Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe
Resource
win10v2004-20230703-en
General
-
Target
0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe
-
Size
390KB
-
MD5
57056d25d965488be02ed6a4efc3ac30
-
SHA1
f335f22a26a34391a596f12340fbe51cebc23f1e
-
SHA256
0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285
-
SHA512
12475f6218a0e0ad5a90e6663c86756e5aa98935ce8de022ca1f5688fe2580302975f5d3b08e32bbf1cd20d748fee88e9998b35eb0f6e5d4bad11a6673dd175f
-
SSDEEP
12288:6Mr8y90BBcmlfbq4z1QjUgZ68xdrkwcHnl9oRNJ:yy+BcmoESj50tH05
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000002320f-145.dat healer behavioral1/files/0x000700000002320f-146.dat healer behavioral1/memory/1908-147-0x0000000000EC0000-0x0000000000ECA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k9360867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k9360867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k9360867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k9360867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k9360867.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k9360867.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation l5594813.exe Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 4620 y5282967.exe 1908 k9360867.exe 3956 l5594813.exe 1316 danke.exe 4780 n7460521.exe 3400 danke.exe 1492 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 1428 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k9360867.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y5282967.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y5282967.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4684 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1468 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1908 k9360867.exe 1908 k9360867.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1908 k9360867.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3956 l5594813.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4136 wrote to memory of 4620 4136 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe 85 PID 4136 wrote to memory of 4620 4136 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe 85 PID 4136 wrote to memory of 4620 4136 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe 85 PID 4620 wrote to memory of 1908 4620 y5282967.exe 86 PID 4620 wrote to memory of 1908 4620 y5282967.exe 86 PID 4620 wrote to memory of 3956 4620 y5282967.exe 92 PID 4620 wrote to memory of 3956 4620 y5282967.exe 92 PID 4620 wrote to memory of 3956 4620 y5282967.exe 92 PID 3956 wrote to memory of 1316 3956 l5594813.exe 93 PID 3956 wrote to memory of 1316 3956 l5594813.exe 93 PID 3956 wrote to memory of 1316 3956 l5594813.exe 93 PID 4136 wrote to memory of 4780 4136 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe 94 PID 4136 wrote to memory of 4780 4136 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe 94 PID 4136 wrote to memory of 4780 4136 0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe 94 PID 1316 wrote to memory of 1468 1316 danke.exe 95 PID 1316 wrote to memory of 1468 1316 danke.exe 95 PID 1316 wrote to memory of 1468 1316 danke.exe 95 PID 1316 wrote to memory of 3408 1316 danke.exe 97 PID 1316 wrote to memory of 3408 1316 danke.exe 97 PID 1316 wrote to memory of 3408 1316 danke.exe 97 PID 3408 wrote to memory of 3532 3408 cmd.exe 100 PID 3408 wrote to memory of 3532 3408 cmd.exe 100 PID 3408 wrote to memory of 3532 3408 cmd.exe 100 PID 3408 wrote to memory of 4080 3408 cmd.exe 99 PID 3408 wrote to memory of 4080 3408 cmd.exe 99 PID 3408 wrote to memory of 4080 3408 cmd.exe 99 PID 3408 wrote to memory of 2636 3408 cmd.exe 101 PID 3408 wrote to memory of 2636 3408 cmd.exe 101 PID 3408 wrote to memory of 2636 3408 cmd.exe 101 PID 3408 wrote to memory of 5088 3408 cmd.exe 102 PID 3408 wrote to memory of 5088 3408 cmd.exe 102 PID 3408 wrote to memory of 5088 3408 cmd.exe 102 PID 3408 wrote to memory of 4832 3408 cmd.exe 103 PID 3408 wrote to memory of 4832 3408 cmd.exe 103 PID 3408 wrote to memory of 4832 3408 cmd.exe 103 PID 3408 wrote to memory of 3520 3408 cmd.exe 104 PID 3408 wrote to memory of 3520 3408 cmd.exe 104 PID 3408 wrote to memory of 3520 3408 cmd.exe 104 PID 1316 wrote to memory of 1428 1316 danke.exe 112 PID 1316 wrote to memory of 1428 1316 danke.exe 112 PID 1316 wrote to memory of 1428 1316 danke.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe"C:\Users\Admin\AppData\Local\Temp\0b1f8b8a80108e2426e367ff13c6f2024492e51fc26f0fb66fcd1c1ead02f285.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5282967.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5282967.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9360867.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9360867.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5594813.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5594813.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1468
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:4080
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3532
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:2636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:5088
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:4832
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:3520
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1428
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7460521.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7460521.exe2⤵
- Executes dropped EXE
PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3400
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1492
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:4684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
175KB
MD54a50360a9361eee9ed8815afb421ed03
SHA11b554f17b99921261ecceb0744319dadf10cb4a3
SHA2565b2bf4d078abc595751fb1de957c5c1724e4dcdaa6fcdea433d15c709ba60a32
SHA512ce24308d733be22c3dcb1dd3a5ce9c197a9c41075adbc63d042a8aa7e2b6f768442c8f5e9de0e54c80c853393a833a47bbed13f327bfb1e1e50d21e5441f2764
-
Filesize
175KB
MD54a50360a9361eee9ed8815afb421ed03
SHA11b554f17b99921261ecceb0744319dadf10cb4a3
SHA2565b2bf4d078abc595751fb1de957c5c1724e4dcdaa6fcdea433d15c709ba60a32
SHA512ce24308d733be22c3dcb1dd3a5ce9c197a9c41075adbc63d042a8aa7e2b6f768442c8f5e9de0e54c80c853393a833a47bbed13f327bfb1e1e50d21e5441f2764
-
Filesize
235KB
MD5696e626517003517fb27cd3952d733f6
SHA1554f4655eed025b36743785416ffa5746448c9cc
SHA2566c99161784795fcd81c55cceb49c3eef6bbe9a73e0cb29821d66204a6d7ef930
SHA5126a217e50ad1f7456b0b9eab2420e8600c47ff7fbca8ac52f45aee62ee8a113c741ae2f01a765f78b393a620ab4290d545b56eaf52342c14c80e4bfd553b7a99d
-
Filesize
235KB
MD5696e626517003517fb27cd3952d733f6
SHA1554f4655eed025b36743785416ffa5746448c9cc
SHA2566c99161784795fcd81c55cceb49c3eef6bbe9a73e0cb29821d66204a6d7ef930
SHA5126a217e50ad1f7456b0b9eab2420e8600c47ff7fbca8ac52f45aee62ee8a113c741ae2f01a765f78b393a620ab4290d545b56eaf52342c14c80e4bfd553b7a99d
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59