Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
17/07/2023, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe
Resource
win10-20230703-en
General
-
Target
a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe
-
Size
390KB
-
MD5
247f1fe3238fa1afeb5205d6807d5f89
-
SHA1
058c54c7f0fe0ccf5bc7edb9ffbe6507327f4171
-
SHA256
a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8
-
SHA512
32d0cc8d87f89869c913a94c502d9315b6d6bdbd886a331989a34fd6b20370c1b1fc5974b410bc6fe01429a550c8c05b6482d546b6897ce3b3e06dd5b89d79f9
-
SSDEEP
6144:KWy+bnr+yp0yN90QEaP9sWZAvnXohKxHo6L8REgnbLJPwCcHnlRHK7pHjQDMqOH:OMr2y908qWOvXxH6Rfv9hcHnl9oFcRV
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
zahar
77.91.68.56:19071
-
auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b00c-130.dat healer behavioral1/files/0x000700000001b00c-129.dat healer behavioral1/memory/856-131-0x0000000000720000-0x000000000072A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k6891003.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k6891003.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k6891003.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k6891003.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k6891003.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 2912 y9910241.exe 856 k6891003.exe 1876 l4065202.exe 3604 danke.exe 1656 n1859856.exe 4884 danke.exe 2832 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 200 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k6891003.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y9910241.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y9910241.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 776 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 856 k6891003.exe 856 k6891003.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 856 k6891003.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1876 l4065202.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2912 1676 a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe 70 PID 1676 wrote to memory of 2912 1676 a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe 70 PID 1676 wrote to memory of 2912 1676 a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe 70 PID 2912 wrote to memory of 856 2912 y9910241.exe 71 PID 2912 wrote to memory of 856 2912 y9910241.exe 71 PID 2912 wrote to memory of 1876 2912 y9910241.exe 72 PID 2912 wrote to memory of 1876 2912 y9910241.exe 72 PID 2912 wrote to memory of 1876 2912 y9910241.exe 72 PID 1876 wrote to memory of 3604 1876 l4065202.exe 73 PID 1876 wrote to memory of 3604 1876 l4065202.exe 73 PID 1876 wrote to memory of 3604 1876 l4065202.exe 73 PID 1676 wrote to memory of 1656 1676 a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe 74 PID 1676 wrote to memory of 1656 1676 a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe 74 PID 1676 wrote to memory of 1656 1676 a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe 74 PID 3604 wrote to memory of 776 3604 danke.exe 75 PID 3604 wrote to memory of 776 3604 danke.exe 75 PID 3604 wrote to memory of 776 3604 danke.exe 75 PID 3604 wrote to memory of 2544 3604 danke.exe 77 PID 3604 wrote to memory of 2544 3604 danke.exe 77 PID 3604 wrote to memory of 2544 3604 danke.exe 77 PID 2544 wrote to memory of 4316 2544 cmd.exe 79 PID 2544 wrote to memory of 4316 2544 cmd.exe 79 PID 2544 wrote to memory of 4316 2544 cmd.exe 79 PID 2544 wrote to memory of 3736 2544 cmd.exe 80 PID 2544 wrote to memory of 3736 2544 cmd.exe 80 PID 2544 wrote to memory of 3736 2544 cmd.exe 80 PID 2544 wrote to memory of 508 2544 cmd.exe 81 PID 2544 wrote to memory of 508 2544 cmd.exe 81 PID 2544 wrote to memory of 508 2544 cmd.exe 81 PID 2544 wrote to memory of 4352 2544 cmd.exe 82 PID 2544 wrote to memory of 4352 2544 cmd.exe 82 PID 2544 wrote to memory of 4352 2544 cmd.exe 82 PID 2544 wrote to memory of 3284 2544 cmd.exe 83 PID 2544 wrote to memory of 3284 2544 cmd.exe 83 PID 2544 wrote to memory of 3284 2544 cmd.exe 83 PID 2544 wrote to memory of 4076 2544 cmd.exe 84 PID 2544 wrote to memory of 4076 2544 cmd.exe 84 PID 2544 wrote to memory of 4076 2544 cmd.exe 84 PID 3604 wrote to memory of 200 3604 danke.exe 86 PID 3604 wrote to memory of 200 3604 danke.exe 86 PID 3604 wrote to memory of 200 3604 danke.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe"C:\Users\Admin\AppData\Local\Temp\a9f68a18f358b3338e1112c300f14b0c677f28fcdcdc7662ada453f8698111b8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9910241.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9910241.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6891003.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6891003.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4065202.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4065202.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:776
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4316
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:3736
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:508
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4352
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3284
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:4076
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:200
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1859856.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1859856.exe2⤵
- Executes dropped EXE
PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4884
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2832
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD5df7999066dba8606e2d804718e0ee522
SHA173e9fb5cceb42fb0827fdd7208e9a367baba9a30
SHA2565a4663a90bd3afe0f02040d379d4974cab0fbaa54796e5b16462b36e0a6bb289
SHA512666efce9c3e597141b4d895b559e03e59a2cd0c5e130680f873427398cc8f9a16a399d52634d485bb358445c14acd276406de21f77a49f5c3c89044db40d6af2
-
Filesize
174KB
MD5df7999066dba8606e2d804718e0ee522
SHA173e9fb5cceb42fb0827fdd7208e9a367baba9a30
SHA2565a4663a90bd3afe0f02040d379d4974cab0fbaa54796e5b16462b36e0a6bb289
SHA512666efce9c3e597141b4d895b559e03e59a2cd0c5e130680f873427398cc8f9a16a399d52634d485bb358445c14acd276406de21f77a49f5c3c89044db40d6af2
-
Filesize
235KB
MD56ffa418f8561aa41821cc138c99a5068
SHA164ee2485093fdaa14d5c66719be217f4dcc5dc86
SHA2566913b6f2a5661b790e1f8c33d07a855297f3a0f3ca0fa1b877d162441f41e751
SHA51247e8e20defd480c995b9d124eb63487e9dae5968b187c333691e9634808cc2199fb2da1b39574b2e06b10a0959cbd9a696ce240013f38809c717548e1f60719a
-
Filesize
235KB
MD56ffa418f8561aa41821cc138c99a5068
SHA164ee2485093fdaa14d5c66719be217f4dcc5dc86
SHA2566913b6f2a5661b790e1f8c33d07a855297f3a0f3ca0fa1b877d162441f41e751
SHA51247e8e20defd480c995b9d124eb63487e9dae5968b187c333691e9634808cc2199fb2da1b39574b2e06b10a0959cbd9a696ce240013f38809c717548e1f60719a
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9