Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2023, 03:43

General

  • Target

    v7229391.bin.exe

  • Size

    235KB

  • MD5

    ee5e79d00a13fde9e96a1f9953f35fea

  • SHA1

    788be8b6304f138f5c7bdf00fe98562de6f2790d

  • SHA256

    10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837

  • SHA512

    26b1209bb16d6e5ed3dabe6fc18e6ec425197ecfd26f2038d9d796cff93d25597c774ca01fec5d975457ef7e544b9d7f7d09372e391c1823b4a7e3bcf94d0c49

  • SSDEEP

    6144:KCy+bnr+0p0yN90QEdHyEL9MR1SKgfYLNYs1Ul8C2N:6Mrcy90zgoYLWs6l8V

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\v7229391.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\v7229391.bin.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
        "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3620
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1552
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:5108
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "danke.exe" /P "Admin:N"
              5⤵
                PID:5056
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "danke.exe" /P "Admin:R" /E
                5⤵
                  PID:4720
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3888
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\3ec1f323b5" /P "Admin:N"
                    5⤵
                      PID:5076
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\3ec1f323b5" /P "Admin:R" /E
                      5⤵
                        PID:4592
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:1464
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:2620
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:4708

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe

                Filesize

                13KB

                MD5

                84bab76f53d09527ab0783ba2ece2e2e

                SHA1

                bfdc2db1addb613025d32d8a288fc7b70b8b22ee

                SHA256

                8f1eae62ef850d5a0a78054f853cbbe4c3b547bfc34ee890746405cee8bbfe95

                SHA512

                45f0fa0cf107c116e6bd6e8145cfa5580cc007c3755e5b290f5aede15e195c83e296b90d4a6bbbbd619dfdb98168569c2efe8f2e4c9c5a7083a849ed65c670c9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe

                Filesize

                13KB

                MD5

                84bab76f53d09527ab0783ba2ece2e2e

                SHA1

                bfdc2db1addb613025d32d8a288fc7b70b8b22ee

                SHA256

                8f1eae62ef850d5a0a78054f853cbbe4c3b547bfc34ee890746405cee8bbfe95

                SHA512

                45f0fa0cf107c116e6bd6e8145cfa5580cc007c3755e5b290f5aede15e195c83e296b90d4a6bbbbd619dfdb98168569c2efe8f2e4c9c5a7083a849ed65c670c9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe

                Filesize

                226KB

                MD5

                144f0c96d774f813d87132e84b2a46ed

                SHA1

                ce04450c00f605252c5c7df6960c0a3ed0705ef1

                SHA256

                2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e

                SHA512

                7d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                272B

                MD5

                d867eabb1be5b45bc77bb06814e23640

                SHA1

                3139a51ce7e8462c31070363b9532c13cc52c82d

                SHA256

                38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349

                SHA512

                afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59

              • memory/2596-144-0x00007FFC850F0000-0x00007FFC85BB1000-memory.dmp

                Filesize

                10.8MB

              • memory/2596-142-0x00007FFC850F0000-0x00007FFC85BB1000-memory.dmp

                Filesize

                10.8MB

              • memory/2596-141-0x00007FFC850F0000-0x00007FFC85BB1000-memory.dmp

                Filesize

                10.8MB

              • memory/2596-140-0x0000000000540000-0x000000000054A000-memory.dmp

                Filesize

                40KB