Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe
Resource
win10v2004-20230703-en
General
-
Target
7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe
-
Size
390KB
-
MD5
3275ccc9e4b5f183fc5b50acae3ede9c
-
SHA1
979d43eabd5c7f3cb497575f993dbbda829d2a91
-
SHA256
7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98
-
SHA512
f24303816e8bf57951a6d2a5e9c1cc543b695d653a50d41bf2d13a4b3d2c6fe5962b547672699233cdd2cae823c007488dc5f292161a1225a3a8db15d5d26c9b
-
SSDEEP
12288:6Mroy90Yw52xTYmq1qhvjacHnl9mMA/9yj:Oyrc2JYmJHqVK
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
zahar
77.91.68.56:19071
-
auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00080000000231ea-146.dat healer behavioral1/files/0x00080000000231ea-145.dat healer behavioral1/memory/2184-147-0x0000000000740000-0x000000000074A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k1280958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k1280958.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k1280958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k1280958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k1280958.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k1280958.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation l0512764.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 8 IoCs
pid Process 1676 y1081759.exe 2184 k1280958.exe 3176 l0512764.exe 1428 danke.exe 3788 n5260668.exe 3368 danke.exe 4616 danke.exe 748 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 2364 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k1280958.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1081759.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y1081759.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1468 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2184 k1280958.exe 2184 k1280958.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2184 k1280958.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3176 l0512764.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 3216 wrote to memory of 1676 3216 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe 86 PID 3216 wrote to memory of 1676 3216 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe 86 PID 3216 wrote to memory of 1676 3216 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe 86 PID 1676 wrote to memory of 2184 1676 y1081759.exe 87 PID 1676 wrote to memory of 2184 1676 y1081759.exe 87 PID 1676 wrote to memory of 3176 1676 y1081759.exe 99 PID 1676 wrote to memory of 3176 1676 y1081759.exe 99 PID 1676 wrote to memory of 3176 1676 y1081759.exe 99 PID 3176 wrote to memory of 1428 3176 l0512764.exe 100 PID 3176 wrote to memory of 1428 3176 l0512764.exe 100 PID 3176 wrote to memory of 1428 3176 l0512764.exe 100 PID 3216 wrote to memory of 3788 3216 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe 101 PID 3216 wrote to memory of 3788 3216 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe 101 PID 3216 wrote to memory of 3788 3216 7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe 101 PID 1428 wrote to memory of 1468 1428 danke.exe 102 PID 1428 wrote to memory of 1468 1428 danke.exe 102 PID 1428 wrote to memory of 1468 1428 danke.exe 102 PID 1428 wrote to memory of 3256 1428 danke.exe 104 PID 1428 wrote to memory of 3256 1428 danke.exe 104 PID 1428 wrote to memory of 3256 1428 danke.exe 104 PID 3256 wrote to memory of 5080 3256 cmd.exe 106 PID 3256 wrote to memory of 5080 3256 cmd.exe 106 PID 3256 wrote to memory of 5080 3256 cmd.exe 106 PID 3256 wrote to memory of 1200 3256 cmd.exe 107 PID 3256 wrote to memory of 1200 3256 cmd.exe 107 PID 3256 wrote to memory of 1200 3256 cmd.exe 107 PID 3256 wrote to memory of 4112 3256 cmd.exe 108 PID 3256 wrote to memory of 4112 3256 cmd.exe 108 PID 3256 wrote to memory of 4112 3256 cmd.exe 108 PID 3256 wrote to memory of 2732 3256 cmd.exe 110 PID 3256 wrote to memory of 2732 3256 cmd.exe 110 PID 3256 wrote to memory of 2732 3256 cmd.exe 110 PID 3256 wrote to memory of 988 3256 cmd.exe 109 PID 3256 wrote to memory of 988 3256 cmd.exe 109 PID 3256 wrote to memory of 988 3256 cmd.exe 109 PID 3256 wrote to memory of 924 3256 cmd.exe 111 PID 3256 wrote to memory of 924 3256 cmd.exe 111 PID 3256 wrote to memory of 924 3256 cmd.exe 111 PID 1428 wrote to memory of 2364 1428 danke.exe 117 PID 1428 wrote to memory of 2364 1428 danke.exe 117 PID 1428 wrote to memory of 2364 1428 danke.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe"C:\Users\Admin\AppData\Local\Temp\7892e0309645ecf572f91d9ea5f6c71b462972be057b03ebe1d822c52fb3ea98.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1081759.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1081759.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1280958.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1280958.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0512764.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0512764.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1468
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:5080
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:1200
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:4112
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2732
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:924
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2364
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5260668.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5260668.exe2⤵
- Executes dropped EXE
PID:3788
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3368
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4616
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD5fe74cbcfc743655c7d11114d95b3ba85
SHA166d504b849cc03ff5bb2d7ef8ce6cd3624bf8bf4
SHA25673b7fc21e82cb8985b53f58442a6ac7f6e8640877cef292de6f0b0e296c09e5f
SHA512e735f332a617d1dd17d2ed8f0c2a5dd809bfa7782539ac838e5a5c5544ff7d2363fecae26b7b6606105159358343218163f2a58a13ac751345c1435160f0d315
-
Filesize
174KB
MD5fe74cbcfc743655c7d11114d95b3ba85
SHA166d504b849cc03ff5bb2d7ef8ce6cd3624bf8bf4
SHA25673b7fc21e82cb8985b53f58442a6ac7f6e8640877cef292de6f0b0e296c09e5f
SHA512e735f332a617d1dd17d2ed8f0c2a5dd809bfa7782539ac838e5a5c5544ff7d2363fecae26b7b6606105159358343218163f2a58a13ac751345c1435160f0d315
-
Filesize
235KB
MD59d5dd4665d024b461b5bc126df733c21
SHA1316d91d1827c610e307b2bb29459f9bac8ec0b1a
SHA2561c0f4ad38d8fda47b6e3ff581ada2e126f2b29350c5e65a94697cc087e1fc1b3
SHA512acba9efe03ecae764b1b576d1a10c204253e7661453a8b9ca4e7939f0bf1a69b18566805474ceac38a8b5df9bbbaec01069d3d1c573edc215f3c64153a61b4ef
-
Filesize
235KB
MD59d5dd4665d024b461b5bc126df733c21
SHA1316d91d1827c610e307b2bb29459f9bac8ec0b1a
SHA2561c0f4ad38d8fda47b6e3ff581ada2e126f2b29350c5e65a94697cc087e1fc1b3
SHA512acba9efe03ecae764b1b576d1a10c204253e7661453a8b9ca4e7939f0bf1a69b18566805474ceac38a8b5df9bbbaec01069d3d1c573edc215f3c64153a61b4ef
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59