Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    59s
  • max time network
    58s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    25/12/2024, 03:27

General

  • Target

    a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe

  • Size

    2.8MB

  • MD5

    952415cd3af41728ca26f5c45cf3c867

  • SHA1

    a2fc5bd9e6367919ef896665d6ecefba89f41e7e

  • SHA256

    04cde81ac938706771fa9fe936ee8f79fe7e0799730985190d045ecccbd72235

  • SHA512

    b2f73f68ef85fbf54f6228092f1506c6321a8a8cc4c1b9ece1f482958c97ea88e41863313fecd66a52ddc1ae1ad30f9b1bbc98de728fbdb7ee924287e7e07d0c

  • SSDEEP

    49152:tOD0G+o20Jl6qY0+tiAJ5/SAt8ZSeWuFJp5FYv6LWhxeK/YgM7UmjD:tOD0GvtnY0+tTzaAtbeWgneyLQx/yN

Malware Config

Extracted

Family

redline

Botnet

719770735

C2

45.133.36.107:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
    "C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4044
    • C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe
      "C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:116
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:2528
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1648
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:3352
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          3⤵
          • Launches sc.exe
          PID:1988
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          3⤵
          • Launches sc.exe
          PID:3368
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          3⤵
          • Launches sc.exe
          PID:3100
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "GOPRDESH"
          3⤵
          • Launches sc.exe
          PID:3304
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "GOPRDESH" binpath= "C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe" start= "auto"
          3⤵
          • Launches sc.exe
          PID:2096
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          3⤵
          • Launches sc.exe
          PID:4212
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "GOPRDESH"
          3⤵
          • Launches sc.exe
          PID:3840
    • C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe
      C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
            PID:3940
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          2⤵
          • Launches sc.exe
          PID:2460
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          2⤵
          • Launches sc.exe
          PID:3496
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          2⤵
          • Launches sc.exe
          PID:3504
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          2⤵
          • Launches sc.exe
          PID:476
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          2⤵
          • Launches sc.exe
          PID:1128
        • C:\Windows\system32\conhost.exe
          C:\Windows\system32\conhost.exe
          2⤵
            PID:1624
          • C:\Windows\explorer.exe
            explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3212

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe

          Filesize

          2.5MB

          MD5

          1584ec9d49300648fb4787af01e581ad

          SHA1

          36382ee29663f9a72140eac36c006fbba8c23eaa

          SHA256

          83aad4b727208a7611de04a56e6a7c98ae2d73fd3bd47cfa93ce862e4adbf151

          SHA512

          fc8251e40448c1f9aee8f2fb2034e4bc94f9e1c4b01b0713459d01611f884dc7c151067e0fb610af0210748c06c7c898c05d6b2407b8462593a3aaee58da15ec

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qarejhh2.4ky.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\build.exe

          Filesize

          300KB

          MD5

          bf064d1a23c92866bc1e60151f28e9cf

          SHA1

          05785c3d76875aa8840b331ae4f3dbd137e675f4

          SHA256

          d362df4546a30c0a7aff8e4d6c27d44b4e8b7d6f0819d02782730de941bf749c

          SHA512

          3085d460c41d350bbcdf9a18c8bd3034c723ebe2823671fefcdd3224fd7d93809e5ab74df9e053a3a91cc74e1e5f11e2d73e5b10a24d1c218fc0826f5bc17621

        • memory/1624-84-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/1624-87-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/1624-83-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/1624-90-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/1624-86-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/1624-85-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/2780-79-0x00000239E2100000-0x00000239E21B5000-memory.dmp

          Filesize

          724KB

        • memory/2780-80-0x00000239E20D0000-0x00000239E20DA000-memory.dmp

          Filesize

          40KB

        • memory/2780-78-0x00000239E20E0000-0x00000239E20FC000-memory.dmp

          Filesize

          112KB

        • memory/3004-56-0x00007FF88D1B0000-0x00007FF88DC72000-memory.dmp

          Filesize

          10.8MB

        • memory/3004-53-0x00007FF88D1B0000-0x00007FF88DC72000-memory.dmp

          Filesize

          10.8MB

        • memory/3004-52-0x00007FF88D1B0000-0x00007FF88DC72000-memory.dmp

          Filesize

          10.8MB

        • memory/3004-41-0x00007FF88D1B3000-0x00007FF88D1B5000-memory.dmp

          Filesize

          8KB

        • memory/3004-42-0x000001FAE02C0000-0x000001FAE02E2000-memory.dmp

          Filesize

          136KB

        • memory/3212-95-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-91-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-105-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-104-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-103-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-92-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-94-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-100-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-93-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-98-0x0000000000580000-0x00000000005A0000-memory.dmp

          Filesize

          128KB

        • memory/3212-97-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-96-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-102-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-101-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/3212-99-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/4044-31-0x0000000005260000-0x00000000052F2000-memory.dmp

          Filesize

          584KB

        • memory/4044-33-0x0000000073AD0000-0x0000000074281000-memory.dmp

          Filesize

          7.7MB

        • memory/4044-35-0x0000000005510000-0x000000000561A000-memory.dmp

          Filesize

          1.0MB

        • memory/4044-36-0x0000000005410000-0x0000000005422000-memory.dmp

          Filesize

          72KB

        • memory/4044-40-0x0000000073AD0000-0x0000000074281000-memory.dmp

          Filesize

          7.7MB

        • memory/4044-32-0x0000000005330000-0x000000000533A000-memory.dmp

          Filesize

          40KB

        • memory/4044-34-0x0000000006ED0000-0x00000000074E8000-memory.dmp

          Filesize

          6.1MB

        • memory/4044-30-0x0000000005900000-0x0000000005EA6000-memory.dmp

          Filesize

          5.6MB

        • memory/4044-29-0x0000000000830000-0x0000000000882000-memory.dmp

          Filesize

          328KB

        • memory/4044-28-0x0000000073ADE000-0x0000000073ADF000-memory.dmp

          Filesize

          4KB

        • memory/4044-37-0x0000000005470000-0x00000000054AC000-memory.dmp

          Filesize

          240KB

        • memory/4044-38-0x0000000005620000-0x000000000566C000-memory.dmp

          Filesize

          304KB

        • memory/4044-39-0x0000000073ADE000-0x0000000073ADF000-memory.dmp

          Filesize

          4KB