Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 15:00

General

  • Target

    2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe

  • Size

    681KB

  • MD5

    00e1431f15d4e7d7521adaf56d1cf9eb

  • SHA1

    63c4a9d2327a46296e4d54c9baeb20f683ec9d87

  • SHA256

    2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609

  • SHA512

    c0e78ad73ffa3f4c0ab94ce0e21dd3cb0638cdbccbe5b3bcd0d841193a11fbd3485c176b010c3196b21d940dfa5b18f09f53e3dfdd28c5ba881df1637584118d

  • SSDEEP

    12288:Cp1zzClVwk1lf0PmOPRQBsoNiDgOIu9diWKg0p2/DqJg7:Cpx8VwkiWaUOIuXZ

Malware Config

Extracted

Family

redline

Botnet

JAPANPORN

C2

45.134.225.35:7821

Attributes
  • auth_value

    18d8418fe71c08942d2ddd0435edb9e5

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

3333----Japanese----3333

Mutex

Aakn1515knAakn1515kn!

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/uqaaCRiU

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe
    "C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe"
    1⤵
    • System Binary Proxy Execution: Regsvcs/Regasm
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nomzctbtacmztkfxofvv.vbs"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe
        "C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2152
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe" -Force
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1276
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      PID:2784
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Nomzctbtacmztkfxofvv.vbs

    Filesize

    118B

    MD5

    c79baba091f7498ce4d61f075f88a4b7

    SHA1

    9906c4bf1e3365c38833c89cd9b1b50c3ccb64a3

    SHA256

    63d3754108ef87e215e9d68095b97d8c62468496fb7348cf0d4c76892bda2bad

    SHA512

    9f571c9211e5f1de1edf22c1ee5bfec5d90e7bc705c3963adbc8db20d56ee2a06b410318c2d61017dae49c4af20e4b53318561e265fa64406b50ef6f291bec18

  • C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe

    Filesize

    104KB

    MD5

    0eef332fd798b03319283bd2b10787a2

    SHA1

    14e4177525f12e20b00c21a05ba711057fb233da

    SHA256

    a54a8b8a85445de206467249b33785a9c1d33828b1eb57e3531d01ad7488e1b3

    SHA512

    fd205aaa4f94df3ec9d3699deb3384f9f51a28ef098cb0e89945ee5b188df6ba7c05b13ecda9c80cd8fddffb664a60f3bd41e566d4d48e2445469e9120c94994

  • \Users\Admin\AppData\Local\Temp\RegAsm.exe

    Filesize

    63KB

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/536-1665-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2152-1664-0x0000000000F30000-0x0000000000F50000-memory.dmp

    Filesize

    128KB

  • memory/2772-32-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-28-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-62-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-60-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-58-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-56-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-54-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-52-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-50-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-48-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-46-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-44-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-42-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-40-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-38-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-36-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-34-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-0-0x00000000745CE000-0x00000000745CF000-memory.dmp

    Filesize

    4KB

  • memory/2772-30-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-64-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-26-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-24-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-22-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-20-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-18-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-16-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-14-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-12-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-6-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-4-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-3-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-1629-0x00000000745C0000-0x0000000074CAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-1637-0x0000000004400000-0x0000000004418000-memory.dmp

    Filesize

    96KB

  • memory/2772-66-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-8-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-1662-0x00000000745C0000-0x0000000074CAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-10-0x0000000004360000-0x00000000043DE000-memory.dmp

    Filesize

    504KB

  • memory/2772-2-0x0000000004360000-0x00000000043E4000-memory.dmp

    Filesize

    528KB

  • memory/2772-1-0x0000000000940000-0x00000000009F0000-memory.dmp

    Filesize

    704KB