Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2023, 19:11

General

  • Target

    f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe

  • Size

    582KB

  • MD5

    bb2625881d3493d7eebe3abcabe9503c

  • SHA1

    74a6b22f57e2d9652f3a642ee138d8f192f80a68

  • SHA256

    f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87

  • SHA512

    7951263446ac0baf2a48196a38daaa686b2a3195e8bfd66c39db089709f828ddfbcf4dfd23c223e2078738e3214f7f948ff780430f4381ccd4c7ad105e014ae7

  • SSDEEP

    12288:+Mr+y90YYOwaMAhN4pis8fjM0YOnvo+PZhvbG+J4twoK:kydYFDiDfjXA+PHK+1

Malware Config

Extracted

Family

redline

Botnet

dedo

C2

83.97.73.130:19061

Attributes
  • auth_value

    ac76f7438fbe49011f900c651cb85e26

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

grega

C2

83.97.73.130:19061

Attributes
  • auth_value

    16e2fbc2847b2270b3f0679e2dd76c8d

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe
    "C:\Users\Admin\AppData\Local\Temp\f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6201821.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6201821.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4032871.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4032871.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6480441.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6480441.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1556
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2959014.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2959014.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2796452.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2796452.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
          "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3068
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:5088
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4240
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:5084
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "rugen.exe" /P "Admin:N"
                6⤵
                  PID:4648
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "rugen.exe" /P "Admin:R" /E
                  6⤵
                    PID:1928
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3320
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\200f691d32" /P "Admin:N"
                      6⤵
                        PID:5112
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\200f691d32" /P "Admin:R" /E
                        6⤵
                          PID:1712
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3832
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9050119.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9050119.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4100
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:4752
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:3096

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9050119.exe

                Filesize

                267KB

                MD5

                2cb3aa66517988b50f997418f9a4c362

                SHA1

                3b5bd879a9223aa8d36a524087aa10545e70eb7a

                SHA256

                94a25fca893444cb23a553921cc12f2b498870414ca6958a00bd178a93a82166

                SHA512

                87910f35882e18715118d86c46b7178d3ec4e8264eeb5d123b6befbb717a94925da6b0c6351f8eeabb56fef7b7d699a2d19881659b1fd11cbecdab120a5e2aec

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9050119.exe

                Filesize

                267KB

                MD5

                2cb3aa66517988b50f997418f9a4c362

                SHA1

                3b5bd879a9223aa8d36a524087aa10545e70eb7a

                SHA256

                94a25fca893444cb23a553921cc12f2b498870414ca6958a00bd178a93a82166

                SHA512

                87910f35882e18715118d86c46b7178d3ec4e8264eeb5d123b6befbb717a94925da6b0c6351f8eeabb56fef7b7d699a2d19881659b1fd11cbecdab120a5e2aec

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6201821.exe

                Filesize

                377KB

                MD5

                ecbbc005d9a3d45ea2cfaba13b5530f2

                SHA1

                19487487b0ecb1932a9c6c7c7717869c603fd297

                SHA256

                40239b16bc3a759b565651296de7fed86ef61ae505edd37549fdf32c104db482

                SHA512

                d45a186947e0c6adc07f935cccfb883e2ee696953a91b7e871db630c706626f86561a7946e7b738502f747e8cd5ee0d79706c20a8ce0c068dd28e0fd8baa44bd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6201821.exe

                Filesize

                377KB

                MD5

                ecbbc005d9a3d45ea2cfaba13b5530f2

                SHA1

                19487487b0ecb1932a9c6c7c7717869c603fd297

                SHA256

                40239b16bc3a759b565651296de7fed86ef61ae505edd37549fdf32c104db482

                SHA512

                d45a186947e0c6adc07f935cccfb883e2ee696953a91b7e871db630c706626f86561a7946e7b738502f747e8cd5ee0d79706c20a8ce0c068dd28e0fd8baa44bd

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2796452.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2796452.exe

