5ef12720a34727ae84c2907cd7befeae5d53568d9deaee8443f4cbda44b598cfc9b6316d9389be09a60

                    • C:\Users\Admin\AppData\Local\Temp\F2F7.exe

                      Filesize

                      7.2MB

                      MD5

                      667ddbcd2147d72d85fe6021270456be

                      SHA1

                      cffb27c5e80163d054366814b209845660bdd412

                      SHA256

                      5956997af14c1707ef6f1dcc5ba1d9593b42d21f2894dacaa4c4adff15fac24c

                      SHA512

                      0d6a081de7eb30013e9c91a264ad83e3218696038b89fb25d1edd284d36ad90679cdd83ce191cb68014eb325c56076810f3110158bbcf5641a74a382804ce90d

                    • C:\Users\Admin\AppData\Local\Temp\F2F7.exe

                      Filesize

                      12.7MB

                      MD5

                      ed3235f559c31f0b2f8fe8698c53ba0b

                      SHA1

                      a25237f9144ea8d64a24517c24dfe05acde53f68

                      SHA256

                      6c0b520c69ff3cbbed8c2172842461996affee4db79047d2a662680ed0b90cb3

                      SHA512

                      e305ce2388f29003ec334fb9a853edabab7837c6879b95b79bcdd332eb80dc31bd521e7c20d21dbd258be767f1cc8ddebebf90b5a9355cd3e149e1d8cd13e5d5

                    • C:\Users\Admin\AppData\Local\Temp\F910.exe

                      Filesize

                      219KB

                      MD5

                      91d23595c11c7ee4424b6267aabf3600

                      SHA1

                      ef161bb8e90cebdf81f4e53dfccb50c1f90a9a02

                      SHA256

                      d58937d468f6ca92b12ee903a16a4908de340f64f894cf7f1c594cd15c0c7e47

                      SHA512

                      cb9ed75c14e7b093cabab66c22d412371c639ace31fbe976c71ffec6007bf85b3d7d3e591fe5612e2a035298398d32e1aa7dc0d753f93328ebc2ce8e44fb8d2b

                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                      Filesize

                      2.3MB

                      MD5

                      77471d919a5e2151fb49f37c315af514

                      SHA1

                      0687047ed80aa348bdc1657731f21181995b654c

                      SHA256

                      52666594a3e8bd7ac277411e215e1f65a7771f7c1d5b00a9e6ec95fade64f1f1

                      SHA512

                      6ffb45e79b03bac2820c98503793cd11c13803f49522eea9334c4c6cd05384dda3a60b0a8a8f363abc439ad444f1a8da290f0350fa69b75b6c3c9701177f8844

                    • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                      Filesize

                      8.3MB

                      MD5

                      1f40433778e799319ae0ece36d28f00f

                      SHA1

                      4ce947e15182e61e379fbfbf52b6625cb0528c69

                      SHA256

                      1d360b097bfd95b5e6312350928af25631973ff1ddfce7835ac5c8b239b9e58c

                      SHA512

                      30e0d4d61dd4535f7e09a0e0d49691dbb9f99ed54f01b4b898eb786b466cdba34e170677887831daa5e6f98bf2f0d8ca7729a2bf7949ee0ac043a617b419030f

                    • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                      Filesize

                      2.2MB

                      MD5

                      b6c38a18341a71ef49e2503b9e28d6b0

                      SHA1

                      d25490d3f37dc2864f0d8629de97d51002dcdd2f

                      SHA256

                      b42c516ac25153cac5de0f44a7ad81cd17b19aecbba650f42187e0c225992173

                      SHA512

                      eb54ceef102209534bbe869619f95ecc8408ce5e9db42b0981484cd3b8e90fa254d77c09500edd63e4364a95a9aa913f8272d17287eca799847a3410213685d4

                    • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                      Filesize

                      3.2MB

                      MD5

                      7e41a1c24fc929332c543bbfcfe35e1c

                      SHA1

                      24bac343b1f9274d58000338ad6ca952d279e506

                      SHA256

                      a74afcff220ef3684c8f4422fd6448d17b26559d8dcd334c2c94251fc7308bbe

                      SHA512

                      3eaf8594fdfc130d3e77bcce87352f31e2bb9a12f099c05aaf5e1c4ac84fc9385267c859882ae1bb674878630d8517c26448c765e52a4dbb53e77512f71bd611

                    • \Users\Admin\AppData\Local\Temp\Broom.exe

                      Filesize

                      5.3MB

                      MD5

                      00e93456aa5bcf9f60f84b0c0760a212

                      SHA1

                      6096890893116e75bd46fea0b8c3921ceb33f57d

                      SHA256

                      ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

                      SHA512

                      abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

                    • \Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                      Filesize

                      11KB

                      MD5

                      365de00b65f84a0a49222348d94e6c6e

                      SHA1

                      f83f943fad3a48790665c1805f8d0d91c6f843af

                      SHA256

                      51f9235838aa532c33cdfb629e9e14a3e67718937a923d3ebd92aa95fbb20884

                      SHA512

                      477cf931e65be79a061568c4c1b7d60b5998d6db046b642625ba2e2ee85bd7a46e537be317ab32c97ba2b8458bd2b4a0ac441894a6a3379ae543cfbdae0ca848

                    • \Users\Admin\AppData\Local\Temp\is-04Q0F.tmp\_isetup\_iscrypt.dll

                      Filesize

                      2KB

                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    • \Users\Admin\AppData\Local\Temp\is-04Q0F.tmp\_isetup\_isdecmp.dll

