Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
Resource
win7-20240903-en
General
-
Target
8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
-
Size
551KB
-
MD5
08954896c00964d3b4b7f4141c5eaa2a
-
SHA1
4fd648890d357c14928bd8c8c5295702b870841b
-
SHA256
278b095c0694af6600aea03963b86d9b19c2811651ca792508de36c7ec55a250
-
SHA512
d1bd743329801f4871ef0c4fb29d9e939f727e48f28a55ac9d309384d866bfc15926570184ef26d7f3d23cc0221dc2d33e86e8d994e17890ad3a5ee713807924
-
SSDEEP
12288:hhQbEeX/zYMIxKzS7no9YB6Hd5fZoyr+oqfk2Aqk4:hh0//PIV7ob/oyr+oq7
Malware Config
Extracted
redline
cheat
45.137.22.248:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2684-28-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2684-25-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2684-23-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2684-30-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2684-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2684-28-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2684-25-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2684-23-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2684-30-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2684-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Sectoprat family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2848 powershell.exe 2996 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 2996 powershell.exe 2848 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 2684 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2848 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 31 PID 1964 wrote to memory of 2848 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 31 PID 1964 wrote to memory of 2848 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 31 PID 1964 wrote to memory of 2848 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 31 PID 1964 wrote to memory of 2996 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 33 PID 1964 wrote to memory of 2996 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 33 PID 1964 wrote to memory of 2996 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 33 PID 1964 wrote to memory of 2996 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 33 PID 1964 wrote to memory of 2828 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 34 PID 1964 wrote to memory of 2828 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 34 PID 1964 wrote to memory of 2828 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 34 PID 1964 wrote to memory of 2828 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 34 PID 1964 wrote to memory of 2608 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 37 PID 1964 wrote to memory of 2608 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 37 PID 1964 wrote to memory of 2608 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 37 PID 1964 wrote to memory of 2608 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 37 PID 1964 wrote to memory of 2628 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 38 PID 1964 wrote to memory of 2628 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 38 PID 1964 wrote to memory of 2628 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 38 PID 1964 wrote to memory of 2628 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 38 PID 1964 wrote to memory of 2644 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 39 PID 1964 wrote to memory of 2644 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 39 PID 1964 wrote to memory of 2644 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 39 PID 1964 wrote to memory of 2644 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 39 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40 PID 1964 wrote to memory of 2684 1964 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"2⤵PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"2⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"2⤵PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56ed3b6f2a93bc16988bf7b2969225602
SHA181865ce40cf9aaaefe9d4f2fe0030cd981eaeafd
SHA25665aee9c20ee0a75b4a7d113d595368edd41a5e527cf268cf479460fa072d9187
SHA512808392c8d39559ec3ca04c445dd592beb77344c6d72e6d4d7fe4b4e2c752d509dfb904de1f6c25a9917206746e85dfee45a56db165a4bcae4acdb9863b9fc5c3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2YD1DO4OPL1ARJR8BSIX.temp
Filesize7KB
MD5d1ef371096ca6f26cff982ca0e613ee1
SHA18b0def53945ce8b04d13cc29ed3992a54ae7fdf0
SHA2563a5dc731db8abaaf140e71fe4fc7b94ed96a1f870133eb0c838785f53d509e8a
SHA5122f278bb9c74e506ddedb5e60b462199447b344549f8b110c180bc7324777adc788b23cf29307b20ae36fa09c2540592c1cc3a5aa80e8e7e402ae7dd9df9b5836