Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
58s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/12/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
Resource
win11-20241007-en
General
-
Target
a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
-
Size
2.8MB
-
MD5
952415cd3af41728ca26f5c45cf3c867
-
SHA1
a2fc5bd9e6367919ef896665d6ecefba89f41e7e
-
SHA256
04cde81ac938706771fa9fe936ee8f79fe7e0799730985190d045ecccbd72235
-
SHA512
b2f73f68ef85fbf54f6228092f1506c6321a8a8cc4c1b9ece1f482958c97ea88e41863313fecd66a52ddc1ae1ad30f9b1bbc98de728fbdb7ee924287e7e07d0c
-
SSDEEP
49152:tOD0G+o20Jl6qY0+tiAJ5/SAt8ZSeWuFJp5FYv6LWhxeK/YgM7UmjD:tOD0GvtnY0+tTzaAtbeWgneyLQx/yN
Malware Config
Extracted
redline
719770735
45.133.36.107:1912
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/files/0x001c00000002aa76-4.dat family_redline behavioral2/memory/4280-23-0x0000000000DA0000-0x0000000000DF2000-memory.dmp family_redline -
Redline family
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/2580-93-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-98-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-97-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-94-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-99-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-100-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-96-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-101-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2580-102-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2996 powershell.exe 4544 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 3 IoCs
pid Process 4280 build.exe 2296 VLCMediaPlayer.exe 2128 psmwzamfkpsj.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe VLCMediaPlayer.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe psmwzamfkpsj.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2128 set thread context of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 set thread context of 2580 2128 psmwzamfkpsj.exe 119 -
resource yara_rule behavioral2/memory/2580-90-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-89-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-93-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-98-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-97-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-94-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-91-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-92-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-88-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-99-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-100-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-96-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-101-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2580-102-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2852 sc.exe 4992 sc.exe 1776 sc.exe 2956 sc.exe 2920 sc.exe 2116 sc.exe 4576 sc.exe 868 sc.exe 4620 sc.exe 3572 sc.exe 1296 sc.exe 5020 sc.exe 1492 sc.exe 4372 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 VLCMediaPlayer.exe 2996 powershell.exe 2996 powershell.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2296 VLCMediaPlayer.exe 2128 psmwzamfkpsj.exe 4544 powershell.exe 4544 powershell.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2128 psmwzamfkpsj.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 4544 powershell.exe Token: SeLockMemoryPrivilege 2580 explorer.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 224 wrote to memory of 4280 224 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 77 PID 224 wrote to memory of 4280 224 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 77 PID 224 wrote to memory of 4280 224 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 77 PID 224 wrote to memory of 2296 224 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 78 PID 224 wrote to memory of 2296 224 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 78 PID 3168 wrote to memory of 2332 3168 cmd.exe 86 PID 3168 wrote to memory of 2332 3168 cmd.exe 86 PID 3024 wrote to memory of 1048 3024 cmd.exe 111 PID 3024 wrote to memory of 1048 3024 cmd.exe 111 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 4568 2128 psmwzamfkpsj.exe 118 PID 2128 wrote to memory of 2580 2128 psmwzamfkpsj.exe 119 PID 2128 wrote to memory of 2580 2128 psmwzamfkpsj.exe 119 PID 2128 wrote to memory of 2580 2128 psmwzamfkpsj.exe 119 PID 2128 wrote to memory of 2580 2128 psmwzamfkpsj.exe 119 PID 2128 wrote to memory of 2580 2128 psmwzamfkpsj.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe"C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe"C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2296 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:2332
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:1492
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4372
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:4576
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:4620
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:4992
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GOPRDESH"3⤵
- Launches sc.exe
PID:868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GOPRDESH" binpath= "C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe" start= "auto"3⤵
- Launches sc.exe
PID:1776
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:3572
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GOPRDESH"3⤵
- Launches sc.exe
PID:2956
-
-
-
C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exeC:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1048
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2852
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1296
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:5020
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2920
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2116
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4568
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD51584ec9d49300648fb4787af01e581ad
SHA136382ee29663f9a72140eac36c006fbba8c23eaa
SHA25683aad4b727208a7611de04a56e6a7c98ae2d73fd3bd47cfa93ce862e4adbf151
SHA512fc8251e40448c1f9aee8f2fb2034e4bc94f9e1c4b01b0713459d01611f884dc7c151067e0fb610af0210748c06c7c898c05d6b2407b8462593a3aaee58da15ec
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
300KB
MD5bf064d1a23c92866bc1e60151f28e9cf
SHA105785c3d76875aa8840b331ae4f3dbd137e675f4
SHA256d362df4546a30c0a7aff8e4d6c27d44b4e8b7d6f0819d02782730de941bf749c
SHA5123085d460c41d350bbcdf9a18c8bd3034c723ebe2823671fefcdd3224fd7d93809e5ab74df9e053a3a91cc74e1e5f11e2d73e5b10a24d1c218fc0826f5bc17621