Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    59s
  • max time network
    58s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/12/2024, 03:27

General

  • Target

    a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe

  • Size

    2.8MB

  • MD5

    952415cd3af41728ca26f5c45cf3c867

  • SHA1

    a2fc5bd9e6367919ef896665d6ecefba89f41e7e

  • SHA256

    04cde81ac938706771fa9fe936ee8f79fe7e0799730985190d045ecccbd72235

  • SHA512

    b2f73f68ef85fbf54f6228092f1506c6321a8a8cc4c1b9ece1f482958c97ea88e41863313fecd66a52ddc1ae1ad30f9b1bbc98de728fbdb7ee924287e7e07d0c

  • SSDEEP

    49152:tOD0G+o20Jl6qY0+tiAJ5/SAt8ZSeWuFJp5FYv6LWhxeK/YgM7UmjD:tOD0GvtnY0+tTzaAtbeWgneyLQx/yN

Malware Config

Extracted

Family

redline

Botnet

719770735

C2

45.133.36.107:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
    "C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4280
    • C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe
      "C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2296
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:2332
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1492
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:4372
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          3⤵
          • Launches sc.exe
          PID:4576
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          3⤵
          • Launches sc.exe
          PID:4620
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          3⤵
          • Launches sc.exe
          PID:4992
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "GOPRDESH"
          3⤵
          • Launches sc.exe
          PID:868
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "GOPRDESH" binpath= "C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe" start= "auto"
          3⤵
          • Launches sc.exe
          PID:1776
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          3⤵
          • Launches sc.exe
          PID:3572
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "GOPRDESH"
          3⤵
          • Launches sc.exe
          PID:2956
    • C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe
      C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4544
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
            PID:1048
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          2⤵
          • Launches sc.exe
          PID:2852
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          2⤵
          • Launches sc.exe
          PID:1296
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          2⤵
          • Launches sc.exe
          PID:5020
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          2⤵
          • Launches sc.exe
          PID:2920
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          2⤵
          • Launches sc.exe
          PID:2116
        • C:\Windows\system32\conhost.exe
          C:\Windows\system32\conhost.exe
          2⤵
            PID:4568
          • C:\Windows\explorer.exe
            explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2580

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe

          Filesize

          2.5MB

          MD5

          1584ec9d49300648fb4787af01e581ad

          SHA1

          36382ee29663f9a72140eac36c006fbba8c23eaa

          SHA256

          83aad4b727208a7611de04a56e6a7c98ae2d73fd3bd47cfa93ce862e4adbf151

          SHA512

          fc8251e40448c1f9aee8f2fb2034e4bc94f9e1c4b01b0713459d01611f884dc7c151067e0fb610af0210748c06c7c898c05d6b2407b8462593a3aaee58da15ec

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jmloj4qf.vuw.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\build.exe

          Filesize

          300KB

          MD5

          bf064d1a23c92866bc1e60151f28e9cf

          SHA1

          05785c3d76875aa8840b331ae4f3dbd137e675f4

          SHA256

          d362df4546a30c0a7aff8e4d6c27d44b4e8b7d6f0819d02782730de941bf749c

          SHA512

          3085d460c41d350bbcdf9a18c8bd3034c723ebe2823671fefcdd3224fd7d93809e5ab74df9e053a3a91cc74e1e5f11e2d73e5b10a24d1c218fc0826f5bc17621

        • memory/2580-94-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-101-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-100-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-99-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-88-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-92-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-91-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-90-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-97-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-96-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-98-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-93-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-89-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-102-0x0000000140000000-0x0000000140848000-memory.dmp

          Filesize

          8.3MB

        • memory/2580-95-0x0000000001920000-0x0000000001940000-memory.dmp

          Filesize

          128KB

        • memory/2996-45-0x00007FFE74F70000-0x00007FFE75A32000-memory.dmp

          Filesize

          10.8MB

        • memory/2996-46-0x00007FFE74F70000-0x00007FFE75A32000-memory.dmp

          Filesize

          10.8MB

        • memory/2996-49-0x00007FFE74F70000-0x00007FFE75A32000-memory.dmp

          Filesize

          10.8MB

        • memory/2996-44-0x00000242291F0000-0x0000024229212000-memory.dmp

          Filesize

          136KB

        • memory/2996-35-0x00007FFE74F73000-0x00007FFE74F75000-memory.dmp

          Filesize

          8KB

        • memory/4280-32-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

          Filesize

          304KB

        • memory/4280-34-0x0000000073A60000-0x0000000074211000-memory.dmp

          Filesize

          7.7MB

        • memory/4280-22-0x0000000073A6E000-0x0000000073A6F000-memory.dmp

          Filesize

          4KB

        • memory/4280-23-0x0000000000DA0000-0x0000000000DF2000-memory.dmp

          Filesize

          328KB

        • memory/4280-24-0x0000000005DA0000-0x0000000006346000-memory.dmp

          Filesize

          5.6MB

        • memory/4280-25-0x00000000057F0000-0x0000000005882000-memory.dmp

          Filesize

          584KB

        • memory/4280-26-0x0000000073A60000-0x0000000074211000-memory.dmp

          Filesize

          7.7MB

        • memory/4280-27-0x0000000005770000-0x000000000577A000-memory.dmp

          Filesize

          40KB

        • memory/4280-28-0x0000000006970000-0x0000000006F88000-memory.dmp

          Filesize

          6.1MB

        • memory/4280-29-0x0000000005B40000-0x0000000005C4A000-memory.dmp

          Filesize

          1.0MB

        • memory/4280-30-0x0000000005900000-0x0000000005912000-memory.dmp

          Filesize

          72KB

        • memory/4280-31-0x0000000005A70000-0x0000000005AAC000-memory.dmp

          Filesize

          240KB

        • memory/4280-33-0x0000000073A6E000-0x0000000073A6F000-memory.dmp

          Filesize

          4KB

        • memory/4544-71-0x00000215EF0D0000-0x00000215EF0DA000-memory.dmp

          Filesize

          40KB

        • memory/4544-77-0x00000215EF130000-0x00000215EF13A000-memory.dmp

          Filesize

          40KB

        • memory/4544-69-0x00000215EEFF0000-0x00000215EF00C000-memory.dmp

          Filesize

          112KB

        • memory/4544-72-0x00000215EF100000-0x00000215EF11C000-memory.dmp

          Filesize

          112KB

        • memory/4544-70-0x00000215EF010000-0x00000215EF0C3000-memory.dmp

          Filesize

          716KB

        • memory/4544-73-0x00000215EF0E0000-0x00000215EF0EA000-memory.dmp

          Filesize

          40KB

        • memory/4544-74-0x00000215EF140000-0x00000215EF15A000-memory.dmp

          Filesize

          104KB

        • memory/4544-75-0x00000215EF0F0000-0x00000215EF0F8000-memory.dmp

          Filesize

          32KB

        • memory/4544-76-0x00000215EF120000-0x00000215EF126000-memory.dmp

          Filesize

          24KB

        • memory/4568-82-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/4568-80-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/4568-81-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/4568-84-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/4568-87-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB

        • memory/4568-83-0x0000000140000000-0x000000014000E000-memory.dmp

          Filesize

          56KB