                      Filesize

                      13KB

                      MD5

                      a813d18268affd4763dde940246dc7e5

                      SHA1

                      c7366e1fd925c17cc6068001bd38eaef5b42852f

                      SHA256

                      e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

                      SHA512

                      b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

                    • \Users\Admin\AppData\Local\Temp\is-04Q0F.tmp\_isetup\_shfoldr.dll

                      Filesize

                      22KB

                      MD5

                      92dc6ef532fbb4a5c3201469a5b5eb63

                      SHA1

                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                      SHA256

                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                      SHA512

                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                    • \Users\Admin\AppData\Local\Temp\is-TIC7J.tmp\tuc3.tmp

                      Filesize

                      694KB

                      MD5

                      5525670a9e72d77b368a9aa4b8c814c1

                      SHA1

                      3fdad952ea00175f3a6e549b5dca4f568e394612

                      SHA256

                      1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

                      SHA512

                      757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

                    • \Users\Admin\AppData\Local\Temp\latestX.exe

                      Filesize

                      5.6MB

                      MD5

                      bae29e49e8190bfbbf0d77ffab8de59d

                      SHA1

                      4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                      SHA256

                      f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                      SHA512

                      9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                    • \Users\Admin\AppData\Local\Temp\toolspub2.exe

                      Filesize

                      291KB

                      MD5

                      cde750f39f58f1ec80ef41ce2f4f1db9

                      SHA1

                      942ea40349b0e5af7583fd34f4d913398a9c3b96

                      SHA256

                      0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                      SHA512

                      c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                    • \Users\Admin\AppData\Local\Temp\tuc3.exe

                      Filesize

                      7.7MB

                      MD5

                      721a2a56d2af016ce1e41d2056ee1e9a

                      SHA1

                      eb1414043ebf9d798e4b9e42d20a8e58558bdba5

                      SHA256

                      3ebb1be7ccf08f80925e4226f6af454f3c98f39a62c0d1c7a002435df9425d0c

                      SHA512

                      342dee4d905714b182e3eb167638167f2f77d785ca839866d2ae5361796cdad823fd57006a7106836910d3180f1d1eabb1c6c7e9bea6ee7312a0708d2124fc85

                    • memory/320-134-0x0000000000400000-0x0000000000409000-memory.dmp

                      Filesize

                      36KB

                    • memory/320-108-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                    • memory/320-123-0x0000000000400000-0x0000000000409000-memory.dmp

                      Filesize

                      36KB

                    • memory/320-126-0x0000000000400000-0x0000000000409000-memory.dmp

                      Filesize

                      36KB

                    • memory/752-109-0x0000000000220000-0x0000000000229000-memory.dmp

                      Filesize

                      36KB

                    • memory/752-105-0x00000000008C0000-0x00000000009C0000-memory.dmp

                      Filesize

                      1024KB

                    • memory/956-149-0x000000013F540000-0x000000013FAE1000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/1044-142-0x0000000000400000-0x00000000004BD000-memory.dmp

                      Filesize

                      756KB

                    • memory/1044-147-0x0000000000240000-0x0000000000241000-memory.dmp

                      Filesize

                      4KB

                    • memory/1044-93-0x0000000000240000-0x0000000000241000-memory.dmp

                      Filesize

                      4KB

                    • memory/1232-133-0x0000000002BF0000-0x0000000002C06000-memory.dmp

                      Filesize

                      88KB

                    • memory/1232-1-0x0000000002780000-0x0000000002796000-memory.dmp

                      Filesize

                      88KB

                    • memory/1724-37-0x0000000001180000-0x0000000002636000-memory.dmp

                      Filesize

                      20.7MB

                    • memory/1724-120-0x0000000074CF0000-0x00000000753DE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/1724-29-0x0000000074CF0000-0x00000000753DE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/1940-135-0x0000000000400000-0x0000000000965000-memory.dmp

                      Filesize

                      5.4MB

                    • memory/1940-100-0x00000000001D0000-0x00000000001D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2032-77-0x0000000000400000-0x0000000000414000-memory.dmp

                      Filesize

                      80KB

                    • memory/2032-141-0x0000000000400000-0x0000000000414000-memory.dmp

                      Filesize

                      80KB

                    • memory/2248-35-0x0000000000FC0000-0x0000000000FFC000-memory.dmp

                      Filesize

                      240KB

                    • memory/2248-129-0x0000000074CF0000-0x00000000753DE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2248-36-0x0000000074CF0000-0x00000000753DE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2248-39-0x0000000007330000-0x0000000007370000-memory.dmp

                      Filesize

                      256KB

                    • memory/2248-139-0x0000000007330000-0x0000000007370000-memory.dmp

                      Filesize

                      256KB

                    • memory/2680-23-0x0000000074D20000-0x000000007540E000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2680-18-0x0000000007580000-0x00000000075C0000-memory.dmp

                      Filesize

                      256KB

                    • memory/2680-12-0x00000000003D0000-0x000000000040C000-memory.dmp

                      Filesize

                      240KB

                    • memory/2680-21-0x0000000007580000-0x00000000075C0000-memory.dmp

                      Filesize

                      256KB

                    • memory/2680-17-0x0000000074D20000-0x000000007540E000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2680-20-0x0000000074D20000-0x000000007540E000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2692-148-0x00000000009C0000-0x0000000000F72000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/2692-151-0x0000000004C10000-0x0000000004C50000-memory.dmp

                      Filesize

                      256KB

                    • memory/2692-150-0x0000000074CF0000-0x00000000753DE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2796-130-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/2796-132-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/2796-124-0x00000000027B0000-0x0000000002BA8000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2796-128-0x0000000002BB0000-0x000000000349B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/2796-127-0x00000000027B0000-0x0000000002BA8000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2852-0-0x0000000000400000-0x000000000040B000-memory.dmp

                      Filesize

                      44KB

                    • memory/2852-2-0x0000000000400000-0x000000000040B000-memory.dmp

                      Filesize

                      44KB