Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2023, 07:36

General

  • Target

    d8427d753b839fc16cef130eedefe06b.exe

  • Size

    716KB

  • MD5

    d8427d753b839fc16cef130eedefe06b

  • SHA1

    2316de94ac85a9f068a1620cb419e9aae351cef0

  • SHA256

    8bf33dea1c91ed1e58fbd244349f9ce410c88cb6a02e7fe57b373e6acb6e75b4

  • SHA512

    cc4d8d6ced4bc8ed65310fd00e992c95b5a498e66114b0befd0d6d719d5ac759174f29c1a537b757b2af457f3bc7442c0eda7098bf1300dca98abd4151be9920

  • SSDEEP

    12288:skQH4MLTHJ9dj9pi/3TtReM4AreTcrrVGU5k7yDpLD5kNS2U/:G4MnHJ9JK3TtReMa8r0U5iyfkNW

Malware Config

Extracted

Family

redline

Botnet

dezik

C2

193.56.146.220:4174

Attributes
  • auth_value

    d39f21dca8edc10800b036ab83f4d75e

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8427d753b839fc16cef130eedefe06b.exe
    "C:\Users\Admin\AppData\Local\Temp\d8427d753b839fc16cef130eedefe06b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1676
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:908
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:904
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:1028
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:268
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1612
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1776
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:1616
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1752
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {05401739-4912-4DE0-B14A-EA6F1BA8BB97} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:380
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1756
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2012

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                Filesize

                382KB

                MD5

                65e4e4f30a4aef3d28440aefb0a4b05b

                SHA1

                9ba27fc1878e66823785565db46369ca3b065d35

                SHA256

                56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                SHA512

                86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                Filesize

                382KB

                MD5

                65e4e4f30a4aef3d28440aefb0a4b05b

                SHA1

                9ba27fc1878e66823785565db46369ca3b065d35

                SHA256

                56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                SHA512

                86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                Filesize

                323KB

                MD5

                ee43881ab62092621b2d2e22a0295878

                SHA1

                0339221e3f787602fea6a0541817565d751a293c

                SHA256

                2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                SHA512

                df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                Filesize

                323KB

                MD5

                ee43881ab62092621b2d2e22a0295878

                SHA1

                0339221e3f787602fea6a0541817565d751a293c

                SHA256

                2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                SHA512

                df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                Filesize

                323KB

                MD5

                ee43881ab62092621b2d2e22a0295878

                SHA1

                0339221e3f787602fea6a0541817565d751a293c

                SHA256

                2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                SHA512

                df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                Filesize

                175KB

                MD5

                92f2a148b8f701e50e2f838f73d4d7b7

                SHA1

                324d8546e35d4f4285cac15b21620299ba5cb023

                SHA256

                9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                SHA512

                3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                Filesize

                175KB

                MD5

                92f2a148b8f701e50e2f838f73d4d7b7

                SHA1

                324d8546e35d4f4285cac15b21620299ba5cb023

                SHA256

                9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                SHA512

                3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

              • \Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dRF92s79.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • \Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                Filesize

                382KB

                MD5

                65e4e4f30a4aef3d28440aefb0a4b05b

                SHA1

                9ba27fc1878e66823785565db46369ca3b065d35

                SHA256

                56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                SHA512

                86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

              • \Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe

                Filesize

                382KB

                MD5

                65e4e4f30a4aef3d28440aefb0a4b05b

                SHA1

                9ba27fc1878e66823785565db46369ca3b065d35

                SHA256

                56566c47f68d8ec0b75f780b64efe454c5bf0ecd29dfd9f0ca75378dc0a002fa

                SHA512

                86ba9d1b36fc3f8e53465ae1492d7d4df2d7b34fa5805a0d669452cea7b3bc4001a3ac62a1d0d871ed5786f08eaaff6c446964d8d72c8dff697a7ab5f63032e4

              • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                Filesize

                323KB

                MD5

                ee43881ab62092621b2d2e22a0295878

                SHA1

                0339221e3f787602fea6a0541817565d751a293c

                SHA256

                2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                SHA512

                df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

              • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                Filesize

                323KB

                MD5

                ee43881ab62092621b2d2e22a0295878

                SHA1

                0339221e3f787602fea6a0541817565d751a293c

                SHA256

                2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                SHA512

                df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

              • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe

                Filesize

                323KB

                MD5

                ee43881ab62092621b2d2e22a0295878

                SHA1

                0339221e3f787602fea6a0541817565d751a293c

                SHA256

                2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

                SHA512

                df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

              • \Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                Filesize

                175KB

                MD5

                92f2a148b8f701e50e2f838f73d4d7b7

                SHA1

                324d8546e35d4f4285cac15b21620299ba5cb023

                SHA256

                9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                SHA512

                3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

              • \Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe

                Filesize

                175KB

                MD5

                92f2a148b8f701e50e2f838f73d4d7b7

                SHA1

                324d8546e35d4f4285cac15b21620299ba5cb023

                SHA256

                9ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04

                SHA512

                3300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c

              • memory/840-137-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/840-113-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/840-80-0x0000000001E10000-0x0000000001E9F000-memory.dmp

                Filesize

                572KB

              • memory/840-54-0x0000000000350000-0x00000000003D5000-memory.dmp

                Filesize

                532KB

              • memory/1676-122-0x0000000000200000-0x0000000000232000-memory.dmp

                Filesize

                200KB

              • memory/1676-123-0x0000000005090000-0x00000000050D0000-memory.dmp

                Filesize

                256KB

              • memory/1764-79-0x0000000000B00000-0x0000000000B1A000-memory.dmp

                Filesize

                104KB

              • memory/1764-112-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-110-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-108-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-114-0x0000000000400000-0x00000000004D4000-memory.dmp

                Filesize

                848KB

              • memory/1764-115-0x0000000000400000-0x00000000004D4000-memory.dmp

                Filesize

                848KB

              • memory/1764-104-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-106-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-100-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-102-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-96-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-98-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-92-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-94-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-90-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-88-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-86-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-85-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                Filesize

                72KB

              • memory/1764-84-0x0000000000BA0000-0x0000000000BB8000-memory.dmp

                Filesize

                96KB

              • memory/1764-83-0x0000000000B40000-0x0000000000B80000-memory.dmp

                Filesize

                256KB

              • memory/1764-82-0x0000000000B40000-0x0000000000B80000-memory.dmp

                Filesize

                256KB

              • memory/1764-81-0x0000000000280000-0x00000000002AD000-memory.dmp

                Filesize

                180KB