                Filesize

                205KB

                MD5

                835f1373b125353f2b0615a2f105d3dd

                SHA1

                1aae6edfedcfe6d6828b98b114c581d9f15db807

                SHA256

                00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4

                SHA512

                8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4032871.exe

                Filesize

                205KB

                MD5

                75c64fb9537164edb124e4a208fbd44a

                SHA1

                d488638e8431d5c7c670bc53c4c1fda48f2b3c65

                SHA256

                4bb318bb4935dbe5bb423afcf968a6570427c5d7fe780c9ecf42d7914388ba38

                SHA512

                f1a7d324d24cb8148c58e6e2984a143ce071d63c7f8e4f491836c36a59b057ed03d7009a9719e07b419e6b0f4c213980baa086a6bc5c36944d33fb08d6a8a069

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4032871.exe

                Filesize

                205KB

                MD5

                75c64fb9537164edb124e4a208fbd44a

                SHA1

                d488638e8431d5c7c670bc53c4c1fda48f2b3c65

                SHA256

                4bb318bb4935dbe5bb423afcf968a6570427c5d7fe780c9ecf42d7914388ba38

                SHA512

                f1a7d324d24cb8148c58e6e2984a143ce071d63c7f8e4f491836c36a59b057ed03d7009a9719e07b419e6b0f4c213980baa086a6bc5c36944d33fb08d6a8a069

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6480441.exe

                Filesize

                172KB

                MD5

                49038638c23ea3d9cbd17c8179b798af

                SHA1

                5788e447aa77bba06f6139d074e37730972ad559

                SHA256

                b79ba334f75484966321aecdda26b667250105928d465f7d6775e5713803a578

                SHA512

                666f8f366968e151abbfa2ea572a3460e618a3cb9e5d7715ebb51da3afc8ccfc7ff15c573c2026801ce3864129d8990df39b6d46c36898158e1ace9030fcda7f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6480441.exe

                Filesize

                172KB

                MD5

                49038638c23ea3d9cbd17c8179b798af

                SHA1

                5788e447aa77bba06f6139d074e37730972ad559

                SHA256

                b79ba334f75484966321aecdda26b667250105928d465f7d6775e5713803a578

                SHA512

                666f8f366968e151abbfa2ea572a3460e618a3cb9e5d7715ebb51da3afc8ccfc7ff15c573c2026801ce3864129d8990df39b6d46c36898158e1ace9030fcda7f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2959014.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2959014.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1556-157-0x000000000A4D0000-0x000000000A4E2000-memory.dmp

                Filesize

                72KB

              • memory/1556-158-0x000000000A530000-0x000000000A56C000-memory.dmp

                Filesize

                240KB

              • memory/1556-167-0x000000000C5C0000-0x000000000CAEC000-memory.dmp

                Filesize

                5.2MB

              • memory/1556-166-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

                Filesize

                64KB

              • memory/1556-165-0x000000000BEC0000-0x000000000C082000-memory.dmp

                Filesize

                1.8MB

              • memory/1556-164-0x000000000B560000-0x000000000B5B0000-memory.dmp

                Filesize

                320KB

              • memory/1556-163-0x000000000AA00000-0x000000000AA66000-memory.dmp

                Filesize

                408KB

              • memory/1556-162-0x000000000B740000-0x000000000BCE4000-memory.dmp

                Filesize

                5.6MB

              • memory/1556-161-0x000000000A960000-0x000000000A9F2000-memory.dmp

                Filesize

                584KB

              • memory/1556-154-0x0000000000750000-0x0000000000780000-memory.dmp

                Filesize

                192KB

              • memory/1556-155-0x000000000AA70000-0x000000000B088000-memory.dmp

                Filesize

                6.1MB

              • memory/1556-160-0x000000000A840000-0x000000000A8B6000-memory.dmp

                Filesize

                472KB

              • memory/1556-159-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

                Filesize

                64KB

              • memory/1556-156-0x000000000A590000-0x000000000A69A000-memory.dmp

                Filesize

                1.0MB

              • memory/4064-172-0x0000000000C40000-0x0000000000C4A000-memory.dmp

                Filesize

                40KB

              • memory/4100-194-0x0000000004B20000-0x0000000004B30000-memory.dmp

                Filesize

                64KB

              • memory/4100-190-0x0000000000450000-0x0000000000480000-memory.dmp

                Filesize

                192KB