Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2023, 12:02

General

  • Target

    0x000800000001231c-4378.exe

  • Size

    229KB

  • MD5

    9f8c78d49df47af680f591c4b9b2dc7b

  • SHA1

    16c24b199ff43e87877a39853eca3d935b532989

  • SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

  • SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • SSDEEP

    6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000800000001231c-4378.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000800000001231c-4378.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:756
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        3⤵
        • Loads dropped DLL
        PID:2040
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {93EE572D-CF7A-4928-B474-2FF6A387039B} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      2⤵
      • Executes dropped EXE
      PID:1216
    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      2⤵
      • Executes dropped EXE
      PID:1896

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    9f8c78d49df47af680f591c4b9b2dc7b

    SHA1

    16c24b199ff43e87877a39853eca3d935b532989

    SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

    SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    9f8c78d49df47af680f591c4b9b2dc7b

    SHA1

    16c24b199ff43e87877a39853eca3d935b532989

    SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

    SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    9f8c78d49df47af680f591c4b9b2dc7b

    SHA1

    16c24b199ff43e87877a39853eca3d935b532989

    SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

    SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    9f8c78d49df47af680f591c4b9b2dc7b

    SHA1

    16c24b199ff43e87877a39853eca3d935b532989

    SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

    SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    9f8c78d49df47af680f591c4b9b2dc7b

    SHA1

    16c24b199ff43e87877a39853eca3d935b532989

    SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

    SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

  • \Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    9f8c78d49df47af680f591c4b9b2dc7b

    SHA1

    16c24b199ff43e87877a39853eca3d935b532989

    SHA256

    9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e

    SHA512

    7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817