Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe
Resource
win10v2004-20230703-en
General
-
Target
aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe
-
Size
389KB
-
MD5
33c6d438bada8e9650e22ba53e1033cb
-
SHA1
2b325c12ed9fb1bb71734d95da26a5eb2c66e0c2
-
SHA256
aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc
-
SHA512
b3a63d1b9895d886c90b5219be69403af56b6cb89c5dec4019aae2967c2c8e4013afd50d6f4a62a55948525d413f364e675b91b757a0257ef7e7f40934248f8e
-
SSDEEP
6144:Kxy+bnr+9p0yN90QEY1sH3wzuF/JHcPguG7TH7xgcK04bpbjtvRpaSawR1o:bMrpy907XaRWqv04bpvbpPawXo
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00060000000231d9-159.dat healer behavioral1/files/0x00060000000231d9-158.dat healer behavioral1/memory/2732-160-0x0000000000150000-0x000000000015A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h1341419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h1341419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h1341419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h1341419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h1341419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h1341419.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation g5839758.exe Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 8 IoCs
pid Process 2084 x9987111.exe 3888 g5839758.exe 4328 danke.exe 2732 h1341419.exe 2504 danke.exe 1196 j2206043.exe 1612 danke.exe 4860 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 3784 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h1341419.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x9987111.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9987111.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1824 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3616 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2732 h1341419.exe 2732 h1341419.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2732 h1341419.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3888 g5839758.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4492 wrote to memory of 2084 4492 aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe 86 PID 4492 wrote to memory of 2084 4492 aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe 86 PID 4492 wrote to memory of 2084 4492 aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe 86 PID 2084 wrote to memory of 3888 2084 x9987111.exe 87 PID 2084 wrote to memory of 3888 2084 x9987111.exe 87 PID 2084 wrote to memory of 3888 2084 x9987111.exe 87 PID 3888 wrote to memory of 4328 3888 g5839758.exe 88 PID 3888 wrote to memory of 4328 3888 g5839758.exe 88 PID 3888 wrote to memory of 4328 3888 g5839758.exe 88 PID 2084 wrote to memory of 2732 2084 x9987111.exe 89 PID 2084 wrote to memory of 2732 2084 x9987111.exe 89 PID 4328 wrote to memory of 3616 4328 danke.exe 90 PID 4328 wrote to memory of 3616 4328 danke.exe 90 PID 4328 wrote to memory of 3616 4328 danke.exe 90 PID 4328 wrote to memory of 1404 4328 danke.exe 92 PID 4328 wrote to memory of 1404 4328 danke.exe 92 PID 4328 wrote to memory of 1404 4328 danke.exe 92 PID 1404 wrote to memory of 4864 1404 cmd.exe 94 PID 1404 wrote to memory of 4864 1404 cmd.exe 94 PID 1404 wrote to memory of 4864 1404 cmd.exe 94 PID 1404 wrote to memory of 2888 1404 cmd.exe 95 PID 1404 wrote to memory of 2888 1404 cmd.exe 95 PID 1404 wrote to memory of 2888 1404 cmd.exe 95 PID 1404 wrote to memory of 3864 1404 cmd.exe 96 PID 1404 wrote to memory of 3864 1404 cmd.exe 96 PID 1404 wrote to memory of 3864 1404 cmd.exe 96 PID 1404 wrote to memory of 4892 1404 cmd.exe 97 PID 1404 wrote to memory of 4892 1404 cmd.exe 97 PID 1404 wrote to memory of 4892 1404 cmd.exe 97 PID 1404 wrote to memory of 3748 1404 cmd.exe 98 PID 1404 wrote to memory of 3748 1404 cmd.exe 98 PID 1404 wrote to memory of 3748 1404 cmd.exe 98 PID 1404 wrote to memory of 2444 1404 cmd.exe 99 PID 1404 wrote to memory of 2444 1404 cmd.exe 99 PID 1404 wrote to memory of 2444 1404 cmd.exe 99 PID 4492 wrote to memory of 1196 4492 aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe 107 PID 4492 wrote to memory of 1196 4492 aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe 107 PID 4492 wrote to memory of 1196 4492 aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe 107 PID 4328 wrote to memory of 3784 4328 danke.exe 114 PID 4328 wrote to memory of 3784 4328 danke.exe 114 PID 4328 wrote to memory of 3784 4328 danke.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe"C:\Users\Admin\AppData\Local\Temp\aeb89054482b96169173a47ba0adec05e2cddc8c7f5564f6b76c3752080301cc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9987111.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9987111.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5839758.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5839758.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:3616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4864
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:2888
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:3864
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4892
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3748
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:2444
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3784
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1341419.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1341419.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2206043.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2206043.exe2⤵
- Executes dropped EXE
PID:1196
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4860
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:1824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
175KB
MD508a5ea5eb3265d6b1b5d48703af3c7d8
SHA1e5e95550a7f95da10e65baab6add303e4bcf6e3c
SHA256f75dbf93d621a4190009e834ccad88a79968fb252b0775377f8c854d5b43c87f
SHA51285d2eeed79354222e66ae74e94c821d4d3bc731525e10fd8820f6c26f022f03a16e00745de8f1d6dcf8d6bc9ba7273a2958dfa6da24e1bbd5dc800e59d60efab
-
Filesize
175KB
MD508a5ea5eb3265d6b1b5d48703af3c7d8
SHA1e5e95550a7f95da10e65baab6add303e4bcf6e3c
SHA256f75dbf93d621a4190009e834ccad88a79968fb252b0775377f8c854d5b43c87f
SHA51285d2eeed79354222e66ae74e94c821d4d3bc731525e10fd8820f6c26f022f03a16e00745de8f1d6dcf8d6bc9ba7273a2958dfa6da24e1bbd5dc800e59d60efab
-
Filesize
234KB
MD5cab6f4a48187d8d926fe52af77e63922
SHA19a94a2df9d53ca59a721a2cf3eb7353e75009d44
SHA25623559c8e0f3a634a1573a6d65dea854002ec3b965bff31738938d6a129a5d9f9
SHA512c07b95765ab47964a1290916db985be42a6640e692a4ae71e11be510c8c3c84fe2b5ed71d700cffb433e2f59d58d574bae8d94b39debe1976c489f2f4dd3e20c
-
Filesize
234KB
MD5cab6f4a48187d8d926fe52af77e63922
SHA19a94a2df9d53ca59a721a2cf3eb7353e75009d44
SHA25623559c8e0f3a634a1573a6d65dea854002ec3b965bff31738938d6a129a5d9f9
SHA512c07b95765ab47964a1290916db985be42a6640e692a4ae71e11be510c8c3c84fe2b5ed71d700cffb433e2f59d58d574bae8d94b39debe1976c489f2f4dd3e20c
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59