Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/02/2023, 02:03

General

  • Target

    aa50127fb98706509eaddec3ee18cea93b0b60ad5656c94ab1d436d9437e785e.exe

  • Size

    558KB

  • MD5

    fc53f8da6891d6b39f7168dfcdc8ede9

  • SHA1

    f63863d1e2f8a1921a9d24200640ea0e34b0460d

  • SHA256

    aa50127fb98706509eaddec3ee18cea93b0b60ad5656c94ab1d436d9437e785e

  • SHA512

    fc7de4b8fb9f8bae3e3557640a3f385c13f5fbe8f76e8755f9c5e3c16a10e156bb39dec47c4ca5f30cb8944e870378869838b5c26d6ce9b25fa31149e6ff3873

  • SSDEEP

    12288:hMrvy90tleIv44bKZfTxCeRsOUIdO8TPXD7sS:Kya4xCeRsOtOWES

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa50127fb98706509eaddec3ee18cea93b0b60ad5656c94ab1d436d9437e785e.exe
    "C:\Users\Admin\AppData\Local\Temp\aa50127fb98706509eaddec3ee18cea93b0b60ad5656c94ab1d436d9437e785e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bVKg.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bVKg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aVKf.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aVKf.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4204
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
        "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4648
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:1740
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "mnolyk.exe" /P "Admin:N"
              5⤵
                PID:2152
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "mnolyk.exe" /P "Admin:R" /E
                5⤵
                  PID:3760
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:2072
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\4b9a106e76" /P "Admin:N"
                    5⤵
                      PID:3276
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\4b9a106e76" /P "Admin:R" /E
                      5⤵
                        PID:5092
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:4188
              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:5116
              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:4780

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bVKg.exe

                Filesize

                371KB

                MD5

                ba927ad5e66ca269778e1941c88074ad

                SHA1

                1ad0dd5be2bd380c01563b3c81799b2ce93eacc1

                SHA256

                204d35db29427d7ee1ac01ab4649fd68b0798c2cc75fcf5b9712d42e8c551380

                SHA512

                8af3f7f7eef0918549f540015f9ef9182279867c388726dc68db5b8e2fe87ad0771cd2d0a374c42da2f4c751141d5bc7667c6fdc8e8ebc6dee26949c216d5d4d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bVKg.exe

                Filesize

                371KB

                MD5

                ba927ad5e66ca269778e1941c88074ad

                SHA1

                1ad0dd5be2bd380c01563b3c81799b2ce93eacc1

                SHA256

                204d35db29427d7ee1ac01ab4649fd68b0798c2cc75fcf5b9712d42e8c551380

                SHA512

                8af3f7f7eef0918549f540015f9ef9182279867c388726dc68db5b8e2fe87ad0771cd2d0a374c42da2f4c751141d5bc7667c6fdc8e8ebc6dee26949c216d5d4d

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aVKf.exe

                Filesize

                341KB

                MD5

                153833d9864a4194e1a8e2aa434195f8

                SHA1

                97aa030d9853b360e77c566fd8e1c04aa08c993e

                SHA256

                0e55ddcf51453954e5140e9dc8c2d8f3c3666fd980beff61c7265e159e55742f

                SHA512

                ba98ec2a2c7bb26c3f70c9c79ddd6ad332ffb8ee05533cb1b5be573a508c8e60ec50143a18a31c72947440202ea07aeab761a418672f3057465c4b669545b3ce

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aVKf.exe

                Filesize

                341KB

                MD5

                153833d9864a4194e1a8e2aa434195f8

                SHA1

                97aa030d9853b360e77c566fd8e1c04aa08c993e

                SHA256

                0e55ddcf51453954e5140e9dc8c2d8f3c3666fd980beff61c7265e159e55742f

                SHA512

                ba98ec2a2c7bb26c3f70c9c79ddd6ad332ffb8ee05533cb1b5be573a508c8e60ec50143a18a31c72947440202ea07aeab761a418672f3057465c4b669545b3ce

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                c79b74d8fec5e7e2ba2f1789fd582a15

                SHA1

                78a1e5d99dbaccc5e07b125e1dfb280112cb3128

                SHA256

                b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3

                SHA512

                0debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba

              • \Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                c79b74d8fec5e7e2ba2f1789fd582a15

                SHA1

                78a1e5d99dbaccc5e07b125e1dfb280112cb3128

                SHA256

                b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3

                SHA512

                0debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba

              • memory/2704-135-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-159-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-138-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-139-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-140-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-141-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-137-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-142-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-143-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-144-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-146-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-145-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-148-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-147-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-149-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-150-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-151-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-152-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-153-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-154-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-155-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-156-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-157-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-136-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-158-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-160-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-162-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-163-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-165-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-164-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-161-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-126-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-134-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-131-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-133-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-132-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-120-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-130-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-128-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-129-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-127-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-125-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-124-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-123-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-122-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/2704-121-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-171-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-179-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-170-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-168-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-173-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-169-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-175-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-176-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-181-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-180-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-172-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-182-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-183-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-185-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-177-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-178-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-186-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/3732-184-0x00000000773D0000-0x000000007755E000-memory.dmp

                Filesize

                1.6MB

              • memory/4204-270-0x0000000000400000-0x00000000004D1000-memory.dmp

                Filesize

                836KB

              • memory/4204-275-0x0000000004970000-0x000000000498A000-memory.dmp

                Filesize

                104KB

              • memory/4204-286-0x0000000000400000-0x00000000004D1000-memory.dmp

                Filesize

                836KB

              • memory/4204-284-0x00000000004E0000-0x000000000062A000-memory.dmp

                Filesize

                1.3MB

              • memory/4204-281-0x0000000004A00000-0x0000000004A18000-memory.dmp

                Filesize

                96KB

              • memory/4204-279-0x0000000004A30000-0x0000000004F2E000-memory.dmp

                Filesize

                5.0MB

              • memory/4204-267-0x00000000004E0000-0x000000000062A000-memory.dmp

                Filesize

                1.3MB

              • memory/4204-268-0x0000000001FB0000-0x0000000001FDD000-memory.dmp

                Filesize

                180KB

              • memory/4768-290-0x0000000000340000-0x000000000034A000-memory.dmp

                Filesize

                40KB