Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe
Resource
win10v2004-20230703-en
General
-
Target
fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe
-
Size
390KB
-
MD5
f36caff4d52d9564110e60a8028088b3
-
SHA1
84551cc2177b8592c4d9a324c395d5960c07c0d7
-
SHA256
fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e
-
SHA512
4d0cb9bd59cb255d2d0f32bfc36d9735d16610aac56cc40834b5b68c3a5587faccd187adbc047be7ad18a865f1ec9484bb477dc55639b1139580afc4db56b09b
-
SSDEEP
6144:KMy+bnr+1p0yN90QEXxW5cykfzJ8b9UKBfnOymKVEJOrkmxXCEj+xG:8Mr5y90W54F8b2YWyFhomxLqxG
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
zahar
77.91.68.56:19071
-
auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00070000000231f0-158.dat healer behavioral1/files/0x00070000000231f0-159.dat healer behavioral1/memory/3756-160-0x0000000000830000-0x000000000083A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h6926477.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h6926477.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h6926477.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h6926477.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h6926477.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h6926477.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation danke.exe Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation g3446756.exe -
Executes dropped EXE 7 IoCs
pid Process 2076 x9467695.exe 3292 g3446756.exe 3644 danke.exe 3756 h6926477.exe 2592 j9168116.exe 4140 danke.exe 4464 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 1464 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h6926477.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9467695.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x9467695.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3432 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1684 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3756 h6926477.exe 3756 h6926477.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3756 h6926477.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3292 g3446756.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4844 wrote to memory of 2076 4844 fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe 86 PID 4844 wrote to memory of 2076 4844 fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe 86 PID 4844 wrote to memory of 2076 4844 fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe 86 PID 2076 wrote to memory of 3292 2076 x9467695.exe 87 PID 2076 wrote to memory of 3292 2076 x9467695.exe 87 PID 2076 wrote to memory of 3292 2076 x9467695.exe 87 PID 3292 wrote to memory of 3644 3292 g3446756.exe 88 PID 3292 wrote to memory of 3644 3292 g3446756.exe 88 PID 3292 wrote to memory of 3644 3292 g3446756.exe 88 PID 2076 wrote to memory of 3756 2076 x9467695.exe 89 PID 2076 wrote to memory of 3756 2076 x9467695.exe 89 PID 3644 wrote to memory of 1684 3644 danke.exe 90 PID 3644 wrote to memory of 1684 3644 danke.exe 90 PID 3644 wrote to memory of 1684 3644 danke.exe 90 PID 3644 wrote to memory of 1100 3644 danke.exe 92 PID 3644 wrote to memory of 1100 3644 danke.exe 92 PID 3644 wrote to memory of 1100 3644 danke.exe 92 PID 1100 wrote to memory of 5024 1100 cmd.exe 94 PID 1100 wrote to memory of 5024 1100 cmd.exe 94 PID 1100 wrote to memory of 5024 1100 cmd.exe 94 PID 1100 wrote to memory of 3096 1100 cmd.exe 95 PID 1100 wrote to memory of 3096 1100 cmd.exe 95 PID 1100 wrote to memory of 3096 1100 cmd.exe 95 PID 1100 wrote to memory of 3192 1100 cmd.exe 96 PID 1100 wrote to memory of 3192 1100 cmd.exe 96 PID 1100 wrote to memory of 3192 1100 cmd.exe 96 PID 1100 wrote to memory of 4948 1100 cmd.exe 98 PID 1100 wrote to memory of 4948 1100 cmd.exe 98 PID 1100 wrote to memory of 4948 1100 cmd.exe 98 PID 1100 wrote to memory of 628 1100 cmd.exe 97 PID 1100 wrote to memory of 628 1100 cmd.exe 97 PID 1100 wrote to memory of 628 1100 cmd.exe 97 PID 1100 wrote to memory of 1348 1100 cmd.exe 99 PID 1100 wrote to memory of 1348 1100 cmd.exe 99 PID 1100 wrote to memory of 1348 1100 cmd.exe 99 PID 4844 wrote to memory of 2592 4844 fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe 104 PID 4844 wrote to memory of 2592 4844 fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe 104 PID 4844 wrote to memory of 2592 4844 fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe 104 PID 3644 wrote to memory of 1464 3644 danke.exe 115 PID 3644 wrote to memory of 1464 3644 danke.exe 115 PID 3644 wrote to memory of 1464 3644 danke.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe"C:\Users\Admin\AppData\Local\Temp\fa52e31822ff1b0bcf965f41e01490f93745d1a82ccfc6538f14a46a71ef844e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9467695.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9467695.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3446756.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3446756.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1684
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:5024
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:3096
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:3192
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4948
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:1348
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1464
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6926477.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6926477.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9168116.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9168116.exe2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4464
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD5ead02d29bc17a357c5db0972b14cc97a
SHA1bfb13555caa95c6264a56ae62d43e9e2bba352f9
SHA256b2048fe1a53289d41cbdc22ef2e6526e6ee3ad4f93af036d25c63a577082835c
SHA512f6d4799af363a31622e29f81e4111f7d515dc09ea9e3582618f7e4e53ecf6735963f37f91a0529c6392db1109948a352eb88bbdf1c81a90f73d44a5e29d9901a
-
Filesize
174KB
MD5ead02d29bc17a357c5db0972b14cc97a
SHA1bfb13555caa95c6264a56ae62d43e9e2bba352f9
SHA256b2048fe1a53289d41cbdc22ef2e6526e6ee3ad4f93af036d25c63a577082835c
SHA512f6d4799af363a31622e29f81e4111f7d515dc09ea9e3582618f7e4e53ecf6735963f37f91a0529c6392db1109948a352eb88bbdf1c81a90f73d44a5e29d9901a
-
Filesize
234KB
MD5075b5451235639fc1ec4409784b67663
SHA174f53be63c0a672449d42f2f3dd9ed29375a4ab0
SHA256de3d032ab6c1d03eadfeeac43ca69c91b60a7df03d4cc28d020d536b19a458a9
SHA5120e576771fadea7527a4e8126d2a6db717686ea8e3751bf971a958a3df9a1126fd1cf92892d183dff3974a23e0cba4df845f6cd698fcc93eb2b8870dd66d7250c
-
Filesize
234KB
MD5075b5451235639fc1ec4409784b67663
SHA174f53be63c0a672449d42f2f3dd9ed29375a4ab0
SHA256de3d032ab6c1d03eadfeeac43ca69c91b60a7df03d4cc28d020d536b19a458a9
SHA5120e576771fadea7527a4e8126d2a6db717686ea8e3751bf971a958a3df9a1126fd1cf92892d183dff3974a23e0cba4df845f6cd698fcc93eb2b8870dd66d7250c
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59