Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe
Resource
win10v2004-20230703-en
General
-
Target
cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe
-
Size
390KB
-
MD5
56b8667e0bed675ed7bfcbc2bb484bca
-
SHA1
54298b4b0580a4138152697b51f2d72d298b49c6
-
SHA256
cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2
-
SHA512
62cbbf9310dcf06b15787a7f36a54c77957f91b70d665ddae8172c002aa422785a8be25ba6fd3317a6d334ee7ec96e41eefe0cefe1f582298f2a81cf1adb9ea0
-
SSDEEP
6144:Kvy+bnr+Sp0yN90QEb2eWAD3RS2C6nnGYg1GKX99WbseUqtDQSUa6T:NMrKy90dMADkWnnGZGKml5Qha6T
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00060000000230aa-158.dat healer behavioral1/files/0x00060000000230aa-159.dat healer behavioral1/memory/3036-160-0x0000000000630000-0x000000000063A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h6058416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h6058416.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h6058416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h6058416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h6058416.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h6058416.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation g4833655.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 4796 x8820618.exe 5116 g4833655.exe 4580 danke.exe 3036 h6058416.exe 4976 j9291084.exe 2304 danke.exe 4072 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 4324 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h6058416.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x8820618.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8820618.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1364 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 h6058416.exe 3036 h6058416.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 h6058416.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5116 g4833655.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1720 wrote to memory of 4796 1720 cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe 86 PID 1720 wrote to memory of 4796 1720 cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe 86 PID 1720 wrote to memory of 4796 1720 cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe 86 PID 4796 wrote to memory of 5116 4796 x8820618.exe 87 PID 4796 wrote to memory of 5116 4796 x8820618.exe 87 PID 4796 wrote to memory of 5116 4796 x8820618.exe 87 PID 5116 wrote to memory of 4580 5116 g4833655.exe 88 PID 5116 wrote to memory of 4580 5116 g4833655.exe 88 PID 5116 wrote to memory of 4580 5116 g4833655.exe 88 PID 4796 wrote to memory of 3036 4796 x8820618.exe 89 PID 4796 wrote to memory of 3036 4796 x8820618.exe 89 PID 4580 wrote to memory of 1364 4580 danke.exe 90 PID 4580 wrote to memory of 1364 4580 danke.exe 90 PID 4580 wrote to memory of 1364 4580 danke.exe 90 PID 4580 wrote to memory of 2456 4580 danke.exe 92 PID 4580 wrote to memory of 2456 4580 danke.exe 92 PID 4580 wrote to memory of 2456 4580 danke.exe 92 PID 2456 wrote to memory of 2840 2456 cmd.exe 94 PID 2456 wrote to memory of 2840 2456 cmd.exe 94 PID 2456 wrote to memory of 2840 2456 cmd.exe 94 PID 2456 wrote to memory of 4328 2456 cmd.exe 95 PID 2456 wrote to memory of 4328 2456 cmd.exe 95 PID 2456 wrote to memory of 4328 2456 cmd.exe 95 PID 2456 wrote to memory of 3088 2456 cmd.exe 96 PID 2456 wrote to memory of 3088 2456 cmd.exe 96 PID 2456 wrote to memory of 3088 2456 cmd.exe 96 PID 2456 wrote to memory of 4604 2456 cmd.exe 97 PID 2456 wrote to memory of 4604 2456 cmd.exe 97 PID 2456 wrote to memory of 4604 2456 cmd.exe 97 PID 2456 wrote to memory of 1736 2456 cmd.exe 98 PID 2456 wrote to memory of 1736 2456 cmd.exe 98 PID 2456 wrote to memory of 1736 2456 cmd.exe 98 PID 2456 wrote to memory of 1308 2456 cmd.exe 99 PID 2456 wrote to memory of 1308 2456 cmd.exe 99 PID 2456 wrote to memory of 1308 2456 cmd.exe 99 PID 1720 wrote to memory of 4976 1720 cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe 104 PID 1720 wrote to memory of 4976 1720 cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe 104 PID 1720 wrote to memory of 4976 1720 cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe 104 PID 4580 wrote to memory of 4324 4580 danke.exe 112 PID 4580 wrote to memory of 4324 4580 danke.exe 112 PID 4580 wrote to memory of 4324 4580 danke.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe"C:\Users\Admin\AppData\Local\Temp\cab5132b3b6a861d06a799b2c3d32e2a0b251a6fd32e19ecee7912328b831de2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8820618.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8820618.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4833655.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4833655.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:1364
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2840
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:4328
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:3088
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4604
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:1736
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:1308
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4324
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6058416.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6058416.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9291084.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9291084.exe2⤵
- Executes dropped EXE
PID:4976
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4072
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
173KB
MD596ef8395cdd93e88ffa99b18407331a1
SHA154991be9e022f9240ab907a33b255c13f0a052ce
SHA256859212018ffa0e0e0bfcb7fa8d18e22f6304b74a9a839fada563a840264a83c9
SHA5126ebaae5b1af1c220e416bcac7fa833ac990d3408716f9eaa691f878ec98f1cfde719903e4be65fe56761e8a2a229793574712cf8fff5cfc854e947329d163130
-
Filesize
173KB
MD596ef8395cdd93e88ffa99b18407331a1
SHA154991be9e022f9240ab907a33b255c13f0a052ce
SHA256859212018ffa0e0e0bfcb7fa8d18e22f6304b74a9a839fada563a840264a83c9
SHA5126ebaae5b1af1c220e416bcac7fa833ac990d3408716f9eaa691f878ec98f1cfde719903e4be65fe56761e8a2a229793574712cf8fff5cfc854e947329d163130
-
Filesize
234KB
MD5f3d8acef5784a41769656add167bf64c
SHA1d4809f9ef7dd8025f3d6addf77fcbaff7e035898
SHA25627fb261b512616fbf22ca417127247934855bfa5e12e47e1a20dcdadbe055ff6
SHA512b041dd393ff51473d59abc8bdeff320f004197a4b45ff692966d2cfc93cd7c14d43e491646cbc8fd9c4b5743d014a7142e330331cfaaf43b4829cad8bd70d106
-
Filesize
234KB
MD5f3d8acef5784a41769656add167bf64c
SHA1d4809f9ef7dd8025f3d6addf77fcbaff7e035898
SHA25627fb261b512616fbf22ca417127247934855bfa5e12e47e1a20dcdadbe055ff6
SHA512b041dd393ff51473d59abc8bdeff320f004197a4b45ff692966d2cfc93cd7c14d43e491646cbc8fd9c4b5743d014a7142e330331cfaaf43b4829cad8bd70d106
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59