Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
264s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
03/07/2023, 04:28
Behavioral task
behavioral1
Sample
n8534008.exe
Resource
win7-20230621-en
General
-
Target
n8534008.exe
-
Size
205KB
-
MD5
835f1373b125353f2b0615a2f105d3dd
-
SHA1
1aae6edfedcfe6d6828b98b114c581d9f15db807
-
SHA256
00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
-
SHA512
8826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
SSDEEP
3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj
Malware Config
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 580 rugen.exe 1740 rugen.exe 1608 rugen.exe 904 rugen.exe 584 rugen.exe 992 rugen.exe -
Loads dropped DLL 5 IoCs
pid Process 2032 n8534008.exe 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1212 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 n8534008.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2032 wrote to memory of 580 2032 n8534008.exe 28 PID 2032 wrote to memory of 580 2032 n8534008.exe 28 PID 2032 wrote to memory of 580 2032 n8534008.exe 28 PID 2032 wrote to memory of 580 2032 n8534008.exe 28 PID 580 wrote to memory of 1212 580 rugen.exe 29 PID 580 wrote to memory of 1212 580 rugen.exe 29 PID 580 wrote to memory of 1212 580 rugen.exe 29 PID 580 wrote to memory of 1212 580 rugen.exe 29 PID 580 wrote to memory of 1488 580 rugen.exe 31 PID 580 wrote to memory of 1488 580 rugen.exe 31 PID 580 wrote to memory of 1488 580 rugen.exe 31 PID 580 wrote to memory of 1488 580 rugen.exe 31 PID 1488 wrote to memory of 1784 1488 cmd.exe 33 PID 1488 wrote to memory of 1784 1488 cmd.exe 33 PID 1488 wrote to memory of 1784 1488 cmd.exe 33 PID 1488 wrote to memory of 1784 1488 cmd.exe 33 PID 1488 wrote to memory of 772 1488 cmd.exe 34 PID 1488 wrote to memory of 772 1488 cmd.exe 34 PID 1488 wrote to memory of 772 1488 cmd.exe 34 PID 1488 wrote to memory of 772 1488 cmd.exe 34 PID 1488 wrote to memory of 1900 1488 cmd.exe 35 PID 1488 wrote to memory of 1900 1488 cmd.exe 35 PID 1488 wrote to memory of 1900 1488 cmd.exe 35 PID 1488 wrote to memory of 1900 1488 cmd.exe 35 PID 1488 wrote to memory of 516 1488 cmd.exe 36 PID 1488 wrote to memory of 516 1488 cmd.exe 36 PID 1488 wrote to memory of 516 1488 cmd.exe 36 PID 1488 wrote to memory of 516 1488 cmd.exe 36 PID 1488 wrote to memory of 1152 1488 cmd.exe 37 PID 1488 wrote to memory of 1152 1488 cmd.exe 37 PID 1488 wrote to memory of 1152 1488 cmd.exe 37 PID 1488 wrote to memory of 1152 1488 cmd.exe 37 PID 1488 wrote to memory of 1952 1488 cmd.exe 38 PID 1488 wrote to memory of 1952 1488 cmd.exe 38 PID 1488 wrote to memory of 1952 1488 cmd.exe 38 PID 1488 wrote to memory of 1952 1488 cmd.exe 38 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 580 wrote to memory of 1444 580 rugen.exe 41 PID 880 wrote to memory of 1740 880 taskeng.exe 43 PID 880 wrote to memory of 1740 880 taskeng.exe 43 PID 880 wrote to memory of 1740 880 taskeng.exe 43 PID 880 wrote to memory of 1740 880 taskeng.exe 43 PID 880 wrote to memory of 1608 880 taskeng.exe 44 PID 880 wrote to memory of 1608 880 taskeng.exe 44 PID 880 wrote to memory of 1608 880 taskeng.exe 44 PID 880 wrote to memory of 1608 880 taskeng.exe 44 PID 880 wrote to memory of 904 880 taskeng.exe 45 PID 880 wrote to memory of 904 880 taskeng.exe 45 PID 880 wrote to memory of 904 880 taskeng.exe 45 PID 880 wrote to memory of 904 880 taskeng.exe 45 PID 880 wrote to memory of 584 880 taskeng.exe 46 PID 880 wrote to memory of 584 880 taskeng.exe 46 PID 880 wrote to memory of 584 880 taskeng.exe 46 PID 880 wrote to memory of 584 880 taskeng.exe 46 PID 880 wrote to memory of 992 880 taskeng.exe 47 PID 880 wrote to memory of 992 880 taskeng.exe 47 PID 880 wrote to memory of 992 880 taskeng.exe 47 PID 880 wrote to memory of 992 880 taskeng.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\n8534008.exe"C:\Users\Admin\AppData\Local\Temp\n8534008.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F3⤵
- Creates scheduled task(s)
PID:1212
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1784
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:N"4⤵PID:772
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:R" /E4⤵PID:1900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:516
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:N"4⤵PID:1152
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:R" /E4⤵PID:1952
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:1444
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {19079AED-21F7-4693-91F9-B7B1DEDF448B} S-1-5-21-1306246566-3334493410-3785284834-1000:FQMLBKKW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:992
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
273B
MD504a943771990ab49147e63e8c2fbbed0
SHA1a2bde564bef4f63749716621693a3cfb7bd4d55e
SHA256587c2fb0cf025a255a077b24fe6433fd67bdfac451d74d321d86db96c369841e
SHA51240e325e6e50e2d7b6c9dd0c555e23c85c4a45bd1829a76efa0383dcc05ac5fd19a14804079a5d2523ded92b03b6e3051c3e8780053795be3359bf32dd3094a6d
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf