Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
17/07/2023, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe
Resource
win10-20230703-en
General
-
Target
2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe
-
Size
390KB
-
MD5
a0fe69670671b4867f4a47b9532cdc78
-
SHA1
efe66d739057b14127368dad47b88f3b8caefe91
-
SHA256
2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853
-
SHA512
cc4509bc3ffc1a7484e06c8931c7eebeb7bfcc08a82800f0989d01a657e3ad3518369c5cdf2dffafbc3b3793e13d94bccad9e8291d08b5975dbcef1c6768a8c4
-
SSDEEP
6144:K6y+bnr+9p0yN90QEnSGcHSVvb46L6hGlxygsnnNLvYpGtxSzKswLpf42aYlzckU:aMrVy90InyVDMnNbue35BmG3L0
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
zahar
77.91.68.56:19071
-
auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000600000001afb0-139.dat healer behavioral1/files/0x000600000001afb0-140.dat healer behavioral1/memory/2100-141-0x00000000003D0000-0x00000000003DA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h6860540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h6860540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h6860540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h6860540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h6860540.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 3884 x4655187.exe 3672 g0364147.exe 4804 danke.exe 2100 h6860540.exe 4448 j4400304.exe 4236 danke.exe 4436 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 3968 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h6860540.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x4655187.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x4655187.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 344 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2100 h6860540.exe 2100 h6860540.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2100 h6860540.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3672 g0364147.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3884 4852 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe 69 PID 4852 wrote to memory of 3884 4852 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe 69 PID 4852 wrote to memory of 3884 4852 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe 69 PID 3884 wrote to memory of 3672 3884 x4655187.exe 70 PID 3884 wrote to memory of 3672 3884 x4655187.exe 70 PID 3884 wrote to memory of 3672 3884 x4655187.exe 70 PID 3672 wrote to memory of 4804 3672 g0364147.exe 71 PID 3672 wrote to memory of 4804 3672 g0364147.exe 71 PID 3672 wrote to memory of 4804 3672 g0364147.exe 71 PID 3884 wrote to memory of 2100 3884 x4655187.exe 72 PID 3884 wrote to memory of 2100 3884 x4655187.exe 72 PID 4804 wrote to memory of 344 4804 danke.exe 73 PID 4804 wrote to memory of 344 4804 danke.exe 73 PID 4804 wrote to memory of 344 4804 danke.exe 73 PID 4804 wrote to memory of 1816 4804 danke.exe 75 PID 4804 wrote to memory of 1816 4804 danke.exe 75 PID 4804 wrote to memory of 1816 4804 danke.exe 75 PID 1816 wrote to memory of 2432 1816 cmd.exe 77 PID 1816 wrote to memory of 2432 1816 cmd.exe 77 PID 1816 wrote to memory of 2432 1816 cmd.exe 77 PID 1816 wrote to memory of 4352 1816 cmd.exe 78 PID 1816 wrote to memory of 4352 1816 cmd.exe 78 PID 1816 wrote to memory of 4352 1816 cmd.exe 78 PID 1816 wrote to memory of 520 1816 cmd.exe 79 PID 1816 wrote to memory of 520 1816 cmd.exe 79 PID 1816 wrote to memory of 520 1816 cmd.exe 79 PID 1816 wrote to memory of 2080 1816 cmd.exe 80 PID 1816 wrote to memory of 2080 1816 cmd.exe 80 PID 1816 wrote to memory of 2080 1816 cmd.exe 80 PID 1816 wrote to memory of 3712 1816 cmd.exe 81 PID 1816 wrote to memory of 3712 1816 cmd.exe 81 PID 1816 wrote to memory of 3712 1816 cmd.exe 81 PID 1816 wrote to memory of 364 1816 cmd.exe 82 PID 1816 wrote to memory of 364 1816 cmd.exe 82 PID 1816 wrote to memory of 364 1816 cmd.exe 82 PID 4852 wrote to memory of 4448 4852 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe 83 PID 4852 wrote to memory of 4448 4852 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe 83 PID 4852 wrote to memory of 4448 4852 2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe 83 PID 4804 wrote to memory of 3968 4804 danke.exe 85 PID 4804 wrote to memory of 3968 4804 danke.exe 85 PID 4804 wrote to memory of 3968 4804 danke.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe"C:\Users\Admin\AppData\Local\Temp\2e86d3fc5d4194ea99d9d18407169d0a4f1ef70e1f6763796aa498f55c568853.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4655187.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4655187.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0364147.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0364147.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:344
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2432
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:4352
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2080
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3712
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:364
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3968
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6860540.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6860540.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4400304.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4400304.exe2⤵
- Executes dropped EXE
PID:4448
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4236
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD5a1ecd6c60d1bc30a03224c652377b518
SHA17ff8568e07f6bcf908196c1f833d0f6d87bb4918
SHA256d2a5090de03f7ca03015207e27381162baa178418944f391253e0ac7f4dd40bf
SHA5120aebee35d6c7238cf12bbda263c2dafc39ca1c37b3298c6e8487c89dd47e2856abfae421d0f660cd9bf2580617f6a7632f52717130f4f9281ece3961868e2a9f
-
Filesize
174KB
MD5a1ecd6c60d1bc30a03224c652377b518
SHA17ff8568e07f6bcf908196c1f833d0f6d87bb4918
SHA256d2a5090de03f7ca03015207e27381162baa178418944f391253e0ac7f4dd40bf
SHA5120aebee35d6c7238cf12bbda263c2dafc39ca1c37b3298c6e8487c89dd47e2856abfae421d0f660cd9bf2580617f6a7632f52717130f4f9281ece3961868e2a9f
-
Filesize
234KB
MD5e96f74baa7d3f4251e9a1cd8ef245f99
SHA111b66720faf1a61b4f61acce98a13f85be66c2f3
SHA256ca7e940cf12a1096edc6b0c6ba8f8e9eae685a8f811514671ada987f440ee68b
SHA512e86fabea0ff6abc4ec9de216aabee5535e0ea3f7a613aea8df9e5ebbe796573c8e7f309f311d4eff0529a196c17238042260b6f1bdaabcee5d1d2cd93153f0d0
-
Filesize
234KB
MD5e96f74baa7d3f4251e9a1cd8ef245f99
SHA111b66720faf1a61b4f61acce98a13f85be66c2f3
SHA256ca7e940cf12a1096edc6b0c6ba8f8e9eae685a8f811514671ada987f440ee68b
SHA512e86fabea0ff6abc4ec9de216aabee5535e0ea3f7a613aea8df9e5ebbe796573c8e7f309f311d4eff0529a196c17238042260b6f1bdaabcee5d1d2cd93153f0d0
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9