Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24/04/2023, 19:41
Static task
static1
General
-
Target
72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe
-
Size
1.0MB
-
MD5
1180fb9ee6f43ea57e520084d89822a6
-
SHA1
0e6315f82abd127853851374931f2ab8f2196511
-
SHA256
72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d
-
SHA512
cc060fbe451a37b10447596497c44857aa69e657bf35dcda7f88e36e4f488c135abb67566877fa61bd03ba0449a44ce7ab626b15f653acb960eeb582c6151cc7
-
SSDEEP
24576:+yW0Rg9IeHlRrP+wdYWy+X0lhZgmWZwtX:N2HlTdjyGgZDz
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 39520144.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 39520144.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 39520144.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 39520144.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 39520144.exe -
Executes dropped EXE 9 IoCs
pid Process 4300 za547358.exe 4624 za127015.exe 4008 39520144.exe 1084 w78eE51.exe 4620 xvEoS86.exe 4160 oneetx.exe 4172 ys508003.exe 4620 oneetx.exe 5048 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5020 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 39520144.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 39520144.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za127015.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za547358.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za547358.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za127015.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4008 39520144.exe 4008 39520144.exe 1084 w78eE51.exe 1084 w78eE51.exe 4172 ys508003.exe 4172 ys508003.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4008 39520144.exe Token: SeDebugPrivilege 1084 w78eE51.exe Token: SeDebugPrivilege 4172 ys508003.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4620 xvEoS86.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3628 wrote to memory of 4300 3628 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe 66 PID 3628 wrote to memory of 4300 3628 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe 66 PID 3628 wrote to memory of 4300 3628 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe 66 PID 4300 wrote to memory of 4624 4300 za547358.exe 67 PID 4300 wrote to memory of 4624 4300 za547358.exe 67 PID 4300 wrote to memory of 4624 4300 za547358.exe 67 PID 4624 wrote to memory of 4008 4624 za127015.exe 68 PID 4624 wrote to memory of 4008 4624 za127015.exe 68 PID 4624 wrote to memory of 4008 4624 za127015.exe 68 PID 4624 wrote to memory of 1084 4624 za127015.exe 69 PID 4624 wrote to memory of 1084 4624 za127015.exe 69 PID 4624 wrote to memory of 1084 4624 za127015.exe 69 PID 4300 wrote to memory of 4620 4300 za547358.exe 71 PID 4300 wrote to memory of 4620 4300 za547358.exe 71 PID 4300 wrote to memory of 4620 4300 za547358.exe 71 PID 4620 wrote to memory of 4160 4620 xvEoS86.exe 72 PID 4620 wrote to memory of 4160 4620 xvEoS86.exe 72 PID 4620 wrote to memory of 4160 4620 xvEoS86.exe 72 PID 3628 wrote to memory of 4172 3628 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe 73 PID 3628 wrote to memory of 4172 3628 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe 73 PID 3628 wrote to memory of 4172 3628 72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe 73 PID 4160 wrote to memory of 3924 4160 oneetx.exe 74 PID 4160 wrote to memory of 3924 4160 oneetx.exe 74 PID 4160 wrote to memory of 3924 4160 oneetx.exe 74 PID 4160 wrote to memory of 5020 4160 oneetx.exe 77 PID 4160 wrote to memory of 5020 4160 oneetx.exe 77 PID 4160 wrote to memory of 5020 4160 oneetx.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe"C:\Users\Admin\AppData\Local\Temp\72f585f24f8efbdd0c4a0c1dede395c282856e8cd25af1e2d7055ee053b5e24d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za547358.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za547358.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za127015.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za127015.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\39520144.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\39520144.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w78eE51.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w78eE51.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xvEoS86.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xvEoS86.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:3924
