Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2023, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe
Resource
win10v2004-20230703-en
General
-
Target
a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe
-
Size
390KB
-
MD5
8dfd2098bf98dcf3012a2768dbc3413e
-
SHA1
5010031333cd26a0e88364df7f7fbbb26cd10440
-
SHA256
a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc
-
SHA512
6d6ad94263499200c1ab5f5dd845518503a0112930cc5a7f10c806c8ef1fd23adea93a2bd7f0e9837a95eac809f8981d667ac1a7f4c7c653abc84133c480311d
-
SSDEEP
6144:KGy+bnr+kp0yN90QE/8GvruxThX3kW8nZNX5YHUp2eWuOFDFdiYT0Y7r+TEh:OMrgy902GU1tnF3iYT0erwu
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
zahar
77.91.68.56:19071
-
auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00060000000230cb-158.dat healer behavioral1/files/0x00060000000230cb-159.dat healer behavioral1/memory/2660-160-0x0000000000BC0000-0x0000000000BCA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h1279936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h1279936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h1279936.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h1279936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h1279936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h1279936.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation g6238597.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 624 x4730660.exe 1268 g6238597.exe 4036 danke.exe 2660 h1279936.exe 1760 j3089891.exe 2896 danke.exe 4128 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 552 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h1279936.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x4730660.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x4730660.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1236 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2660 h1279936.exe 2660 h1279936.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 h1279936.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1268 g6238597.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4252 wrote to memory of 624 4252 a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe 86 PID 4252 wrote to memory of 624 4252 a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe 86 PID 4252 wrote to memory of 624 4252 a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe 86 PID 624 wrote to memory of 1268 624 x4730660.exe 87 PID 624 wrote to memory of 1268 624 x4730660.exe 87 PID 624 wrote to memory of 1268 624 x4730660.exe 87 PID 1268 wrote to memory of 4036 1268 g6238597.exe 90 PID 1268 wrote to memory of 4036 1268 g6238597.exe 90 PID 1268 wrote to memory of 4036 1268 g6238597.exe 90 PID 624 wrote to memory of 2660 624 x4730660.exe 91 PID 624 wrote to memory of 2660 624 x4730660.exe 91 PID 4036 wrote to memory of 1236 4036 danke.exe 92 PID 4036 wrote to memory of 1236 4036 danke.exe 92 PID 4036 wrote to memory of 1236 4036 danke.exe 92 PID 4036 wrote to memory of 3744 4036 danke.exe 94 PID 4036 wrote to memory of 3744 4036 danke.exe 94 PID 4036 wrote to memory of 3744 4036 danke.exe 94 PID 3744 wrote to memory of 2472 3744 cmd.exe 96 PID 3744 wrote to memory of 2472 3744 cmd.exe 96 PID 3744 wrote to memory of 2472 3744 cmd.exe 96 PID 3744 wrote to memory of 1848 3744 cmd.exe 97 PID 3744 wrote to memory of 1848 3744 cmd.exe 97 PID 3744 wrote to memory of 1848 3744 cmd.exe 97 PID 3744 wrote to memory of 4448 3744 cmd.exe 98 PID 3744 wrote to memory of 4448 3744 cmd.exe 98 PID 3744 wrote to memory of 4448 3744 cmd.exe 98 PID 3744 wrote to memory of 3424 3744 cmd.exe 99 PID 3744 wrote to memory of 3424 3744 cmd.exe 99 PID 3744 wrote to memory of 3424 3744 cmd.exe 99 PID 3744 wrote to memory of 3392 3744 cmd.exe 100 PID 3744 wrote to memory of 3392 3744 cmd.exe 100 PID 3744 wrote to memory of 3392 3744 cmd.exe 100 PID 3744 wrote to memory of 2236 3744 cmd.exe 101 PID 3744 wrote to memory of 2236 3744 cmd.exe 101 PID 3744 wrote to memory of 2236 3744 cmd.exe 101 PID 4252 wrote to memory of 1760 4252 a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe 108 PID 4252 wrote to memory of 1760 4252 a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe 108 PID 4252 wrote to memory of 1760 4252 a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe 108 PID 4036 wrote to memory of 552 4036 danke.exe 112 PID 4036 wrote to memory of 552 4036 danke.exe 112 PID 4036 wrote to memory of 552 4036 danke.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe"C:\Users\Admin\AppData\Local\Temp\a588845cd0e47d77eb079dcb0811cf918b598e34fa3a13635daf312afdf8a5fc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4730660.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4730660.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6238597.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6238597.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1236
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2472
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:1848
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:4448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3424
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3392
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:2236
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1279936.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1279936.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3089891.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3089891.exe2⤵
- Executes dropped EXE
PID:1760
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD5182333fc28952c74392eb26cd64d4be0
SHA1b438454848306722f4c3a8d3274e15a436db8306
SHA256bba2d84397354ae6e0c8eb25aaa1346d43e3463770dfb76aeb857325960cbcd4
SHA5122028e69898ec21f2e5a939d8e012825754b3d1b3e976b8bddc54756f9fefd7b625b2d969191d3eef4e6b21648dbc31fed7bf7a5b15cc599e775be4cf020fb3e6
-
Filesize
174KB
MD5182333fc28952c74392eb26cd64d4be0
SHA1b438454848306722f4c3a8d3274e15a436db8306
SHA256bba2d84397354ae6e0c8eb25aaa1346d43e3463770dfb76aeb857325960cbcd4
SHA5122028e69898ec21f2e5a939d8e012825754b3d1b3e976b8bddc54756f9fefd7b625b2d969191d3eef4e6b21648dbc31fed7bf7a5b15cc599e775be4cf020fb3e6
-
Filesize
234KB
MD5ec89071250ab4b5a6a4991b189e6fad6
SHA14da26df0efccee648ea307de387a126626cbdc28
SHA25657e83873943fc76441f46c4603478455b94b7e78a3604ba0631f6613447d3841
SHA512f210882409e46ae70d4d5a91bff8e67b4fa8d1c7cc10567a15ceccf2685fac7ec5be97f4a8bd0e3882c7108b488752860f80a66a18bc76d64e598a89551834bc
-
Filesize
234KB
MD5ec89071250ab4b5a6a4991b189e6fad6
SHA14da26df0efccee648ea307de387a126626cbdc28
SHA25657e83873943fc76441f46c4603478455b94b7e78a3604ba0631f6613447d3841
SHA512f210882409e46ae70d4d5a91bff8e67b4fa8d1c7cc10567a15ceccf2685fac7ec5be97f4a8bd0e3882c7108b488752860f80a66a18bc76d64e598a89551834bc
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59