Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2023, 12:02
Behavioral task
behavioral1
Sample
0x000800000001231c-4378.exe
Resource
win7-20230220-en
General
-
Target
0x000800000001231c-4378.exe
-
Size
229KB
-
MD5
9f8c78d49df47af680f591c4b9b2dc7b
-
SHA1
16c24b199ff43e87877a39853eca3d935b532989
-
SHA256
9ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
-
SHA512
7840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
SSDEEP
6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1788 oneetx.exe 1216 oneetx.exe 1896 oneetx.exe -
Loads dropped DLL 5 IoCs
pid Process 1980 0x000800000001231c-4378.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 756 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 0x000800000001231c-4378.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1788 1980 0x000800000001231c-4378.exe 27 PID 1980 wrote to memory of 1788 1980 0x000800000001231c-4378.exe 27 PID 1980 wrote to memory of 1788 1980 0x000800000001231c-4378.exe 27 PID 1980 wrote to memory of 1788 1980 0x000800000001231c-4378.exe 27 PID 1788 wrote to memory of 756 1788 oneetx.exe 28 PID 1788 wrote to memory of 756 1788 oneetx.exe 28 PID 1788 wrote to memory of 756 1788 oneetx.exe 28 PID 1788 wrote to memory of 756 1788 oneetx.exe 28 PID 832 wrote to memory of 1216 832 taskeng.exe 33 PID 832 wrote to memory of 1216 832 taskeng.exe 33 PID 832 wrote to memory of 1216 832 taskeng.exe 33 PID 832 wrote to memory of 1216 832 taskeng.exe 33 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 1788 wrote to memory of 2040 1788 oneetx.exe 34 PID 832 wrote to memory of 1896 832 taskeng.exe 35 PID 832 wrote to memory of 1896 832 taskeng.exe 35 PID 832 wrote to memory of 1896 832 taskeng.exe 35 PID 832 wrote to memory of 1896 832 taskeng.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000800000001231c-4378.exe"C:\Users\Admin\AppData\Local\Temp\0x000800000001231c-4378.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F3⤵
- Creates scheduled task(s)
PID:756
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Loads dropped DLL
PID:2040
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {93EE572D-CF7A-4928-B474-2FF6A387039B} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe2⤵
- Executes dropped EXE
PID:1216
-
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe2⤵
- Executes dropped EXE
PID:1896
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD59f8c78d49df47af680f591c4b9b2dc7b
SHA116c24b199ff43e87877a39853eca3d935b532989
SHA2569ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
SHA5127840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
Filesize
229KB
MD59f8c78d49df47af680f591c4b9b2dc7b
SHA116c24b199ff43e87877a39853eca3d935b532989
SHA2569ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
SHA5127840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
Filesize
229KB
MD59f8c78d49df47af680f591c4b9b2dc7b
SHA116c24b199ff43e87877a39853eca3d935b532989
SHA2569ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
SHA5127840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
Filesize
229KB
MD59f8c78d49df47af680f591c4b9b2dc7b
SHA116c24b199ff43e87877a39853eca3d935b532989
SHA2569ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
SHA5127840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
Filesize
229KB
MD59f8c78d49df47af680f591c4b9b2dc7b
SHA116c24b199ff43e87877a39853eca3d935b532989
SHA2569ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
SHA5127840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
229KB
MD59f8c78d49df47af680f591c4b9b2dc7b
SHA116c24b199ff43e87877a39853eca3d935b532989
SHA2569ae5de0f789fd21484abe71c698b7ffec1765d15ce6eca5271acc9983e21bd1e
SHA5127840cd457db60ab44e588642579b75813bc8e30c45343ad7a00c3410997d12a0bf3d5931d5679d64f608e69217cb558b321745e624a3b8ea9e1d808f90c84db2
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817