Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2023, 11:17

General

  • Target

    349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe

  • Size

    731KB

  • MD5

    af2fee0bfcea457f9762b5764b1ccc23

  • SHA1

    474197911b4ab0ff9498c6c5e174bdc035327e20

  • SHA256

    349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3

  • SHA512

    9d93b192543bd670feba1b905863ac22a1b967a4fb0cb247482bfbf0e8dc52a796822a086372e8a02b4ab1842b1851c6cf6256834d4b0fb88e0c55ccd6b4b467

  • SSDEEP

    12288:hQzSqyOm5fdGWX1PQqujRPcNrRnqIgoVGbx/V2Mxs3EZ86ra:0yO+V1PQjjZARnqoVG1osZbra

Malware Config

Extracted

Family

redline

Botnet

diza

C2

193.56.146.11:4173

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe
    "C:\Users\Admin\AppData\Local\Temp\349df45dce0401728d1e3af4fa03cba14029ef45934894b7670e377ca1ac69b3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film2454.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film2454.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4128
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum0753.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum0753.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0973.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0973.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dBz39s36.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dBz39s36.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4832
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4108
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4240
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:2224
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:3760
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3516
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:3708
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3932
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 512
                  2⤵
                  • Program crash
                  PID:4340
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1912 -ip 1912
                1⤵
                  PID:3492
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2984
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4708

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dBz39s36.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dBz39s36.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film2454.exe

                  Filesize

                  382KB

                  MD5

                  c24e1d7a3b37f2d94db3c8a95455de7b

                  SHA1

                  62de187c9a5b9346ffe7f719b13184cc440229f1

                  SHA256

                  41d46b43b59c2b0832b08d3870fdf565d58d0cf6bb0ce43e49bed66ed52e8475

                  SHA512

                  89987c5160cc19e6986fa8b197966a4b39af0c6ccebb5f8cfdbbf0b01db1d2d9682b6a5fb45c673732d58af86657ded9f7a97eafebc1826ad155e32c0d6af68b

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film2454.exe

                  Filesize

                  382KB

                  MD5

                  c24e1d7a3b37f2d94db3c8a95455de7b

                  SHA1

                  62de187c9a5b9346ffe7f719b13184cc440229f1

                  SHA256

                  41d46b43b59c2b0832b08d3870fdf565d58d0cf6bb0ce43e49bed66ed52e8475

                  SHA512

                  89987c5160cc19e6986fa8b197966a4b39af0c6ccebb5f8cfdbbf0b01db1d2d9682b6a5fb45c673732d58af86657ded9f7a97eafebc1826ad155e32c0d6af68b

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum0753.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum0753.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0973.exe

                  Filesize

                  175KB

                  MD5

                  5c65803d42d5d06e302798faee3a11cd

                  SHA1

                  1e8de783b9994a3e422d9799437e4ad0ce554cc6

                  SHA256

                  a44091a1a8110f482b8a4bea50b7eeddc9d8cb6c11878fe49b955f886b3defd2

                  SHA512

                  71a465f5df53ed7fcc34a492acedb12bb2d81538aa4e137dfb9ec71bb911a943eed2b2d3f45cd13f15cb57aaf4f7536576cc5629848da5c6e273ec1e323d4804

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0973.exe

                  Filesize

                  175KB

                  MD5

                  5c65803d42d5d06e302798faee3a11cd

                  SHA1

                  1e8de783b9994a3e422d9799437e4ad0ce554cc6

                  SHA256

                  a44091a1a8110f482b8a4bea50b7eeddc9d8cb6c11878fe49b955f886b3defd2

                  SHA512

                  71a465f5df53ed7fcc34a492acedb12bb2d81538aa4e137dfb9ec71bb911a943eed2b2d3f45cd13f15cb57aaf4f7536576cc5629848da5c6e273ec1e323d4804

                • memory/1912-220-0x0000000000400000-0x000000000053B000-memory.dmp

                  Filesize

                  1.2MB

                • memory/1912-141-0x0000000002310000-0x000000000239F000-memory.dmp

                  Filesize

                  572KB

                • memory/1912-183-0x0000000000400000-0x000000000053B000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4044-206-0x0000000004D60000-0x0000000004D70000-memory.dmp

                  Filesize

                  64KB

                • memory/4044-203-0x0000000006A10000-0x0000000006F3C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4044-202-0x0000000006310000-0x00000000064D2000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4044-200-0x00000000055E0000-0x0000000005646000-memory.dmp

                  Filesize

                  408KB

                • memory/4044-199-0x0000000004F10000-0x0000000004FA2000-memory.dmp

                  Filesize

                  584KB

                • memory/4044-198-0x0000000004D60000-0x0000000004D70000-memory.dmp

                  Filesize

                  64KB

                • memory/4044-197-0x0000000004A90000-0x0000000004ACC000-memory.dmp

                  Filesize

                  240KB

                • memory/4044-196-0x0000000004A30000-0x0000000004A42000-memory.dmp

                  Filesize

                  72KB

                • memory/4044-195-0x0000000004B00000-0x0000000004C0A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4044-204-0x00000000064E0000-0x0000000006556000-memory.dmp

                  Filesize

                  472KB

                • memory/4044-194-0x0000000004FC0000-0x00000000055D8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4044-193-0x0000000000190000-0x00000000001C2000-memory.dmp

                  Filesize

                  200KB

                • memory/4044-205-0x0000000006290000-0x00000000062E0000-memory.dmp

                  Filesize

                  320KB

                • memory/4796-160-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-189-0x0000000000400000-0x00000000004D4000-memory.dmp

                  Filesize

                  848KB

                • memory/4796-187-0x0000000002310000-0x0000000002320000-memory.dmp

                  Filesize

                  64KB

                • memory/4796-186-0x0000000002310000-0x0000000002320000-memory.dmp

                  Filesize

                  64KB

                • memory/4796-185-0x0000000002310000-0x0000000002320000-memory.dmp

                  Filesize

                  64KB

                • memory/4796-184-0x0000000000400000-0x00000000004D4000-memory.dmp

                  Filesize

                  848KB

                • memory/4796-182-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-180-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-178-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-176-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-174-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-172-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-170-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-168-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-166-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-164-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-162-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-158-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-156-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-155-0x00000000022F0000-0x0000000002302000-memory.dmp

                  Filesize

                  72KB

                • memory/4796-154-0x0000000002310000-0x0000000002320000-memory.dmp

                  Filesize

                  64KB

                • memory/4796-153-0x0000000002310000-0x0000000002320000-memory.dmp

                  Filesize

                  64KB

                • memory/4796-152-0x0000000002310000-0x0000000002320000-memory.dmp

                  Filesize

                  64KB

                • memory/4796-151-0x00000000004E0000-0x000000000050D000-memory.dmp

                  Filesize

                  180KB

                • memory/4796-150-0x0000000004B50000-0x00000000050F4000-memory.dmp

                  Filesize

                  5.6MB