Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
277s -
max time network
236s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/07/2023, 03:40
Behavioral task
behavioral1
Sample
l4807903.exe
Resource
win7-20230712-en
General
-
Target
l4807903.exe
-
Size
224KB
-
MD5
8c6b79ec436d7cf6950a804c1ec7d3e9
-
SHA1
4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
-
SHA256
4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
-
SHA512
06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
SSDEEP
3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 780 danke.exe 840 danke.exe 3028 danke.exe 1824 danke.exe 2036 danke.exe 1084 danke.exe -
Loads dropped DLL 5 IoCs
pid Process 2532 l4807903.exe 820 rundll32.exe 820 rundll32.exe 820 rundll32.exe 820 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2972 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2532 l4807903.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2532 wrote to memory of 780 2532 l4807903.exe 28 PID 2532 wrote to memory of 780 2532 l4807903.exe 28 PID 2532 wrote to memory of 780 2532 l4807903.exe 28 PID 2532 wrote to memory of 780 2532 l4807903.exe 28 PID 780 wrote to memory of 2972 780 danke.exe 29 PID 780 wrote to memory of 2972 780 danke.exe 29 PID 780 wrote to memory of 2972 780 danke.exe 29 PID 780 wrote to memory of 2972 780 danke.exe 29 PID 780 wrote to memory of 3012 780 danke.exe 31 PID 780 wrote to memory of 3012 780 danke.exe 31 PID 780 wrote to memory of 3012 780 danke.exe 31 PID 780 wrote to memory of 3012 780 danke.exe 31 PID 3012 wrote to memory of 2852 3012 cmd.exe 33 PID 3012 wrote to memory of 2852 3012 cmd.exe 33 PID 3012 wrote to memory of 2852 3012 cmd.exe 33 PID 3012 wrote to memory of 2852 3012 cmd.exe 33 PID 3012 wrote to memory of 2928 3012 cmd.exe 34 PID 3012 wrote to memory of 2928 3012 cmd.exe 34 PID 3012 wrote to memory of 2928 3012 cmd.exe 34 PID 3012 wrote to memory of 2928 3012 cmd.exe 34 PID 3012 wrote to memory of 2752 3012 cmd.exe 35 PID 3012 wrote to memory of 2752 3012 cmd.exe 35 PID 3012 wrote to memory of 2752 3012 cmd.exe 35 PID 3012 wrote to memory of 2752 3012 cmd.exe 35 PID 3012 wrote to memory of 1980 3012 cmd.exe 36 PID 3012 wrote to memory of 1980 3012 cmd.exe 36 PID 3012 wrote to memory of 1980 3012 cmd.exe 36 PID 3012 wrote to memory of 1980 3012 cmd.exe 36 PID 3012 wrote to memory of 2160 3012 cmd.exe 37 PID 3012 wrote to memory of 2160 3012 cmd.exe 37 PID 3012 wrote to memory of 2160 3012 cmd.exe 37 PID 3012 wrote to memory of 2160 3012 cmd.exe 37 PID 3012 wrote to memory of 2896 3012 cmd.exe 38 PID 3012 wrote to memory of 2896 3012 cmd.exe 38 PID 3012 wrote to memory of 2896 3012 cmd.exe 38 PID 3012 wrote to memory of 2896 3012 cmd.exe 38 PID 2704 wrote to memory of 840 2704 taskeng.exe 43 PID 2704 wrote to memory of 840 2704 taskeng.exe 43 PID 2704 wrote to memory of 840 2704 taskeng.exe 43 PID 2704 wrote to memory of 840 2704 taskeng.exe 43 PID 780 wrote to memory of 820 780 danke.exe 44 PID 780 wrote to memory of 820 780 danke.exe 44 PID 780 wrote to memory of 820 780 danke.exe 44 PID 780 wrote to memory of 820 780 danke.exe 44 PID 780 wrote to memory of 820 780 danke.exe 44 PID 780 wrote to memory of 820 780 danke.exe 44 PID 780 wrote to memory of 820 780 danke.exe 44 PID 2704 wrote to memory of 3028 2704 taskeng.exe 45 PID 2704 wrote to memory of 3028 2704 taskeng.exe 45 PID 2704 wrote to memory of 3028 2704 taskeng.exe 45 PID 2704 wrote to memory of 3028 2704 taskeng.exe 45 PID 2704 wrote to memory of 1824 2704 taskeng.exe 46 PID 2704 wrote to memory of 1824 2704 taskeng.exe 46 PID 2704 wrote to memory of 1824 2704 taskeng.exe 46 PID 2704 wrote to memory of 1824 2704 taskeng.exe 46 PID 2704 wrote to memory of 2036 2704 taskeng.exe 47 PID 2704 wrote to memory of 2036 2704 taskeng.exe 47 PID 2704 wrote to memory of 2036 2704 taskeng.exe 47 PID 2704 wrote to memory of 2036 2704 taskeng.exe 47 PID 2704 wrote to memory of 1084 2704 taskeng.exe 48 PID 2704 wrote to memory of 1084 2704 taskeng.exe 48 PID 2704 wrote to memory of 1084 2704 taskeng.exe 48 PID 2704 wrote to memory of 1084 2704 taskeng.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\l4807903.exe"C:\Users\Admin\AppData\Local\Temp\l4807903.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F3⤵
- Creates scheduled task(s)
PID:2972
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2852
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"4⤵PID:2928
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E4⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:1980
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"4⤵PID:2160
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E4⤵PID:2896
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:820
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {CB1592A3-AFE6-4765-B0A3-19DD501554A3} S-1-5-21-1024678951-1535676557-2778719785-1000:KDGGTDCU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe2⤵
- Executes dropped EXE
PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe2⤵
- Executes dropped EXE
PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe2⤵
- Executes dropped EXE
PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe2⤵
- Executes dropped EXE
PID:1084
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9