Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe
Resource
win10v2004-20241007-en
General
-
Target
2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe
-
Size
681KB
-
MD5
00e1431f15d4e7d7521adaf56d1cf9eb
-
SHA1
63c4a9d2327a46296e4d54c9baeb20f683ec9d87
-
SHA256
2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609
-
SHA512
c0e78ad73ffa3f4c0ab94ce0e21dd3cb0638cdbccbe5b3bcd0d841193a11fbd3485c176b010c3196b21d940dfa5b18f09f53e3dfdd28c5ba881df1637584118d
-
SSDEEP
12288:Cp1zzClVwk1lf0PmOPRQBsoNiDgOIu9diWKg0p2/DqJg7:Cpx8VwkiWaUOIuXZ
Malware Config
Extracted
redline
JAPANPORN
45.134.225.35:7821
-
auth_value
18d8418fe71c08942d2ddd0435edb9e5
Extracted
asyncrat
0.5.7B
3333----Japanese----3333
Aakn1515knAakn1515kn!
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/uqaaCRiU
Signatures
-
Asyncrat family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000012250-1661.dat family_redline behavioral1/memory/2152-1664-0x0000000000F30000-0x0000000000F50000-memory.dmp family_redline -
Redline family
-
System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs
Abuse Regasm to proxy execution of malicious code.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\RegAsm.exe 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe Key opened \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe -
Deletes itself 1 IoCs
pid Process 1276 powershell.exe -
Executes dropped EXE 3 IoCs
pid Process 2784 RegAsm.exe 536 RegAsm.exe 2152 Yljfderdjwutqbwifekmjhjapanred.exe -
Loads dropped DLL 4 IoCs
pid Process 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2568 WScript.exe 536 RegAsm.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 6 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2772 set thread context of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Yljfderdjwutqbwifekmjhjapanred.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 1276 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe Token: SeDebugPrivilege 1276 powershell.exe Token: SeDebugPrivilege 536 RegAsm.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2568 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 32 PID 2772 wrote to memory of 2568 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 32 PID 2772 wrote to memory of 2568 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 32 PID 2772 wrote to memory of 2568 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 32 PID 2772 wrote to memory of 1276 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 33 PID 2772 wrote to memory of 1276 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 33 PID 2772 wrote to memory of 1276 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 33 PID 2772 wrote to memory of 1276 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 33 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 2784 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 35 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2772 wrote to memory of 536 2772 2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe 36 PID 2568 wrote to memory of 2152 2568 WScript.exe 37 PID 2568 wrote to memory of 2152 2568 WScript.exe 37 PID 2568 wrote to memory of 2152 2568 WScript.exe 37 PID 2568 wrote to memory of 2152 2568 WScript.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe"C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe"1⤵
- System Binary Proxy Execution: Regsvcs/Regasm
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nomzctbtacmztkfxofvv.vbs"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe"C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe" -Force2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
118B
MD5c79baba091f7498ce4d61f075f88a4b7
SHA19906c4bf1e3365c38833c89cd9b1b50c3ccb64a3
SHA25663d3754108ef87e215e9d68095b97d8c62468496fb7348cf0d4c76892bda2bad
SHA5129f571c9211e5f1de1edf22c1ee5bfec5d90e7bc705c3963adbc8db20d56ee2a06b410318c2d61017dae49c4af20e4b53318561e265fa64406b50ef6f291bec18
-
Filesize
104KB
MD50eef332fd798b03319283bd2b10787a2
SHA114e4177525f12e20b00c21a05ba711057fb233da
SHA256a54a8b8a85445de206467249b33785a9c1d33828b1eb57e3531d01ad7488e1b3
SHA512fd205aaa4f94df3ec9d3699deb3384f9f51a28ef098cb0e89945ee5b188df6ba7c05b13ecda9c80cd8fddffb664a60f3bd41e566d4d48e2445469e9120c94994
-
Filesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab