Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe
Resource
win10v2004-20230703-en
General
-
Target
cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe
-
Size
390KB
-
MD5
53fc69ddcc1efcb2cec80d8e185d8327
-
SHA1
fe43d689d761eb89ac5c13946c76119cc66fc606
-
SHA256
cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1
-
SHA512
27d7a332a4443e96cd35a30dcc6d4e90a89d87a512c435db52e4d98dcaad268f9a057a43b3e90ea7a049fcccebc11fe8a8fecd7cc4d4895206876323a7371582
-
SSDEEP
6144:K6y+bnr+qp0yN90QE2RpibeyRRnxXl/pajdILJABC/prbmFZB0fe0Q:mMrqy90wilxVxajdIL2C/pnm3B0fe0Q
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00070000000231d6-159.dat healer behavioral1/files/0x00070000000231d6-158.dat healer behavioral1/memory/3148-160-0x0000000000020000-0x000000000002A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h5812054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h5812054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h5812054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h5812054.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h5812054.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h5812054.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation g6246723.exe Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 8 IoCs
pid Process 4060 x2247472.exe 3672 g6246723.exe 3080 danke.exe 3148 h5812054.exe 1904 danke.exe 4652 j0960097.exe 1016 danke.exe 2020 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 4396 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h5812054.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x2247472.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x2247472.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2752 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3148 h5812054.exe 3148 h5812054.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3148 h5812054.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3672 g6246723.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4076 wrote to memory of 4060 4076 cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe 84 PID 4076 wrote to memory of 4060 4076 cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe 84 PID 4076 wrote to memory of 4060 4076 cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe 84 PID 4060 wrote to memory of 3672 4060 x2247472.exe 85 PID 4060 wrote to memory of 3672 4060 x2247472.exe 85 PID 4060 wrote to memory of 3672 4060 x2247472.exe 85 PID 3672 wrote to memory of 3080 3672 g6246723.exe 87 PID 3672 wrote to memory of 3080 3672 g6246723.exe 87 PID 3672 wrote to memory of 3080 3672 g6246723.exe 87 PID 4060 wrote to memory of 3148 4060 x2247472.exe 88 PID 4060 wrote to memory of 3148 4060 x2247472.exe 88 PID 3080 wrote to memory of 2752 3080 danke.exe 89 PID 3080 wrote to memory of 2752 3080 danke.exe 89 PID 3080 wrote to memory of 2752 3080 danke.exe 89 PID 3080 wrote to memory of 116 3080 danke.exe 91 PID 3080 wrote to memory of 116 3080 danke.exe 91 PID 3080 wrote to memory of 116 3080 danke.exe 91 PID 116 wrote to memory of 4920 116 cmd.exe 94 PID 116 wrote to memory of 4920 116 cmd.exe 94 PID 116 wrote to memory of 4920 116 cmd.exe 94 PID 116 wrote to memory of 3960 116 cmd.exe 95 PID 116 wrote to memory of 3960 116 cmd.exe 95 PID 116 wrote to memory of 3960 116 cmd.exe 95 PID 116 wrote to memory of 1072 116 cmd.exe 96 PID 116 wrote to memory of 1072 116 cmd.exe 96 PID 116 wrote to memory of 1072 116 cmd.exe 96 PID 116 wrote to memory of 3784 116 cmd.exe 97 PID 116 wrote to memory of 3784 116 cmd.exe 97 PID 116 wrote to memory of 3784 116 cmd.exe 97 PID 116 wrote to memory of 3084 116 cmd.exe 98 PID 116 wrote to memory of 3084 116 cmd.exe 98 PID 116 wrote to memory of 3084 116 cmd.exe 98 PID 116 wrote to memory of 1008 116 cmd.exe 99 PID 116 wrote to memory of 1008 116 cmd.exe 99 PID 116 wrote to memory of 1008 116 cmd.exe 99 PID 4076 wrote to memory of 4652 4076 cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe 105 PID 4076 wrote to memory of 4652 4076 cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe 105 PID 4076 wrote to memory of 4652 4076 cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe 105 PID 3080 wrote to memory of 4396 3080 danke.exe 118 PID 3080 wrote to memory of 4396 3080 danke.exe 118 PID 3080 wrote to memory of 4396 3080 danke.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe"C:\Users\Admin\AppData\Local\Temp\cf7f0588d1389a905ae2c9f350f483f8f65424386a0b942440c66f93df6c4fe1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2247472.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2247472.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6246723.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6246723.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:2752
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4920
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:3960
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:1072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3784
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3084
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:1008
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4396
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5812054.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h5812054.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0960097.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0960097.exe2⤵
- Executes dropped EXE
PID:4652
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
175KB
MD5ae2c9b5370220b5b3ad2fb3805e1d8f8
SHA1ee69433ad0d273fbd97726f235e886fb0e9b8ab8
SHA256f4648bd5391515e6794ce88da9fe205d344b6d861a4be8821f90b6c89d3aab02
SHA51276cac760b307e6bebb3002e7b03b4f46bb656334e4b56f8b0a26cc6bbe40051c41d239baa721d44ab8edc2f2136fc49c4b7f5854d48f2feae4786eccf941891e
-
Filesize
175KB
MD5ae2c9b5370220b5b3ad2fb3805e1d8f8
SHA1ee69433ad0d273fbd97726f235e886fb0e9b8ab8
SHA256f4648bd5391515e6794ce88da9fe205d344b6d861a4be8821f90b6c89d3aab02
SHA51276cac760b307e6bebb3002e7b03b4f46bb656334e4b56f8b0a26cc6bbe40051c41d239baa721d44ab8edc2f2136fc49c4b7f5854d48f2feae4786eccf941891e
-
Filesize
234KB
MD57d1f28b5a63775d74dd1584c7e2a84f2
SHA148754f1da5b361e6a4fefbac52270c987146c765
SHA25616ca48abfe545679ea64e48e77c24b2a1f00b4d982b497d5f8ae1427e4594bc4
SHA5124aad4cc3b2a831c07b4412e40da529f8eb6cefb6daf9d9dfe6178707cdb7f9dbe731404696496400c1cae55206015ea2ddc4df458a3a8da82f944c3247369f84
-
Filesize
234KB
MD57d1f28b5a63775d74dd1584c7e2a84f2
SHA148754f1da5b361e6a4fefbac52270c987146c765
SHA25616ca48abfe545679ea64e48e77c24b2a1f00b4d982b497d5f8ae1427e4594bc4
SHA5124aad4cc3b2a831c07b4412e40da529f8eb6cefb6daf9d9dfe6178707cdb7f9dbe731404696496400c1cae55206015ea2ddc4df458a3a8da82f944c3247369f84
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59