Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2023, 02:06
Behavioral task
behavioral1
Sample
0x000a000000015dbc-87.exe
Resource
win7-20230712-en
General
-
Target
0x000a000000015dbc-87.exe
-
Size
228KB
-
MD5
0709d929d383a7b7e0c0bc1b46c208f9
-
SHA1
c25f2c24b5e6a03116feb48832fe673927a4c347
-
SHA256
8e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
-
SHA512
92cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
SSDEEP
3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation danke.exe Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation 0x000a000000015dbc-87.exe -
Executes dropped EXE 4 IoCs
pid Process 2628 danke.exe 5116 danke.exe 2540 danke.exe 4188 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 2184 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3836 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4884 0x000a000000015dbc-87.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4884 wrote to memory of 2628 4884 0x000a000000015dbc-87.exe 86 PID 4884 wrote to memory of 2628 4884 0x000a000000015dbc-87.exe 86 PID 4884 wrote to memory of 2628 4884 0x000a000000015dbc-87.exe 86 PID 2628 wrote to memory of 3836 2628 danke.exe 87 PID 2628 wrote to memory of 3836 2628 danke.exe 87 PID 2628 wrote to memory of 3836 2628 danke.exe 87 PID 2628 wrote to memory of 3788 2628 danke.exe 89 PID 2628 wrote to memory of 3788 2628 danke.exe 89 PID 2628 wrote to memory of 3788 2628 danke.exe 89 PID 3788 wrote to memory of 4156 3788 cmd.exe 91 PID 3788 wrote to memory of 4156 3788 cmd.exe 91 PID 3788 wrote to memory of 4156 3788 cmd.exe 91 PID 3788 wrote to memory of 2164 3788 cmd.exe 92 PID 3788 wrote to memory of 2164 3788 cmd.exe 92 PID 3788 wrote to memory of 2164 3788 cmd.exe 92 PID 3788 wrote to memory of 4124 3788 cmd.exe 93 PID 3788 wrote to memory of 4124 3788 cmd.exe 93 PID 3788 wrote to memory of 4124 3788 cmd.exe 93 PID 3788 wrote to memory of 4692 3788 cmd.exe 94 PID 3788 wrote to memory of 4692 3788 cmd.exe 94 PID 3788 wrote to memory of 4692 3788 cmd.exe 94 PID 3788 wrote to memory of 1344 3788 cmd.exe 95 PID 3788 wrote to memory of 1344 3788 cmd.exe 95 PID 3788 wrote to memory of 1344 3788 cmd.exe 95 PID 3788 wrote to memory of 4776 3788 cmd.exe 96 PID 3788 wrote to memory of 4776 3788 cmd.exe 96 PID 3788 wrote to memory of 4776 3788 cmd.exe 96 PID 2628 wrote to memory of 2184 2628 danke.exe 110 PID 2628 wrote to memory of 2184 2628 danke.exe 110 PID 2628 wrote to memory of 2184 2628 danke.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000a000000015dbc-87.exe"C:\Users\Admin\AppData\Local\Temp\0x000a000000015dbc-87.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F3⤵
- Creates scheduled task(s)
PID:3836
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4156
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"4⤵PID:2164
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E4⤵PID:4124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4692
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"4⤵PID:1344
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E4⤵PID:4776
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:2184
-
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD50709d929d383a7b7e0c0bc1b46c208f9
SHA1c25f2c24b5e6a03116feb48832fe673927a4c347
SHA2568e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
SHA51292cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
Filesize
228KB
MD50709d929d383a7b7e0c0bc1b46c208f9
SHA1c25f2c24b5e6a03116feb48832fe673927a4c347
SHA2568e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
SHA51292cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
Filesize
228KB
MD50709d929d383a7b7e0c0bc1b46c208f9
SHA1c25f2c24b5e6a03116feb48832fe673927a4c347
SHA2568e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
SHA51292cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
Filesize
228KB
MD50709d929d383a7b7e0c0bc1b46c208f9
SHA1c25f2c24b5e6a03116feb48832fe673927a4c347
SHA2568e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
SHA51292cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
Filesize
228KB
MD50709d929d383a7b7e0c0bc1b46c208f9
SHA1c25f2c24b5e6a03116feb48832fe673927a4c347
SHA2568e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
SHA51292cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
Filesize
228KB
MD50709d929d383a7b7e0c0bc1b46c208f9
SHA1c25f2c24b5e6a03116feb48832fe673927a4c347
SHA2568e0ce2743cb2e2ce038b92ac7e4234a432279dcce4c892555b9440aa8b16265e
SHA51292cde8147bf7dc9208261a2a1ce8c5536c28b710bc520afc5e9916920f8b9d1ba4c66b243e56a1a48c06df6c29280d76d3d5d8b2845cc158c2264b0df2b24029
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59