Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/11/2022, 05:00

General

  • Target

    0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e.exe

  • Size

    361KB

  • MD5

    237ba2b42480f768697f6728e5690230

  • SHA1

    48121e6fd277f9ad0066550b8214dada4baa980a

  • SHA256

    0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e

  • SHA512

    0bf04f6b088552829c5701cafdf0a58ca32d9427f4683d355f3ca69515b2cf4344128d30534f890952b410caf395a60c3ed768b1c24dac04ff47344275ba7a60

  • SSDEEP

    3072:HH8gbGUoly3Lc5StZ9icreSq1xROifqOAkDpwmQoz7SP6LpoI9wjWzVggjcGkNIq:n8gbIy7jQSqpOi1wmerImjm7ITsqF

Malware Config

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e.exe
    "C:\Users\Admin\AppData\Local\Temp\0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:792
      • C:\Users\Admin\AppData\Local\Temp\1000006001\sfx_123_271.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\sfx_123_271.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Windows\SysWOW64\control.exe
          "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\9FGMMqh.Cpl",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3960
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\9FGMMqh.Cpl",
            5⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:4716
            • C:\Windows\system32\RunDll32.exe
              C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\9FGMMqh.Cpl",
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:220
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\9FGMMqh.Cpl",
                7⤵
                • Loads dropped DLL
                PID:3380
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:2620
  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    1⤵
    • Executes dropped EXE
    PID:2964
  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
    1⤵
    • Executes dropped EXE
    PID:4652

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1000006001\sfx_123_271.exe

    Filesize

    1.6MB

    MD5

    803dd7940f6015b50f58db0bf6961b65

    SHA1

    bef50d1b1cd5fd765090d45b0f4ae6b554efdc59

    SHA256

    3487a8dc1c169a1dae88f7396abff10ec11eccc0daea64a002fd393c6d0d5964

    SHA512

    a096107b7acdf26d583660bf41e4cc118a8697b3085af7fc428ccc09e521fbfa9d3a56b2edd0d61e2c298f19fc768ebe440234f27fe070622880f7fedc752117

  • C:\Users\Admin\AppData\Local\Temp\1000006001\sfx_123_271.exe

    Filesize

    1.6MB

    MD5

    803dd7940f6015b50f58db0bf6961b65

    SHA1

    bef50d1b1cd5fd765090d45b0f4ae6b554efdc59

    SHA256

    3487a8dc1c169a1dae88f7396abff10ec11eccc0daea64a002fd393c6d0d5964

    SHA512

    a096107b7acdf26d583660bf41e4cc118a8697b3085af7fc428ccc09e521fbfa9d3a56b2edd0d61e2c298f19fc768ebe440234f27fe070622880f7fedc752117

  • C:\Users\Admin\AppData\Local\Temp\9FGMMqh.Cpl

    Filesize

    1.8MB

    MD5

    bf0e44bf7e7d3dae0ab3ab6f8c2e6b6d

    SHA1

    a154acf8454142b2e7f90a957b5ec464a686ab20

    SHA256

    9445420553911716f3247d3211618824327aa849c5778384bcd83ca3dfc07f25

    SHA512

    8786607ec969b95dfe9d26ae09e73f1df99c9deaebb1d9e2695819ea2e388de6834231ec0e3222fcc7f4ef655b1d0e29c7bb9bfebd755dfc8539c9349a28d7a4

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

    Filesize

    361KB

    MD5

    237ba2b42480f768697f6728e5690230

    SHA1

    48121e6fd277f9ad0066550b8214dada4baa980a

    SHA256

    0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e

    SHA512

    0bf04f6b088552829c5701cafdf0a58ca32d9427f4683d355f3ca69515b2cf4344128d30534f890952b410caf395a60c3ed768b1c24dac04ff47344275ba7a60

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

    Filesize

    361KB

    MD5

    237ba2b42480f768697f6728e5690230

    SHA1

    48121e6fd277f9ad0066550b8214dada4baa980a

    SHA256

    0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e

    SHA512

    0bf04f6b088552829c5701cafdf0a58ca32d9427f4683d355f3ca69515b2cf4344128d30534f890952b410caf395a60c3ed768b1c24dac04ff47344275ba7a60

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

    Filesize

    361KB

    MD5

    237ba2b42480f768697f6728e5690230

    SHA1

    48121e6fd277f9ad0066550b8214dada4baa980a

    SHA256

    0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e

    SHA512

    0bf04f6b088552829c5701cafdf0a58ca32d9427f4683d355f3ca69515b2cf4344128d30534f890952b410caf395a60c3ed768b1c24dac04ff47344275ba7a60

  • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

    Filesize

    361KB

    MD5

    237ba2b42480f768697f6728e5690230

    SHA1

    48121e6fd277f9ad0066550b8214dada4baa980a

    SHA256

    0d63ae41ebd3569f6469bb8893a5acf3816f1b4b177c89210e0b69453c5b333e

    SHA512

    0bf04f6b088552829c5701cafdf0a58ca32d9427f4683d355f3ca69515b2cf4344128d30534f890952b410caf395a60c3ed768b1c24dac04ff47344275ba7a60

