Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 09:41

General

  • Target

    48826f11960c6a37a6492d62f1741242.exe

  • Size

    555KB

  • MD5

    48826f11960c6a37a6492d62f1741242

  • SHA1

    164f7b206e602a0ee54f0c7a43c1ee9ada363874

  • SHA256

    8d1f95b7b7ec864d13ed8255fe73da0fd72179b73537f498fb172de68159763f

  • SHA512

    7d318cdceacf8b14b0991540ac3c045291bf1af8337ebf3162cc195c7bf7b0dddb61735f1ed9398613d02fd4768caf2f02a36243fcc434d0bfaf734840654230

  • SSDEEP

    12288:VvPNdvPR5ncf/vc4Q9uuDqSbxzNHeJNi+apDF0/wkR:hPh52vcFgkzoipDE3

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.164:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe
    "C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zLRPXPmCiYo.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2760
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zLRPXPmCiYo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6345.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2636
    • C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe
      "C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp6345.tmp

    Filesize

    1KB

    MD5

    a41d5023fe077ab2c9858058dc458227

    SHA1

    b685384abb509f97e807809ec2b09c493053ef96

    SHA256

    e2d02c60db65eb92f272a0c19621dd6afed8ba6ce1ab1218b738501b5389eeef

    SHA512

    3fd7fbcfc7b4bc58962cbc9ae0ec545053286bd8fd8b44ff0155f27d773818387007a7f5930c53c4f5c60161c1ab948c404b8fada82f34fb6102dd7565a011ee

  • C:\Users\Admin\AppData\Local\Temp\tmp91B7.tmp

    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

  • C:\Users\Admin\AppData\Local\Temp\tmp91EB.tmp

    Filesize

    92KB

    MD5

    dd6944619a1cff7c63c0e49ed65368ca

    SHA1

    a055ce9efa2206cdc35b924d43a5d06f453ce777

    SHA256

    58ea6de2879649260c0a62b6e8e045e88c3311978e993f63a8dfcdb0dba9f05d

    SHA512

    856d454cd202fc39bec08f7ea7fb9c631e5531c1d5ffc269d3ea4ef2cdd568b176da0f8e00ffd8c80eaad461cecbce213fa4cd46b142a7760fd32815261fddd7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    445a22b8305e1a655db45363e4d4eb19

    SHA1

    b0b60a4008165489820c19d074a5b6283deab4cf

    SHA256

    cf0b65b8aa022b3884cf7a09a79535f3dc8b2ead9fc0f97629b8b70a653478a4

    SHA512

    4709c0c3e6246f54687c03abcf1e5142537d819a809502e45839514fd186dcfa549a167c274f31432e08bfc3400fa01d868f660511af5dc8347a86d54752e43f

  • memory/2220-5-0x0000000073D50000-0x000000007443E000-memory.dmp

    Filesize

    6.9MB

  • memory/2220-33-0x0000000073D50000-0x000000007443E000-memory.dmp

    Filesize

    6.9MB

  • memory/2220-6-0x0000000000470000-0x000000000047E000-memory.dmp

    Filesize

    56KB

  • memory/2220-7-0x00000000004E0000-0x00000000004F6000-memory.dmp

    Filesize

    88KB

  • memory/2220-8-0x0000000004E60000-0x0000000004EC0000-memory.dmp

    Filesize

    384KB

  • memory/2220-4-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

    Filesize

    4KB

  • memory/2220-3-0x00000000004C0000-0x00000000004DA000-memory.dmp

    Filesize

    104KB

  • memory/2220-1-0x0000000000D20000-0x0000000000DAC000-memory.dmp

    Filesize

    560KB

  • memory/2220-2-0x0000000073D50000-0x000000007443E000-memory.dmp

    Filesize

    6.9MB

  • memory/2220-0-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

    Filesize

    4KB

  • memory/3012-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3012-32-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3012-31-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3012-25-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3012-23-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3012-27-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3012-30-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3012-21-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB