Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2023, 07:16

General

  • Target

    9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff.exe

  • Size

    459KB

  • MD5

    86655f7893da5dcd3348b097154b6091

  • SHA1

    7ec2a66117af034b39b764c5d16817fc832b9fad

  • SHA256

    9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff

  • SHA512

    12aa7ad6a21bce679b9088874aae8983da92834b2f4c0cc551abc3b23c42e98a5a8476b87848cb88689fd4c38cb67d9bba4a087d88474112a52fb4e0e4cb5df7

  • SSDEEP

    12288:JxFGgNXEsffo5TwN8srb5ZisaL86eb36y2R:J+s0sIdwKSXi/L8rKy2R

Malware Config

Extracted

Family

redline

Botnet

well

C2

193.233.20.28:4125

Attributes
  • auth_value

    265e7373dd436339d88347c08a10b402

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff.exe
    "C:\Users\Admin\AppData\Local\Temp\9f5cd5834b87274b9d0bde0b4c1dbd2ea2b144084a8fbcc910a4262851a48eff.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1708
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4292
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1376
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4332
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:2932
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3940
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:2244
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:2552
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:544
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4996
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:3320
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:2744

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\duI09s41.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe

                Filesize

                192KB

                MD5

                fa4870d435e242159168b9a9b26715de

                SHA1

                2284166d902bde49c43ed6056434fd663b1c7aad

                SHA256

                6fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42

                SHA512

                f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film9537.exe

                Filesize

                192KB

                MD5

                fa4870d435e242159168b9a9b26715de

                SHA1

                2284166d902bde49c43ed6056434fd663b1c7aad

                SHA256

                6fa8bc8f7341e8e2582e6d7c910f99975f88ea0445a8ae979522fde979cace42

                SHA512

                f1d1fe716825fc90dcad5c525d7c4a8931a11ac8cdda40e4c22e1b0ef1231cd9cffba719f83648f93edd5b2d231af592938cfc11474688cf20d94bdb8a8b26a8

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bus8152.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe

                Filesize

                175KB

                MD5

                b3cbfcd14491f891be0baef768f2a4da

                SHA1

                47be5bb6f31976fad7f904f52a19a177f84e04de

                SHA256

                0c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f

                SHA512

                330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con0735.exe

                Filesize

                175KB

                MD5

                b3cbfcd14491f891be0baef768f2a4da

                SHA1

                47be5bb6f31976fad7f904f52a19a177f84e04de

                SHA256

                0c4f122d0b3d47a36ebe292558f5981b3a68f81316f235eec9625f55691ccf7f

                SHA512

                330844ff4f622df3912bbbaddf61d4b20e1ff5406bf9c5e218c794bb2f8a0e7fcd75ae8cb2a28384012413dc1835a4d5d038310aa199983b5744f17385a6abaf

              • memory/1708-149-0x0000000000E90000-0x0000000000E9A000-memory.dmp

                Filesize

                40KB

              • memory/2180-184-0x0000000000400000-0x00000000004F2000-memory.dmp

                Filesize

                968KB

              • memory/2180-138-0x00000000022B0000-0x000000000230F000-memory.dmp

                Filesize

                380KB

              • memory/2180-150-0x0000000000400000-0x00000000004F2000-memory.dmp

                Filesize

                968KB

              • memory/5056-160-0x0000000005530000-0x000000000556C000-memory.dmp

                Filesize

                240KB

              • memory/5056-165-0x00000000064F0000-0x0000000006566000-memory.dmp

                Filesize

                472KB

              • memory/5056-166-0x0000000006570000-0x00000000065C0000-memory.dmp

                Filesize

                320KB

              • memory/5056-167-0x0000000005580000-0x0000000005590000-memory.dmp

                Filesize

                64KB

              • memory/5056-168-0x0000000007020000-0x00000000071E2000-memory.dmp

                Filesize

                1.8MB

              • memory/5056-169-0x0000000007720000-0x0000000007C4C000-memory.dmp

                Filesize

                5.2MB

              • memory/5056-164-0x0000000005900000-0x0000000005966000-memory.dmp

                Filesize

                408KB

              • memory/5056-163-0x00000000066A0000-0x0000000006C44000-memory.dmp

                Filesize

                5.6MB

              • memory/5056-161-0x0000000005860000-0x00000000058F2000-memory.dmp

                Filesize

                584KB

              • memory/5056-159-0x0000000005580000-0x0000000005590000-memory.dmp

                Filesize

                64KB

              • memory/5056-158-0x00000000054D0000-0x00000000054E2000-memory.dmp

                Filesize

                72KB

              • memory/5056-157-0x00000000055C0000-0x00000000056CA000-memory.dmp

                Filesize

                1.0MB

              • memory/5056-156-0x0000000005AD0000-0x00000000060E8000-memory.dmp

                Filesize

                6.1MB

              • memory/5056-155-0x0000000000AE0000-0x0000000000B12000-memory.dmp

                Filesize

                200KB