Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2023, 05:37

General

  • Target

    d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe

  • Size

    537KB

  • MD5

    f323b7fb5cd5b7b98c995b42145bd709

  • SHA1

    3d5418e18b4763ec5f5400b364b3e5e7f7ba43da

  • SHA256

    d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334

  • SHA512

    c70bcdb4698ffd3ff7bb25c481b4dab4cb199b63dc7e403c71b8c424637fc4d777b944ea912077e4cc9d37dc8ac70d62804bfc5a557dee46ea4a817fd013a55c

  • SSDEEP

    12288:9d5+vYnP4MFbt9ZJM8HHJE/aey6Pl+sZKXIm:9vPLl68JERySl+3N

Malware Config

Extracted

Family

redline

Botnet

well

C2

193.233.20.28:4125

Attributes
  • auth_value

    265e7373dd436339d88347c08a10b402

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe
    "C:\Users\Admin\AppData\Local\Temp\d6c44008d48515cd044cae0ba40c0344ef0e14b91e7cef7f8c6de7e8b2a03334.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1292
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3296
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3116
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3344
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4292
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4640
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:432
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:2548
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4552
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 532
                  2⤵
                  • Program crash
                  PID:1356
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4276 -ip 4276
                1⤵
                  PID:4988
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3560
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4372

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe

                  Filesize

                  226KB

                  MD5

                  8627ebe3777cc777ed2a14b907162224

                  SHA1

                  06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                  SHA256

                  319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                  SHA512

                  9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe

                  Filesize

                  192KB

                  MD5

                  fa4870d435e242159168b9a9b26715de

                  SHA1

                  2284166d902bde49c43ed6056434fd663b1c7aad

                  SHA256

                  6fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42

                  SHA512

                  f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe

                  Filesize

                  192KB

                  MD5

                  fa4870d435e242159168b9a9b26715de

                  SHA1

                  2284166d902bde49c43ed6056434fd663b1c7aad

                  SHA256

                  6fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42

                  SHA512

                  f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe

                  Filesize

                  175KB

                  MD5

                  b3cbfcd14491f891be0baef768f2a4da

                  SHA1

                  47be5bb6f31976fad7f904f52a19a177f84e04de

                  SHA256

                  0c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f

                  SHA512

                  330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe

                  Filesize

                  175KB

                  MD5

                  b3cbfcd14491f891be0baef768f2a4da

                  SHA1

                  47be5bb6f31976fad7f904f52a19a177f84e04de

                  SHA256

                  0c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f

                  SHA512

                  330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf

                • memory/1292-149-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

                  Filesize

                  40KB

                • memory/3296-160-0x0000000005C10000-0x0000000005C20000-memory.dmp

                  Filesize

                  64KB

                • memory/3296-159-0x0000000005910000-0x000000000594C000-memory.dmp

                  Filesize

                  240KB

                • memory/3296-162-0x00000000067D0000-0x0000000006862000-memory.dmp

                  Filesize

                  584KB

                • memory/3296-163-0x0000000006E20000-0x00000000073C4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3296-165-0x0000000006BF0000-0x0000000006DB2000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3296-166-0x0000000007900000-0x0000000007E2C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3296-167-0x0000000005C10000-0x0000000005C20000-memory.dmp

                  Filesize

                  64KB

                • memory/3296-168-0x0000000007450000-0x00000000074C6000-memory.dmp

                  Filesize

                  472KB

                • memory/3296-169-0x00000000074D0000-0x0000000007520000-memory.dmp

                  Filesize

                  320KB

                • memory/3296-161-0x0000000005C20000-0x0000000005C86000-memory.dmp

                  Filesize

                  408KB

                • memory/3296-158-0x00000000058B0000-0x00000000058C2000-memory.dmp

                  Filesize

                  72KB

                • memory/3296-157-0x0000000005980000-0x0000000005A8A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3296-156-0x0000000005E00000-0x0000000006418000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3296-155-0x0000000000ED0000-0x0000000000F02000-memory.dmp

                  Filesize

                  200KB

                • memory/4276-183-0x0000000000400000-0x00000000005CB000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4276-150-0x0000000000400000-0x00000000005CB000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4276-148-0x0000000002340000-0x000000000239F000-memory.dmp

                  Filesize

                  380KB