Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe
Resource
win10v2004-20230703-en
General
-
Target
716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe
-
Size
390KB
-
MD5
ce4a66c426e381a1cfac0eccf34f665a
-
SHA1
d15e190c32ae490e3182c1124b43560ffde77cf0
-
SHA256
716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943
-
SHA512
c814f3c9f5a6c56568a723338ee102695afafb254b111757899be590a730632ad82613e11c08d035d6e70af574b89ec639a3878912e47b63aced2fbc23212936
-
SSDEEP
12288:8MrPy906vQ5bOAqppOhyXL48cHnl9/HkS:bypY5zqppONHYS
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x0007000000023202-145.dat healer behavioral1/files/0x0007000000023202-146.dat healer behavioral1/memory/4520-147-0x0000000000330000-0x000000000033A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k6634662.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k6634662.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k6634662.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k6634662.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k6634662.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k6634662.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation l7292453.exe Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 2844 y8812067.exe 4520 k6634662.exe 4912 l7292453.exe 896 danke.exe 2848 n8585500.exe 8 danke.exe 4672 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 652 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k6634662.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y8812067.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8812067.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1620 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4520 k6634662.exe 4520 k6634662.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4520 k6634662.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4912 l7292453.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 556 wrote to memory of 2844 556 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe 86 PID 556 wrote to memory of 2844 556 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe 86 PID 556 wrote to memory of 2844 556 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe 86 PID 2844 wrote to memory of 4520 2844 y8812067.exe 87 PID 2844 wrote to memory of 4520 2844 y8812067.exe 87 PID 2844 wrote to memory of 4912 2844 y8812067.exe 96 PID 2844 wrote to memory of 4912 2844 y8812067.exe 96 PID 2844 wrote to memory of 4912 2844 y8812067.exe 96 PID 4912 wrote to memory of 896 4912 l7292453.exe 97 PID 4912 wrote to memory of 896 4912 l7292453.exe 97 PID 4912 wrote to memory of 896 4912 l7292453.exe 97 PID 556 wrote to memory of 2848 556 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe 98 PID 556 wrote to memory of 2848 556 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe 98 PID 556 wrote to memory of 2848 556 716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe 98 PID 896 wrote to memory of 1620 896 danke.exe 99 PID 896 wrote to memory of 1620 896 danke.exe 99 PID 896 wrote to memory of 1620 896 danke.exe 99 PID 896 wrote to memory of 4532 896 danke.exe 101 PID 896 wrote to memory of 4532 896 danke.exe 101 PID 896 wrote to memory of 4532 896 danke.exe 101 PID 4532 wrote to memory of 4072 4532 cmd.exe 103 PID 4532 wrote to memory of 4072 4532 cmd.exe 103 PID 4532 wrote to memory of 4072 4532 cmd.exe 103 PID 4532 wrote to memory of 4336 4532 cmd.exe 104 PID 4532 wrote to memory of 4336 4532 cmd.exe 104 PID 4532 wrote to memory of 4336 4532 cmd.exe 104 PID 4532 wrote to memory of 1708 4532 cmd.exe 105 PID 4532 wrote to memory of 1708 4532 cmd.exe 105 PID 4532 wrote to memory of 1708 4532 cmd.exe 105 PID 4532 wrote to memory of 4224 4532 cmd.exe 106 PID 4532 wrote to memory of 4224 4532 cmd.exe 106 PID 4532 wrote to memory of 4224 4532 cmd.exe 106 PID 4532 wrote to memory of 1992 4532 cmd.exe 107 PID 4532 wrote to memory of 1992 4532 cmd.exe 107 PID 4532 wrote to memory of 1992 4532 cmd.exe 107 PID 4532 wrote to memory of 668 4532 cmd.exe 108 PID 4532 wrote to memory of 668 4532 cmd.exe 108 PID 4532 wrote to memory of 668 4532 cmd.exe 108 PID 896 wrote to memory of 652 896 danke.exe 116 PID 896 wrote to memory of 652 896 danke.exe 116 PID 896 wrote to memory of 652 896 danke.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe"C:\Users\Admin\AppData\Local\Temp\716020e4f020112592364d018f7b4dcc3a077aa74caa5a47248bd8bed748f943.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8812067.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8812067.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6634662.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6634662.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7292453.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7292453.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1620
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4072
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:4336
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4224
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:1992
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:668
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:652
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n8585500.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n8585500.exe2⤵
- Executes dropped EXE
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:8
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
172KB
MD54f6b8e0a6644e5eb49027b71cdda63f1
SHA127551c81894c0f5cd950a03a058f101a2ea0ae6a
SHA2569c33876b824333d9d3fbaf13ae3f9c8518ad1a3856ca4a3cbab35edc61947951
SHA51251bc31d0a696677158e7fcc6e64f8e67bfa1a0a7a86d5de6d0cb1fae0dab814035fb1f3395f50892cd91065ed786a973556b1f467aa1b8bbbdbdda19204ec04a
-
Filesize
172KB
MD54f6b8e0a6644e5eb49027b71cdda63f1
SHA127551c81894c0f5cd950a03a058f101a2ea0ae6a
SHA2569c33876b824333d9d3fbaf13ae3f9c8518ad1a3856ca4a3cbab35edc61947951
SHA51251bc31d0a696677158e7fcc6e64f8e67bfa1a0a7a86d5de6d0cb1fae0dab814035fb1f3395f50892cd91065ed786a973556b1f467aa1b8bbbdbdda19204ec04a
-
Filesize
235KB
MD5602da0071efa3a1163829b0784ebcffd
SHA145bdb135b3650f6411bafde24cc94029ad7a6b0e
SHA256b2bf2be1c347071ec7173998e3f7fd161552412ec18d2d0e88fddbdd31ffd643
SHA512039b63a6b3a16bd0982b161e47d32137d0f53ec7bff066a8d67141e7ad841f0d483b9183d43e8ca0b62417cc3e981d6ee068cb5d39ab0cbd6b3e366f76277ae5
-
Filesize
235KB
MD5602da0071efa3a1163829b0784ebcffd
SHA145bdb135b3650f6411bafde24cc94029ad7a6b0e
SHA256b2bf2be1c347071ec7173998e3f7fd161552412ec18d2d0e88fddbdd31ffd643
SHA512039b63a6b3a16bd0982b161e47d32137d0f53ec7bff066a8d67141e7ad841f0d483b9183d43e8ca0b62417cc3e981d6ee068cb5d39ab0cbd6b3e366f76277ae5
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59