Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
19/07/2023, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe
Resource
win10-20230703-en
General
-
Target
b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe
-
Size
390KB
-
MD5
737ec26180bc283aba28b78c2666f574
-
SHA1
4206d28dc47498c37ca35e17731155d66acb5add
-
SHA256
b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5
-
SHA512
4798ed5797d27c4b06190969c1f1f18580668679d8dd2c34ee99d1794f168d6695d73f4ca755045b51916aef803b12bad999f5e37125e694625ad926db192e1f
-
SSDEEP
12288:2Mrmy90qc8gh7R44+b3Qo+XggcHnl9R73e0Y0:kyrc/7OBAXgfHx3eS
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b02b-134.dat healer behavioral1/files/0x000700000001b02b-135.dat healer behavioral1/memory/3584-136-0x0000000000760000-0x000000000076A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k8847691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k8847691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k8847691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k8847691.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k8847691.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
pid Process 4512 y2325469.exe 3584 k8847691.exe 4652 l9225120.exe 4488 danke.exe 4396 n9582554.exe 532 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 4316 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k8847691.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y2325469.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y2325469.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3584 k8847691.exe 3584 k8847691.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3584 k8847691.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4652 l9225120.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 192 wrote to memory of 4512 192 b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe 70 PID 192 wrote to memory of 4512 192 b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe 70 PID 192 wrote to memory of 4512 192 b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe 70 PID 4512 wrote to memory of 3584 4512 y2325469.exe 71 PID 4512 wrote to memory of 3584 4512 y2325469.exe 71 PID 4512 wrote to memory of 4652 4512 y2325469.exe 72 PID 4512 wrote to memory of 4652 4512 y2325469.exe 72 PID 4512 wrote to memory of 4652 4512 y2325469.exe 72 PID 4652 wrote to memory of 4488 4652 l9225120.exe 73 PID 4652 wrote to memory of 4488 4652 l9225120.exe 73 PID 4652 wrote to memory of 4488 4652 l9225120.exe 73 PID 192 wrote to memory of 4396 192 b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe 74 PID 192 wrote to memory of 4396 192 b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe 74 PID 192 wrote to memory of 4396 192 b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe 74 PID 4488 wrote to memory of 1296 4488 danke.exe 75 PID 4488 wrote to memory of 1296 4488 danke.exe 75 PID 4488 wrote to memory of 1296 4488 danke.exe 75 PID 4488 wrote to memory of 2328 4488 danke.exe 76 PID 4488 wrote to memory of 2328 4488 danke.exe 76 PID 4488 wrote to memory of 2328 4488 danke.exe 76 PID 2328 wrote to memory of 4296 2328 cmd.exe 79 PID 2328 wrote to memory of 4296 2328 cmd.exe 79 PID 2328 wrote to memory of 4296 2328 cmd.exe 79 PID 2328 wrote to memory of 1096 2328 cmd.exe 80 PID 2328 wrote to memory of 1096 2328 cmd.exe 80 PID 2328 wrote to memory of 1096 2328 cmd.exe 80 PID 2328 wrote to memory of 3932 2328 cmd.exe 81 PID 2328 wrote to memory of 3932 2328 cmd.exe 81 PID 2328 wrote to memory of 3932 2328 cmd.exe 81 PID 2328 wrote to memory of 3776 2328 cmd.exe 82 PID 2328 wrote to memory of 3776 2328 cmd.exe 82 PID 2328 wrote to memory of 3776 2328 cmd.exe 82 PID 2328 wrote to memory of 976 2328 cmd.exe 83 PID 2328 wrote to memory of 976 2328 cmd.exe 83 PID 2328 wrote to memory of 976 2328 cmd.exe 83 PID 2328 wrote to memory of 2144 2328 cmd.exe 84 PID 2328 wrote to memory of 2144 2328 cmd.exe 84 PID 2328 wrote to memory of 2144 2328 cmd.exe 84 PID 4488 wrote to memory of 4316 4488 danke.exe 86 PID 4488 wrote to memory of 4316 4488 danke.exe 86 PID 4488 wrote to memory of 4316 4488 danke.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe"C:\Users\Admin\AppData\Local\Temp\b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2325469.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2325469.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8847691.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8847691.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9225120.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9225120.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1296
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4296
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:1096
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:3932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3776
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:976
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:2144
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4316
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9582554.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9582554.exe2⤵
- Executes dropped EXE
PID:4396
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:532
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
175KB
MD558c77414d982326cda5334518a83bdef
SHA17ae81445a8a84c100d5af7cadaaa04c7820bdd85
SHA25687826d88977a5e28fb45580c915cb8f0431708f896f755ae35e2ddefacf47ae9
SHA5122bc79603108edcfcd9540b41ff28daeca1e29653d174760291cf5d0074ffe4ecef236f1ea3edd16addfd150b817663ead5900d2cb07a08dbd24d36b3b4bc3ce4
-
Filesize
175KB
MD558c77414d982326cda5334518a83bdef
SHA17ae81445a8a84c100d5af7cadaaa04c7820bdd85
SHA25687826d88977a5e28fb45580c915cb8f0431708f896f755ae35e2ddefacf47ae9
SHA5122bc79603108edcfcd9540b41ff28daeca1e29653d174760291cf5d0074ffe4ecef236f1ea3edd16addfd150b817663ead5900d2cb07a08dbd24d36b3b4bc3ce4
-
Filesize
235KB
MD5bff2a59625e5c995d555bd2034b4da3e
SHA15eb1e223b12c98947c97dab6df68a14256eb3db9
SHA256358e2c6f0a0dc7031d6679863508db353343d22f71aa8cb40e13d32a135f58bb
SHA5126ec810deba0629a526250a495ca1182f1254c6aa02839e29eae9eb96637b74da0dbed3534c70bf0edee64a387384986ee6683fdc71812d37b55c01d1a8f5859b
-
Filesize
235KB
MD5bff2a59625e5c995d555bd2034b4da3e
SHA15eb1e223b12c98947c97dab6df68a14256eb3db9
SHA256358e2c6f0a0dc7031d6679863508db353343d22f71aa8cb40e13d32a135f58bb
SHA5126ec810deba0629a526250a495ca1182f1254c6aa02839e29eae9eb96637b74da0dbed3534c70bf0edee64a387384986ee6683fdc71812d37b55c01d1a8f5859b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9