Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2023, 07:36

General

  • Target

    c81067a2bd494fd599d348faf5525e20.exe

  • Size

    773KB

  • MD5

    c81067a2bd494fd599d348faf5525e20

  • SHA1

    8d0c9c5a989119a6274e0a0ccadd3967355e1792

  • SHA256

    d8525593464fd57668aa86ee583452f5db36c7d55583252837072d3c1e54da47

  • SHA512

    2ba558a5852f3527c1dc454add20caca62ed9742c2dccf8025b7445495a2cfaa1c61c195a6b50c0600ac73f47f24446e5490df112dc5d7b273f4250438095c91

  • SSDEEP

    12288:8AZN5Bv30aX6nqtNl7BAmsRhUFjeTIEhhyFTIP2qVpZfxOFyrMxS6DVT:9N5Bv30a1l7StedeKGPnVPoS6DVT

Malware Config

Extracted

Family

redline

Botnet

dezik

C2

193.56.146.220:4174

Attributes
  • auth_value

    d39f21dca8edc10800b036ab83f4d75e

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c81067a2bd494fd599d348faf5525e20.exe
    "C:\Users\Admin\AppData\Local\Temp\c81067a2bd494fd599d348faf5525e20.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:524
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1152
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe
      2⤵
      • Executes dropped EXE
      PID:1236
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:764
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:472
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:336
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:1944
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1032
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:328
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:1424
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1524
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {00FCE822-4042-403E-8A89-A8801AFE0AC4} S-1-5-21-1914912747-3343861975-731272777-1000:TMRJMUQF\Admin:Interactive:[1]
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1920
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  2⤵
                    PID:1676

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                  Filesize

                  382KB

                  MD5

                  65e4e4f30a4aef3d28440aefb0a4b05b

                  SHA1

                  9ba27fc1878e66823785565db46369ca3b065d35

                  SHA256

                  56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                  SHA512

                  86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                  Filesize

                  382KB

                  MD5

                  65e4e4f30a4aef3d28440aefb0a4b05b

                  SHA1

                  9ba27fc1878e66823785565db46369ca3b065d35

                  SHA256

                  56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                  SHA512

                  86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                  Filesize

                  175KB

                  MD5

                  92f2a148b8f701e50e2f838f73d4d7b7

                  SHA1

                  324d8546e35d4f4285cac15b21620299ba5cb023

                  SHA256

                  9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                  SHA512

                  3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                  Filesize

                  175KB

                  MD5

                  92f2a148b8f701e50e2f838f73d4d7b7

                  SHA1

                  324d8546e35d4f4285cac15b21620299ba5cb023

                  SHA256

                  9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                  SHA512

                  3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

                • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • \Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                  Filesize

                  382KB

                  MD5

                  65e4e4f30a4aef3d28440aefb0a4b05b

                  SHA1

                  9ba27fc1878e66823785565db46369ca3b065d35

                  SHA256

                  56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                  SHA512

                  86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

                • \Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                  Filesize

                  382KB

                  MD5

                  65e4e4f30a4aef3d28440aefb0a4b05b

                  SHA1

                  9ba27fc1878e66823785565db46369ca3b065d35

                  SHA256

                  56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                  SHA512

                  86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

                • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                  Filesize

                  323KB

                  MD5

                  ee43881ab62092621b2d2e22a0295878

                  SHA1

                  0339221e3f787602fea6a0541817565d751a293c

                  SHA256

                  2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                  SHA512

                  df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

                • \Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                  Filesize

                  175KB

                  MD5

                  92f2a148b8f701e50e2f838f73d4d7b7

                  SHA1

                  324d8546e35d4f4285cac15b21620299ba5cb023

                  SHA256

                  9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                  SHA512

                  3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

                • \Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                  Filesize

                  175KB

                  MD5

                  92f2a148b8f701e50e2f838f73d4d7b7

                  SHA1

                  324d8546e35d4f4285cac15b21620299ba5cb023

                  SHA256

                  9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                  SHA512

                  3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

                • memory/524-95-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-113-0x0000000000400000-0x00000000004D4000-memory.dmp

                  Filesize

                  848KB

                • memory/524-89-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-91-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-93-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-80-0x0000000000240000-0x000000000026D000-memory.dmp

                  Filesize

                  180KB

                • memory/524-97-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-99-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-101-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-103-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-105-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-111-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-109-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-107-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-81-0x00000000003E0000-0x00000000003FA000-memory.dmp

                  Filesize

                  104KB

                • memory/524-87-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-82-0x0000000004CC0000-0x0000000004D00000-memory.dmp

                  Filesize

                  256KB

                • memory/524-115-0x0000000000400000-0x00000000004D4000-memory.dmp

                  Filesize

                  848KB

                • memory/524-85-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-84-0x00000000005E0000-0x00000000005F2000-memory.dmp

                  Filesize

                  72KB

                • memory/524-83-0x00000000005E0000-0x00000000005F8000-memory.dmp

                  Filesize

                  96KB

                • memory/904-114-0x0000000000550000-0x00000000005DF000-memory.dmp

                  Filesize

                  572KB

                • memory/904-112-0x0000000000400000-0x0000000000545000-memory.dmp

                  Filesize

                  1.3MB

                • memory/904-54-0x0000000000230000-0x00000000002B5000-memory.dmp

                  Filesize

                  532KB

                • memory/904-55-0x0000000000550000-0x00000000005DF000-memory.dmp

                  Filesize

                  572KB

                • memory/904-147-0x0000000000400000-0x0000000000545000-memory.dmp

                  Filesize

                  1.3MB

                • memory/1152-122-0x0000000000070000-0x00000000000A2000-memory.dmp

                  Filesize

                  200KB

                • memory/1152-124-0x0000000000620000-0x0000000000660000-memory.dmp

                  Filesize

                  256KB

                • memory/1152-126-0x0000000000620000-0x0000000000660000-memory.dmp

                  Filesize

                  256KB