Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 05:47

General

  • Target

    8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

  • Size

    551KB

  • MD5

    08954896c00964d3b4b7f4141c5eaa2a

  • SHA1

    4fd648890d357c14928bd8c8c5295702b870841b

  • SHA256

    278b095c0694af6600aea03963b86d9b19c2811651ca792508de36c7ec55a250

  • SHA512

    d1bd743329801f4871ef0c4fb29d9e939f727e48f28a55ac9d309384d866bfc15926570184ef26d7f3d23cc0221dc2d33e86e8d994e17890ad3a5ee713807924

  • SSDEEP

    12288:hhQbEeX/zYMIxKzS7no9YB6Hd5fZoyr+oqfk2Aqk4:hh0//PIV7ob/oyr+oq7

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.248:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Sectoprat family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
    "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2828
    • C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
      "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
      2⤵
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
        "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
        2⤵
          PID:2628
        • C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
          "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
          2⤵
            PID:2644
          • C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
            "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2684

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp

          Filesize

          1KB

          MD5

          6ed3b6f2a93bc16988bf7b2969225602

          SHA1

          81865ce40cf9aaaefe9d4f2fe0030cd981eaeafd

          SHA256

          65aee9c20ee0a75b4a7d113d595368edd41a5e527cf268cf479460fa072d9187

          SHA512

          808392c8d39559ec3ca04c445dd592beb77344c6d72e6d4d7fe4b4e2c752d509dfb904de1f6c25a9917206746e85dfee45a56db165a4bcae4acdb9863b9fc5c3

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2YD1DO4OPL1ARJR8BSIX.temp

          Filesize

          7KB

          MD5

          d1ef371096ca6f26cff982ca0e613ee1

          SHA1

          8b0def53945ce8b04d13cc29ed3992a54ae7fdf0

          SHA256

          3a5dc731db8abaaf140e71fe4fc7b94ed96a1f870133eb0c838785f53d509e8a

          SHA512

          2f278bb9c74e506ddedb5e60b462199447b344549f8b110c180bc7324777adc788b23cf29307b20ae36fa09c2540592c1cc3a5aa80e8e7e402ae7dd9df9b5836

        • memory/1964-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

          Filesize

          4KB

        • memory/1964-31-0x0000000073F60000-0x000000007464E000-memory.dmp

          Filesize

          6.9MB

        • memory/1964-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

          Filesize

          4KB

        • memory/1964-5-0x0000000073F60000-0x000000007464E000-memory.dmp

          Filesize

          6.9MB

        • memory/1964-6-0x0000000001EF0000-0x0000000001F50000-memory.dmp

          Filesize

          384KB

        • memory/1964-2-0x0000000073F60000-0x000000007464E000-memory.dmp

          Filesize

          6.9MB

        • memory/1964-1-0x0000000000180000-0x000000000020C000-memory.dmp

          Filesize

          560KB

        • memory/1964-3-0x00000000005C0000-0x00000000005DC000-memory.dmp

          Filesize

          112KB

        • memory/2684-19-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2684-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2684-25-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2684-23-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2684-21-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2684-30-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2684-29-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2684-28-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB