Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

SevenRedCo...et.exe

windows10-2004-x64

9

SevenRedCo...et.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/05/2024, 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SevenRedCodeDotnet.exe

  • Size

    28KB

  • MD5

    3b1ce9c2afe664f11ddfacceeca0875a

  • SHA1

    166c88a4ccd007c5b460f77b8b1f5726ac91e22a

  • SHA256

    5db37b4e53d6aa13481ae8d4d82907dbe652909e84b730c56dc2f7a89846cfda

  • SHA512

    4f9bb3272e829e3959ad3c3ae459f8fcc36e73f58f5b86e1ce248261e6cbda820688a15dcad81f3e2cfffbdae5606faf730d035219644048b45f30afcb04ca01

  • SSDEEP

    384:aTTADuwXZAQ+XKlT4AybtvCwrMc+4jvkjvcK5MhsYilRt9VSTxM66YNT/IszFd26:aTTAawS21jybWUnUZS99/gK

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (1069) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Views/modifies file attributes 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe
    "C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe C:\Windows\System32\SevenRedCodeDotnet.exe
      2⤵
        PID:1952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe C:\Users\Public\Documents\SevenRedCodeDotnet.exe
        2⤵
          PID:4016
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C attrib +h C:\Windows\System32\SevenRedCodeDotnet.exe
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h C:\Windows\System32\SevenRedCodeDotnet.exe
            3⤵
            • Drops file in System32 directory
            • Views/modifies file attributes
            PID:4988
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C attrib +h C:\Users\Public\Documents\SevenRedCodeDotnet.exe
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h C:\Users\Public\Documents\SevenRedCodeDotnet.exe
            3⤵
            • Views/modifies file attributes
            PID:3624
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe C:\Windows\System32\SevenRedCodeDotnet.exe
          2⤵
          • Drops file in System32 directory
          PID:4816
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe C:\Users\Public\Documents\SevenRedCodeDotnet.exe
          2⤵
            PID:2140
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe C:\Windows\System32\SevenRedCodeDotnet.exe
            2⤵
            • Drops file in System32 directory
            PID:2964
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\SevenRedCodeDotnet.exe C:\Users\Public\Documents\SevenRedCodeDotnet.exe
            2⤵
              PID:1424
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C attrib +h C:\Windows\System32\SevenRedCodeDotnet.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5008
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h C:\Windows\System32\SevenRedCodeDotnet.exe
                3⤵
                • Drops file in System32 directory
                • Views/modifies file attributes
                PID:1396
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C attrib +h C:\Windows\System32\SevenRedCodeDotnet.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2104
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h C:\Windows\System32\SevenRedCodeDotnet.exe
                3⤵
                • Views/modifies file attributes
                PID:3196
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C attrib +h C:\Users\Public\Documents\SevenRedCodeDotnet.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2376
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h C:\Users\Public\Documents\SevenRedCodeDotnet.exe
                3⤵
                • Views/modifies file attributes
                PID:3892
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C attrib +h C:\Users\Public\Documents\SevenRedCodeDotnet.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1556
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h C:\Users\Public\Documents\SevenRedCodeDotnet.exe
                3⤵
                • Views/modifies file attributes
                PID:3948
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /tn "SevenRecode" /tr "C:\Windows\System32\Winhttp.exe" /sc minute /mo 1 /rl highest /f
              2⤵
              • Creates scheduled task(s)
              PID:2368

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\SevenRedCodeDotnet.exe
            Filesize

            28KB

            MD5

            3b1ce9c2afe664f11ddfacceeca0875a

            SHA1

            166c88a4ccd007c5b460f77b8b1f5726ac91e22a

            SHA256

            5db37b4e53d6aa13481ae8d4d82907dbe652909e84b730c56dc2f7a89846cfda

            SHA512

            4f9bb3272e829e3959ad3c3ae459f8fcc36e73f58f5b86e1ce248261e6cbda820688a15dcad81f3e2cfffbdae5606faf730d035219644048b45f30afcb04ca01

            Download Submit

          • C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png.sos
            Filesize

            80B

            MD5

            33a9f17dd8e50ab0b614dfba8a577e12

            SHA1

            dcaba228b37abe75bea3611358d7ca42708ad369

            SHA256

            6d00b5a0ee9b03c5710969b830b0e8aab9e7936ad8ba0c44e706356a1b095774

            SHA512

            b3290be259fc9847ddd69126ce15508f423e7d34dcedb0bb7d0f1837137572a9db59da21b6b1ca2e7c5a9ab47c38487d24a1dd76259b7d4104f54f62cff425af

            Download Submit

          • C:\Windows\servicing\Editions\ProfessionalEducationEdition.xml.sos
            Filesize

            23KB

            MD5

            1a1febda702fda4341b4d5e1002120ee

            SHA1

            4f6b8309c57b156baa8dc1b75cf240100c102be4

            SHA256

            5313f15560b8e957df3a7b84e3b0a9be2a4f1d49773a7250c2c288ea9a239807

            SHA512

            e09493f7e985be6c3c57a4bd1b3f9d91bea9e356ee65f8cb577358e9eeb31f57292947bfba505c402ba849bd043873fab2c09fd37e58b41d64ed0e5e5eab4c0f

            Download Submit

          • memory/5072-0-0x00000000006E0000-0x00000000006EE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/5072-1-0x0000000074AC0000-0x0000000075271000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/5072-859-0x0000000074AC0000-0x0000000075271000-memory.dmp

            Filesize

            7.7MB

            Download