  • C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

    Filesize

    126KB

    MD5

    522adad0782501491314a78c7f32006b

    SHA1

    e487edceeef3a41e2a8eea1e684bcbc3b39adb97

    SHA256

    351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

    SHA512

    5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

  • \Users\Admin\AppData\Local\Temp\9FGMMqh.cpl

    Filesize

    1.8MB

    MD5

    bf0e44bf7e7d3dae0ab3ab6f8c2e6b6d

    SHA1

    a154acf8454142b2e7f90a957b5ec464a686ab20

    SHA256

    9445420553911716f3247d3211618824327aa849c5778384bcd83ca3dfc07f25

    SHA512

    8786607ec969b95dfe9d26ae09e73f1df99c9deaebb1d9e2695819ea2e388de6834231ec0e3222fcc7f4ef655b1d0e29c7bb9bfebd755dfc8539c9349a28d7a4

  • \Users\Admin\AppData\Local\Temp\9FGMMqh.cpl

    Filesize

    1.8MB

    MD5

    bf0e44bf7e7d3dae0ab3ab6f8c2e6b6d

    SHA1

    a154acf8454142b2e7f90a957b5ec464a686ab20

    SHA256

    9445420553911716f3247d3211618824327aa849c5778384bcd83ca3dfc07f25

    SHA512

    8786607ec969b95dfe9d26ae09e73f1df99c9deaebb1d9e2695819ea2e388de6834231ec0e3222fcc7f4ef655b1d0e29c7bb9bfebd755dfc8539c9349a28d7a4

  • \Users\Admin\AppData\Local\Temp\9FGMMqh.cpl

    Filesize

    1.8MB

    MD5

    bf0e44bf7e7d3dae0ab3ab6f8c2e6b6d

    SHA1

    a154acf8454142b2e7f90a957b5ec464a686ab20

    SHA256

    9445420553911716f3247d3211618824327aa849c5778384bcd83ca3dfc07f25

    SHA512

    8786607ec969b95dfe9d26ae09e73f1df99c9deaebb1d9e2695819ea2e388de6834231ec0e3222fcc7f4ef655b1d0e29c7bb9bfebd755dfc8539c9349a28d7a4

  • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

    Filesize

    126KB

    MD5

    522adad0782501491314a78c7f32006b

    SHA1

    e487edceeef3a41e2a8eea1e684bcbc3b39adb97

    SHA256

    351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

    SHA512

    5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

  • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

    Filesize

    126KB

    MD5

    522adad0782501491314a78c7f32006b

    SHA1

    e487edceeef3a41e2a8eea1e684bcbc3b39adb97

    SHA256

    351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

    SHA512

    5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

  • memory/956-235-0x0000000000400000-0x0000000002C48000-memory.dmp

    Filesize

    40.3MB

  • memory/956-190-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-173-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-176-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-422-0x0000000000400000-0x0000000002C48000-memory.dmp

    Filesize

    40.3MB

  • memory/956-421-0x0000000002CF0000-0x0000000002D9E000-memory.dmp

    Filesize

    696KB

  • memory/956-224-0x0000000002CF0000-0x0000000002D9E000-memory.dmp

    Filesize

    696KB

  • memory/956-192-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-191-0x0000000002D96000-0x0000000002DB6000-memory.dmp

    Filesize

    128KB

  • memory/956-174-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-172-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-189-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-188-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-187-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-186-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-184-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-182-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-183-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-180-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-179-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/956-178-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2964-617-0x0000000000400000-0x0000000002C48000-memory.dmp

    Filesize

    40.3MB

  • memory/3068-157-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-144-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-161-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-162-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-163-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-165-0x0000000000400000-0x0000000002C48000-memory.dmp

    Filesize

    40.3MB

  • memory/3068-164-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-166-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-167-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-168-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-169-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-159-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-158-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-175-0x0000000002E66000-0x0000000002E85000-memory.dmp

    Filesize

    124KB

  • memory/3068-177-0x0000000002DC0000-0x0000000002DFE000-memory.dmp

    Filesize

    248KB

  • memory/3068-136-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-156-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-155-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-154-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-153-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-152-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-135-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-151-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-150-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-149-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-148-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-147-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-146-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-185-0x0000000000400000-0x0000000002C48000-memory.dmp

    Filesize

    40.3MB

  • memory/3068-145-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-134-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-160-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-143-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-142-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-141-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-133-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-120-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-121-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-132-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-131-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-137-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-122-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-130-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-125-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-129-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-123-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-124-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-138-0x0000000002E66000-0x0000000002E85000-memory.dmp

    Filesize

    124KB

  • memory/3068-140-0x0000000002DC0000-0x0000000002DFE000-memory.dmp

    Filesize

    248KB

  • memory/3068-128-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-126-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-127-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3068-139-0x0000000077DB0000-0x0000000077F3E000-memory.dmp

    Filesize

    1.6MB

  • memory/3380-481-0x0000000005320000-0x0000000005427000-memory.dmp

    Filesize

    1.0MB

  • memory/3380-490-0x0000000005320000-0x0000000005427000-memory.dmp

    Filesize

    1.0MB

  • memory/3380-480-0x0000000005100000-0x0000000005206000-memory.dmp

    Filesize

    1.0MB

  • memory/4652-653-0x0000000000400000-0x0000000002C48000-memory.dmp

    Filesize

    40.3MB

  • memory/4716-492-0x0000000004F90000-0x0000000005097000-memory.dmp

    Filesize

    1.0MB

  • memory/4716-420-0x0000000004F90000-0x0000000005097000-memory.dmp

    Filesize

    1.0MB

  • memory/4716-419-0x0000000004D70000-0x0000000004E76000-memory.dmp

    Filesize

    1.0MB