Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    redirect

  • Size

    6KB

  • Sample

    240714-nhyvha1bnh

  • MD5

    0ef859252c048bc711a5019498e22a3b

  • SHA1

    80ff8207a028df42119db7d9b0720e07ae533bd7

  • SHA256

    6505e9b8af864023bb405d6e25d02e9853b128e1760dd87a64f920f697ac7db4

  • SHA512

    91a0ff1e42f30bd2df5297c1937f0b3bb5a9a459ff8e4750216a0db7d1396b1c297b5950e4ef81d8c4c90e0e3bf3ea8bc9eac91e224c570bc8e85c5d445aaaad

  • SSDEEP

    192:dmHLxX7777/77QF75yrU0Lod4BYCIoJWOK7Xz/n:dmr5HY/0+CIoJWOK7Xzf

Malware Config

Extracted

Family

redline

Botnet

@mass1vexdd

C2

85.28.47.132:80

Targets

    • Target

      redirect

    • Size

      6KB

    • MD5

      0ef859252c048bc711a5019498e22a3b

    • SHA1

      80ff8207a028df42119db7d9b0720e07ae533bd7

    • SHA256

      6505e9b8af864023bb405d6e25d02e9853b128e1760dd87a64f920f697ac7db4

    • SHA512

      91a0ff1e42f30bd2df5297c1937f0b3bb5a9a459ff8e4750216a0db7d1396b1c297b5950e4ef81d8c4c90e0e3bf3ea8bc9eac91e224c570bc8e85c5d445aaaad

    • SSDEEP

      192:dmHLxX7777/77QF75yrU0Lod4BYCIoJWOK7Xz/n:dmr5HY/0+CIoJWOK7Xzf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks