Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2023, 07:27

General

  • Target

    6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803.exe

  • Size

    716KB

  • MD5

    f4eaf70f345f39838cc38f33e42bd278

  • SHA1

    07e352fb0d12cd4ad913902025d83dbbaeffc213

  • SHA256

    6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803

  • SHA512

    62d16d4aa5a6befa7ed0cb21cdf78f804d594b91f671d4f32a38cf612bee73f1c28644ffda0d15c2ce5e18ef79dfe50b83e40d62c42de89bd4ae4035b85eaaaa

  • SSDEEP

    12288:ukQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:k4MnHJ9JK3TtReMa8r0U5iyfkNW

Malware Config

Extracted

Family

redline

Botnet

dezik

C2

193.56.146.220:4174

Attributes
  • auth_value

    d39f21dca8edc10800b036ab83f4d75e

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803.exe
    "C:\Users\Admin\AppData\Local\Temp\6365de14d9d67f271f4d4619dacbfa2d044849bda0d8455b8bedab088858f803.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:444
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3748
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2220
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:976
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:376
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:2524
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1872
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4032
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3868
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 444
                  2⤵
                  • Program crash
                  PID:2148
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1524 -ip 1524
                1⤵
                  PID:4412
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4976
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1272

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                  Filesize

                  382KB

                  MD5

                  65e4e4f30a4aef3d28440aefb0a4b05b

                  SHA1

                  9ba27fc1878e66823785565db46369ca3b065d35

                  SHA256

                  56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                  SHA512

                  86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                  Filesize

                  382KB

                  MD5

                  65e4e4f30a4aef3d28440aefb0a4b05b

                  SHA1

                  9ba27fc1878e66823785565db46369ca3b065d35

                  SHA256

                  56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                  SHA512

                  86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                  Filesize

                  175KB

                  MD5

                  92f2a148b8f701e50e2f838f73d4d7b7

                  SHA1

                  324d8546e35d4f4285cac15b21620299ba5cb023

                  SHA256

                  9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                  SHA512

                  3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                  Filesize

                  175KB

                  MD5

                  92f2a148b8f701e50e2f838f73d4d7b7

                  SHA1

                  324d8546e35d4f4285cac15b21620299ba5cb023

                  SHA256

                  9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                  SHA512

                  3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

                • memory/444-186-0x0000000000400000-0x00000000004D4000-memory.dmp

                  Filesize

                  848KB

                • memory/444-184-0x0000000000400000-0x00000000004D4000-memory.dmp

                  Filesize

                  848KB

                • memory/444-170-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-168-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-166-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-164-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-162-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-158-0x0000000004C60000-0x0000000004C70000-memory.dmp

                  Filesize

                  64KB

                • memory/444-157-0x0000000004C60000-0x0000000004C70000-memory.dmp

                  Filesize

                  64KB

                • memory/444-154-0x0000000004C60000-0x0000000004C70000-memory.dmp

                  Filesize

                  64KB

                • memory/444-151-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-152-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-174-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-182-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-172-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-187-0x0000000004C60000-0x0000000004C70000-memory.dmp

                  Filesize

                  64KB

                • memory/444-178-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-180-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-150-0x0000000004C70000-0x0000000005214000-memory.dmp

                  Filesize

                  5.6MB

                • memory/444-176-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-153-0x00000000005B0000-0x00000000005DD000-memory.dmp

                  Filesize

                  180KB

                • memory/444-160-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/444-156-0x0000000004B80000-0x0000000004B92000-memory.dmp

                  Filesize

                  72KB

                • memory/1524-218-0x0000000000400000-0x0000000000537000-memory.dmp

                  Filesize

                  1.2MB

                • memory/1524-138-0x00000000023E0000-0x000000000246F000-memory.dmp

                  Filesize

                  572KB

                • memory/1524-183-0x0000000000400000-0x0000000000537000-memory.dmp

                  Filesize

                  1.2MB

                • memory/3716-192-0x0000000005B10000-0x0000000006128000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3716-201-0x0000000006D90000-0x0000000006DE0000-memory.dmp

                  Filesize

                  320KB

                • memory/3716-202-0x0000000005960000-0x0000000005970000-memory.dmp

                  Filesize

                  64KB

                • memory/3716-203-0x0000000006FB0000-0x0000000007172000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3716-204-0x00000000076B0000-0x0000000007BDC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3716-200-0x0000000006D10000-0x0000000006D86000-memory.dmp

                  Filesize

                  472KB

                • memory/3716-198-0x00000000061D0000-0x0000000006236000-memory.dmp

                  Filesize

                  408KB

                • memory/3716-197-0x0000000006130000-0x00000000061C2000-memory.dmp

                  Filesize

                  584KB

                • memory/3716-196-0x0000000005960000-0x0000000005970000-memory.dmp

                  Filesize

                  64KB

                • memory/3716-195-0x0000000005610000-0x000000000564C000-memory.dmp

                  Filesize

                  240KB

                • memory/3716-194-0x00000000055B0000-0x00000000055C2000-memory.dmp

                  Filesize

                  72KB

                • memory/3716-193-0x0000000005680000-0x000000000578A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3716-191-0x0000000000BD0000-0x0000000000C02000-memory.dmp

                  Filesize

                  200KB