Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 09:41
Static task
static1
Behavioral task
behavioral1
Sample
48826f11960c6a37a6492d62f1741242.exe
Resource
win7-20240704-en
General
-
Target
48826f11960c6a37a6492d62f1741242.exe
-
Size
555KB
-
MD5
48826f11960c6a37a6492d62f1741242
-
SHA1
164f7b206e602a0ee54f0c7a43c1ee9ada363874
-
SHA256
8d1f95b7b7ec864d13ed8255fe73da0fd72179b73537f498fb172de68159763f
-
SHA512
7d318cdceacf8b14b0991540ac3c045291bf1af8337ebf3162cc195c7bf7b0dddb61735f1ed9398613d02fd4768caf2f02a36243fcc434d0bfaf734840654230
-
SSDEEP
12288:VvPNdvPR5ncf/vc4Q9uuDqSbxzNHeJNi+apDF0/wkR:hPh52vcFgkzoipDE3
Malware Config
Extracted
redline
cheat
45.137.22.164:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/3012-30-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/3012-27-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/3012-32-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/3012-31-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/3012-25-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/3012-30-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/3012-27-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/3012-32-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/3012-31-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/3012-25-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2620 powershell.exe 2760 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2220 set thread context of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48826f11960c6a37a6492d62f1741242.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48826f11960c6a37a6492d62f1741242.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2636 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2220 48826f11960c6a37a6492d62f1741242.exe 2220 48826f11960c6a37a6492d62f1741242.exe 2220 48826f11960c6a37a6492d62f1741242.exe 2220 48826f11960c6a37a6492d62f1741242.exe 2760 powershell.exe 2620 powershell.exe 3012 48826f11960c6a37a6492d62f1741242.exe 3012 48826f11960c6a37a6492d62f1741242.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2220 48826f11960c6a37a6492d62f1741242.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeDebugPrivilege 3012 48826f11960c6a37a6492d62f1741242.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2620 2220 48826f11960c6a37a6492d62f1741242.exe 30 PID 2220 wrote to memory of 2620 2220 48826f11960c6a37a6492d62f1741242.exe 30 PID 2220 wrote to memory of 2620 2220 48826f11960c6a37a6492d62f1741242.exe 30 PID 2220 wrote to memory of 2620 2220 48826f11960c6a37a6492d62f1741242.exe 30 PID 2220 wrote to memory of 2760 2220 48826f11960c6a37a6492d62f1741242.exe 32 PID 2220 wrote to memory of 2760 2220 48826f11960c6a37a6492d62f1741242.exe 32 PID 2220 wrote to memory of 2760 2220 48826f11960c6a37a6492d62f1741242.exe 32 PID 2220 wrote to memory of 2760 2220 48826f11960c6a37a6492d62f1741242.exe 32 PID 2220 wrote to memory of 2636 2220 48826f11960c6a37a6492d62f1741242.exe 34 PID 2220 wrote to memory of 2636 2220 48826f11960c6a37a6492d62f1741242.exe 34 PID 2220 wrote to memory of 2636 2220 48826f11960c6a37a6492d62f1741242.exe 34 PID 2220 wrote to memory of 2636 2220 48826f11960c6a37a6492d62f1741242.exe 34 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36 PID 2220 wrote to memory of 3012 2220 48826f11960c6a37a6492d62f1741242.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zLRPXPmCiYo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zLRPXPmCiYo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6345.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"C:\Users\Admin\AppData\Local\Temp\48826f11960c6a37a6492d62f1741242.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a41d5023fe077ab2c9858058dc458227
SHA1b685384abb509f97e807809ec2b09c493053ef96
SHA256e2d02c60db65eb92f272a0c19621dd6afed8ba6ce1ab1218b738501b5389eeef
SHA5123fd7fbcfc7b4bc58962cbc9ae0ec545053286bd8fd8b44ff0155f27d773818387007a7f5930c53c4f5c60161c1ab948c404b8fada82f34fb6102dd7565a011ee
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD5dd6944619a1cff7c63c0e49ed65368ca
SHA1a055ce9efa2206cdc35b924d43a5d06f453ce777
SHA25658ea6de2879649260c0a62b6e8e045e88c3311978e993f63a8dfcdb0dba9f05d
SHA512856d454cd202fc39bec08f7ea7fb9c631e5531c1d5ffc269d3ea4ef2cdd568b176da0f8e00ffd8c80eaad461cecbce213fa4cd46b142a7760fd32815261fddd7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5445a22b8305e1a655db45363e4d4eb19
SHA1b0b60a4008165489820c19d074a5b6283deab4cf
SHA256cf0b65b8aa022b3884cf7a09a79535f3dc8b2ead9fc0f97629b8b70a653478a4
SHA5124709c0c3e6246f54687c03abcf1e5142537d819a809502e45839514fd186dcfa549a167c274f31432e08bfc3400fa01d868f660511af5dc8347a86d54752e43f