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:5020
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys508003.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys508003.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:5048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
459KB
MD5c97e22ae4aac3dd93fd653f498991773
SHA18d7bf0a28bbd28a74e9f3454af587af6f669548f
SHA25601fbaf34e6e98be9ea2f535a481d2b3fbc52ca6dbe2f35d2db92e95f06481b7e
SHA512a3d8fdeaf2985e5b5fab0f6da63c227f388907f52d9059d8ce6b33d69eb12fae04e2dc0c661da9ed2634e09bc9efbb10a65e1f7b4ca8d0c8e4bf0c2ab6aff3ef
-
Filesize
459KB
MD5c97e22ae4aac3dd93fd653f498991773
SHA18d7bf0a28bbd28a74e9f3454af587af6f669548f
SHA25601fbaf34e6e98be9ea2f535a481d2b3fbc52ca6dbe2f35d2db92e95f06481b7e
SHA512a3d8fdeaf2985e5b5fab0f6da63c227f388907f52d9059d8ce6b33d69eb12fae04e2dc0c661da9ed2634e09bc9efbb10a65e1f7b4ca8d0c8e4bf0c2ab6aff3ef
-
Filesize
775KB
MD52e79e4fd2bb1ed837642e1846f408885
SHA195d9321c0597999103c217fef06a3debb274ca6c
SHA256dbe9eb72e2e8cc3be9ffd9162dcef9d80a0152f1e3a8dae480a4138ca84ab7b6
SHA512a656e37814efe171fa5033876cbfec92d0d167f7cb43b06b77aeceba7083e88116141c3505c1b3f918008b9fb4ac8a9abab807918d71795aec8c6c107c5cd871
-
Filesize
775KB
MD52e79e4fd2bb1ed837642e1846f408885
SHA195d9321c0597999103c217fef06a3debb274ca6c
SHA256dbe9eb72e2e8cc3be9ffd9162dcef9d80a0152f1e3a8dae480a4138ca84ab7b6
SHA512a656e37814efe171fa5033876cbfec92d0d167f7cb43b06b77aeceba7083e88116141c3505c1b3f918008b9fb4ac8a9abab807918d71795aec8c6c107c5cd871
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
592KB
MD578e5ff43d54ed7bab77679a657f63c90
SHA140f0adc201e3717f75767b9d21f4055fad147e50
SHA256d0acf83fea2c576f87aafd9aa6952825d85e5343702452bb57e3dc1fca887028
SHA512572a61ed7f69a008d9d29e92b36dbf4f1b1779c83a98f6f4d7d27632b2d48102e56a5dc354f27dffb284a35b3b469be2a405a71cf5c4980f436faecfc1e26093
-
Filesize
592KB
MD578e5ff43d54ed7bab77679a657f63c90
SHA140f0adc201e3717f75767b9d21f4055fad147e50
SHA256d0acf83fea2c576f87aafd9aa6952825d85e5343702452bb57e3dc1fca887028
SHA512572a61ed7f69a008d9d29e92b36dbf4f1b1779c83a98f6f4d7d27632b2d48102e56a5dc354f27dffb284a35b3b469be2a405a71cf5c4980f436faecfc1e26093
-
Filesize
377KB
MD577ca67247d7a272a8c428d694c971bce
SHA129cbb73128b07804e0b681acbe4dccb39deea724
SHA256e1c89680e5c7104d024c79089091e5f1c56c66163a54472566d7689dd72e3bf7
SHA51203350e0ae99518aa81775d774450239bb197abf09e2f9f4ec2393e8a0fe82a77ba57765b0cb3e268e62b5bc77cb72328a20242b7bef5c83a25374f2ee0126c5a
-
Filesize
377KB
MD577ca67247d7a272a8c428d694c971bce
SHA129cbb73128b07804e0b681acbe4dccb39deea724
SHA256e1c89680e5c7104d024c79089091e5f1c56c66163a54472566d7689dd72e3bf7
SHA51203350e0ae99518aa81775d774450239bb197abf09e2f9f4ec2393e8a0fe82a77ba57765b0cb3e268e62b5bc77cb72328a20242b7bef5c83a25374f2ee0126c5a
-
Filesize
459KB
MD57a98ec8bc733ca4165af061677ac5752
SHA1821c5578208209a9b4210442b97592fdcd7ae0ad
SHA2568453f0c8fe2a1df025250d237b80302f7fd9406cc6030a892c61d2880b1717c7
SHA51293768429cbccd9dca02c07e3c7acfd5cb84bfd0be21dae278ae1aa5ca57cf0970fc58e051cf1472cbc02e6ee3b61f50492f8cedc1a1bbb98a7969fea4bcbc29c
-
Filesize
459KB
MD57a98ec8bc733ca4165af061677ac5752
SHA1821c5578208209a9b4210442b97592fdcd7ae0ad
SHA2568453f0c8fe2a1df025250d237b80302f7fd9406cc6030a892c61d2880b1717c7
SHA51293768429cbccd9dca02c07e3c7acfd5cb84bfd0be21dae278ae1aa5ca57cf0970fc58e051cf1472cbc02e6ee3b61f50492f8cedc1a1bbb98a7969fea4bcbc29c
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817