Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    168s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/02/2023, 05:00

General

  • Target

    8ddb2c0c5f08724bb9e9c60a996429484c7851ebb35d66ccc0ce2c331b568f7c.exe

  • Size

    566KB

  • MD5

    0bcda69c341128970fd12ef70bf41296

  • SHA1

    2b3d34d7dbf0603305d07c4493bbecb774f03271

  • SHA256

    8ddb2c0c5f08724bb9e9c60a996429484c7851ebb35d66ccc0ce2c331b568f7c

  • SHA512

    33bb9aa7beb821756cfde4174479c3b70f2af77dabb0b6ca6f28a34ed0bb6155363f8bd76f531bfe68e578ce318f48ee548bd5c4c4a7ccc396cccde9de1036e6

  • SSDEEP

    12288:IMr8y901muElPJyL2NkTFtLR6iIRGCRDu4R02xpA4H:kynulwkPR6USE2xdH

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ddb2c0c5f08724bb9e9c60a996429484c7851ebb35d66ccc0ce2c331b568f7c.exe
    "C:\Users\Admin\AppData\Local\Temp\8ddb2c0c5f08724bb9e9c60a996429484c7851ebb35d66ccc0ce2c331b568f7c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bZRg.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bZRg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aZRl.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aZRl.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4984
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
        "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4424
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:796
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:2240
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "mnolyk.exe" /P "Admin:N"
              5⤵
                PID:2212
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "mnolyk.exe" /P "Admin:R" /E
                5⤵
                  PID:3824
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3756
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\4b9a106e76" /P "Admin:N"
                    5⤵
                      PID:2580
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\4b9a106e76" /P "Admin:R" /E
                      5⤵
                        PID:2808
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:4904
              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:5012
              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:5100

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bZRg.exe

                Filesize

                379KB

                MD5

                a36d4622aefdbb70f43dfe6b0bb480b4

                SHA1

                eb490463660ee53e143f307d132de0d8573616cc

                SHA256

                2aa623021fc267053c27448ce7da43622d491c072c12dbdc1bf6840cb1a6f419

                SHA512

                1beed1fb92cf166146f08ae54db088d3e2c182bfa3e6f1f0bd2a14456e6c584c295a40bb4ab6c3bfc862b69a35eaed40ce0079ab84bbc0d39e7f7b85310f6597

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bZRg.exe

                Filesize

                379KB

                MD5

                a36d4622aefdbb70f43dfe6b0bb480b4

                SHA1

                eb490463660ee53e143f307d132de0d8573616cc

                SHA256

                2aa623021fc267053c27448ce7da43622d491c072c12dbdc1bf6840cb1a6f419

                SHA512

                1beed1fb92cf166146f08ae54db088d3e2c182bfa3e6f1f0bd2a14456e6c584c295a40bb4ab6c3bfc862b69a35eaed40ce0079ab84bbc0d39e7f7b85310f6597

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe

                Filesize

                236KB

                MD5

                8bb923c4d81284daef7896e5682df6c6

                SHA1

                67e34a96b77e44b666c5479f540995bdeacf5de2

                SHA256

                9b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21

                SHA512

                2daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aZRl.exe

                Filesize

                364KB

                MD5

                23940f577149df066b3a3c92e917f329

                SHA1

                9870b89bbba6078e93dc602182fa42f041c4cbbe

                SHA256

                acc14419d3c8bcf5c7e494606681502d8c972c4513d95bdf6fffa3424505fb5e

                SHA512

                a6cabad0cce4a0203a9d68eea21e688d07710e2def0d67862e4045eacd78791da737e49e8ef3c0866b428bb691b22674c532f3d7afcd93592b563e0633be5773

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aZRl.exe

                Filesize

                364KB

                MD5

                23940f577149df066b3a3c92e917f329

                SHA1

                9870b89bbba6078e93dc602182fa42f041c4cbbe

                SHA256

                acc14419d3c8bcf5c7e494606681502d8c972c4513d95bdf6fffa3424505fb5e

                SHA512

                a6cabad0cce4a0203a9d68eea21e688d07710e2def0d67862e4045eacd78791da737e49e8ef3c0866b428bb691b22674c532f3d7afcd93592b563e0633be5773

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                c79b74d8fec5e7e2ba2f1789fd582a15

                SHA1

                78a1e5d99dbaccc5e07b125e1dfb280112cb3128

                SHA256

                b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3

                SHA512

                0debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba

              • \Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                c79b74d8fec5e7e2ba2f1789fd582a15

                SHA1

                78a1e5d99dbaccc5e07b125e1dfb280112cb3128

                SHA256

                b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3

                SHA512

                0debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba

              • memory/2576-131-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-157-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-134-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-135-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-136-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-137-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-138-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-139-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-140-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-141-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-142-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-143-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-144-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-145-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-146-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-147-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-148-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-149-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-150-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-151-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-152-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-154-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-153-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-155-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-156-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-133-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-158-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-159-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-160-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-132-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-130-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-129-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-128-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-127-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-117-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-115-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-126-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-125-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-124-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-123-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-122-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-121-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-120-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-119-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-116-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/2576-118-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/3336-276-0x0000000000400000-0x000000000059A000-memory.dmp

                Filesize

                1.6MB

              • memory/3336-267-0x00000000020D0000-0x00000000020EA000-memory.dmp

                Filesize

                104KB

              • memory/3336-271-0x0000000004B00000-0x0000000004FFE000-memory.dmp

                Filesize

                5.0MB

              • memory/3336-273-0x0000000005000000-0x0000000005018000-memory.dmp

                Filesize

                96KB

              • memory/3336-274-0x0000000000640000-0x000000000078A000-memory.dmp

                Filesize

                1.3MB

              • memory/3336-275-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/3336-279-0x0000000000640000-0x000000000078A000-memory.dmp

                Filesize

                1.3MB

              • memory/3336-281-0x0000000000400000-0x000000000059A000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-175-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-171-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-177-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-176-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-163-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-174-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-164-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-173-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-172-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-179-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-178-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-170-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-168-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-180-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-181-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-167-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-166-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4540-165-0x00000000775B0000-0x000000007773E000-memory.dmp

                Filesize

                1.6MB

              • memory/4984-285-0x00000000005F0000-0x00000000005FA000-memory.dmp

                Filesize

                40KB