Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe
Resource
win10v2004-20230703-en
General
-
Target
d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe
-
Size
389KB
-
MD5
6a96c639cebce4ace3a2a40a1a6daa16
-
SHA1
18755cde5412e12c706c97aff10a3b106bf3fbe0
-
SHA256
d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06
-
SHA512
2d8b394d7f1a84e7cf9e19b2096120faa84855e835b2c334a9d5c0457d4bea1f24bade273de9232333558d4455da2475818a6f28bac10912bd86517ee2a14628
-
SSDEEP
6144:KYy+bnr+4p0yN90QE7pThfmhqvqkN1RGVBo0ig9KYDYcbvW0ojoSjE:EMr4y90FpFvqm1RG40H04W0FSw
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x0006000000023212-159.dat healer behavioral1/files/0x0006000000023212-158.dat healer behavioral1/memory/4684-160-0x0000000000D30000-0x0000000000D3A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h6122843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h6122843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h6122843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h6122843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h6122843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h6122843.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation g9722629.exe Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 1696 x2720203.exe 4484 g9722629.exe 260 danke.exe 4684 h6122843.exe 4144 j3992265.exe 2328 danke.exe 4456 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 3404 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h6122843.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x2720203.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x2720203.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5108 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4684 h6122843.exe 4684 h6122843.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4684 h6122843.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4484 g9722629.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 3948 wrote to memory of 1696 3948 d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe 86 PID 3948 wrote to memory of 1696 3948 d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe 86 PID 3948 wrote to memory of 1696 3948 d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe 86 PID 1696 wrote to memory of 4484 1696 x2720203.exe 87 PID 1696 wrote to memory of 4484 1696 x2720203.exe 87 PID 1696 wrote to memory of 4484 1696 x2720203.exe 87 PID 4484 wrote to memory of 260 4484 g9722629.exe 88 PID 4484 wrote to memory of 260 4484 g9722629.exe 88 PID 4484 wrote to memory of 260 4484 g9722629.exe 88 PID 1696 wrote to memory of 4684 1696 x2720203.exe 89 PID 1696 wrote to memory of 4684 1696 x2720203.exe 89 PID 260 wrote to memory of 5108 260 danke.exe 90 PID 260 wrote to memory of 5108 260 danke.exe 90 PID 260 wrote to memory of 5108 260 danke.exe 90 PID 260 wrote to memory of 1512 260 danke.exe 92 PID 260 wrote to memory of 1512 260 danke.exe 92 PID 260 wrote to memory of 1512 260 danke.exe 92 PID 1512 wrote to memory of 4564 1512 cmd.exe 94 PID 1512 wrote to memory of 4564 1512 cmd.exe 94 PID 1512 wrote to memory of 4564 1512 cmd.exe 94 PID 1512 wrote to memory of 1412 1512 cmd.exe 95 PID 1512 wrote to memory of 1412 1512 cmd.exe 95 PID 1512 wrote to memory of 1412 1512 cmd.exe 95 PID 1512 wrote to memory of 3788 1512 cmd.exe 96 PID 1512 wrote to memory of 3788 1512 cmd.exe 96 PID 1512 wrote to memory of 3788 1512 cmd.exe 96 PID 1512 wrote to memory of 3984 1512 cmd.exe 97 PID 1512 wrote to memory of 3984 1512 cmd.exe 97 PID 1512 wrote to memory of 3984 1512 cmd.exe 97 PID 1512 wrote to memory of 3004 1512 cmd.exe 98 PID 1512 wrote to memory of 3004 1512 cmd.exe 98 PID 1512 wrote to memory of 3004 1512 cmd.exe 98 PID 1512 wrote to memory of 2872 1512 cmd.exe 99 PID 1512 wrote to memory of 2872 1512 cmd.exe 99 PID 1512 wrote to memory of 2872 1512 cmd.exe 99 PID 3948 wrote to memory of 4144 3948 d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe 104 PID 3948 wrote to memory of 4144 3948 d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe 104 PID 3948 wrote to memory of 4144 3948 d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe 104 PID 260 wrote to memory of 3404 260 danke.exe 112 PID 260 wrote to memory of 3404 260 danke.exe 112 PID 260 wrote to memory of 3404 260 danke.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe"C:\Users\Admin\AppData\Local\Temp\d661eb5d599b4d7d3dcde30f0956562ca725ae63ce0995fe72da6776ec8def06.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2720203.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2720203.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9722629.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9722629.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:5108
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4564
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:1412
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:3788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3984
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3004
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:2872
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3404
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6122843.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6122843.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3992265.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3992265.exe2⤵
- Executes dropped EXE
PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD54295eb8bdfe86a6a2b3a1181480ca797
SHA187ba958f39d3afcd13edccccd76802f352fd9282
SHA256f1326ca8f00fa2bd494bb95ca184458b9cac29d867a12eb98d76292584ca511a
SHA512eff2e5a208e393c21fa6b44c0126d00ae9c1d73c257db4e7ee184bc2cc28744ee8b72ba45e4024f49ca4604d425b63ad33d6e7c955d6f30f54aec91d275e28a0
-
Filesize
174KB
MD54295eb8bdfe86a6a2b3a1181480ca797
SHA187ba958f39d3afcd13edccccd76802f352fd9282
SHA256f1326ca8f00fa2bd494bb95ca184458b9cac29d867a12eb98d76292584ca511a
SHA512eff2e5a208e393c21fa6b44c0126d00ae9c1d73c257db4e7ee184bc2cc28744ee8b72ba45e4024f49ca4604d425b63ad33d6e7c955d6f30f54aec91d275e28a0
-
Filesize
234KB
MD514810221d652e03c75a54116fdc0d98f
SHA1093fc93e26a87777ea95869776e44df7e676ae70
SHA2567cb0b97c0d7fe21ffc2ee10830e418301b5aef988642049e5626885615f2abab
SHA5125ea6329d587ee8ea201e3403d6e0193755a53984a3a54af926d6cf6e1ad13f5ce314b1810ef478a7e2bee7e8ed1a3cf351b2c3ebb8f7102ea4d5a98cd31b7abc
-
Filesize
234KB
MD514810221d652e03c75a54116fdc0d98f
SHA1093fc93e26a87777ea95869776e44df7e676ae70
SHA2567cb0b97c0d7fe21ffc2ee10830e418301b5aef988642049e5626885615f2abab
SHA5125ea6329d587ee8ea201e3403d6e0193755a53984a3a54af926d6cf6e1ad13f5ce314b1810ef478a7e2bee7e8ed1a3cf351b2c3ebb8f7102ea4d5a98cd31b7abc
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59