Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
21/07/2023, 08:13
Static task
static1
Behavioral task
behavioral1
Sample
aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe
Resource
win10-20230703-en
General
-
Target
aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe
-
Size
390KB
-
MD5
187ca7f692d7c9374525370772770407
-
SHA1
8a9e4999938b7a9b9dad4cfa8fdff699f2d83833
-
SHA256
aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801
-
SHA512
e5e3695d486964e75ee15441a77877e90f3f8786e0729fa20a953d6807ef091be4344cbd939c17654534b419dd77b90fef6a509a0656d492d0d3c4e417851934
-
SSDEEP
12288:gMrny90ZzF9ijb+sP5EpKcHnl9r7Jsq+z:XyK3ijvqH/7Jc
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001af78-132.dat healer behavioral1/files/0x000700000001af78-133.dat healer behavioral1/memory/1296-134-0x0000000000F00000-0x0000000000F0A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k0546847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k0546847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k0546847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k0546847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k0546847.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
pid Process 3820 y9201283.exe 1296 k0546847.exe 2184 l1610967.exe 4328 danke.exe 3768 n8106476.exe 3356 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 2272 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k0546847.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y9201283.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y9201283.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1296 k0546847.exe 1296 k0546847.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1296 k0546847.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 l1610967.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4452 wrote to memory of 3820 4452 aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe 69 PID 4452 wrote to memory of 3820 4452 aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe 69 PID 4452 wrote to memory of 3820 4452 aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe 69 PID 3820 wrote to memory of 1296 3820 y9201283.exe 70 PID 3820 wrote to memory of 1296 3820 y9201283.exe 70 PID 3820 wrote to memory of 2184 3820 y9201283.exe 71 PID 3820 wrote to memory of 2184 3820 y9201283.exe 71 PID 3820 wrote to memory of 2184 3820 y9201283.exe 71 PID 2184 wrote to memory of 4328 2184 l1610967.exe 72 PID 2184 wrote to memory of 4328 2184 l1610967.exe 72 PID 2184 wrote to memory of 4328 2184 l1610967.exe 72 PID 4452 wrote to memory of 3768 4452 aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe 73 PID 4452 wrote to memory of 3768 4452 aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe 73 PID 4452 wrote to memory of 3768 4452 aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe 73 PID 4328 wrote to memory of 4252 4328 danke.exe 74 PID 4328 wrote to memory of 4252 4328 danke.exe 74 PID 4328 wrote to memory of 4252 4328 danke.exe 74 PID 4328 wrote to memory of 4244 4328 danke.exe 75 PID 4328 wrote to memory of 4244 4328 danke.exe 75 PID 4328 wrote to memory of 4244 4328 danke.exe 75 PID 4244 wrote to memory of 3636 4244 cmd.exe 78 PID 4244 wrote to memory of 3636 4244 cmd.exe 78 PID 4244 wrote to memory of 3636 4244 cmd.exe 78 PID 4244 wrote to memory of 2416 4244 cmd.exe 79 PID 4244 wrote to memory of 2416 4244 cmd.exe 79 PID 4244 wrote to memory of 2416 4244 cmd.exe 79 PID 4244 wrote to memory of 1180 4244 cmd.exe 80 PID 4244 wrote to memory of 1180 4244 cmd.exe 80 PID 4244 wrote to memory of 1180 4244 cmd.exe 80 PID 4244 wrote to memory of 1768 4244 cmd.exe 81 PID 4244 wrote to memory of 1768 4244 cmd.exe 81 PID 4244 wrote to memory of 1768 4244 cmd.exe 81 PID 4244 wrote to memory of 4228 4244 cmd.exe 82 PID 4244 wrote to memory of 4228 4244 cmd.exe 82 PID 4244 wrote to memory of 4228 4244 cmd.exe 82 PID 4244 wrote to memory of 1940 4244 cmd.exe 83 PID 4244 wrote to memory of 1940 4244 cmd.exe 83 PID 4244 wrote to memory of 1940 4244 cmd.exe 83 PID 4328 wrote to memory of 2272 4328 danke.exe 85 PID 4328 wrote to memory of 2272 4328 danke.exe 85 PID 4328 wrote to memory of 2272 4328 danke.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe"C:\Users\Admin\AppData\Local\Temp\aaee8c63e5deee0e0c974b4e0afb6cc2a0061d6e844475dceec42a52c7ee4801.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9201283.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9201283.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0546847.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0546847.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1610967.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1610967.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:4252
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3636
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:2416
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:1180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1768
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:4228
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:1940
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2272
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n8106476.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n8106476.exe2⤵
- Executes dropped EXE
PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3356
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
175KB
MD5348c83342a0b4417eded8dfcf985a1f4
SHA18921f2ad34e20935c7e458de876039ff6cfba1ba
SHA2567b88f6a5f29fe983311d9d3c06dde025ae8692e8479fae100382c3f6e8f9c541
SHA512ebbbc89f8f8bfe57b52eec60d29de56ca2782e19bd03a63d5cbd08e20a96ec9cd79dde496f5f17125b56b1b8cd75b1024508f0c4c6df527929fd5f853e4ab53e
-
Filesize
175KB
MD5348c83342a0b4417eded8dfcf985a1f4
SHA18921f2ad34e20935c7e458de876039ff6cfba1ba
SHA2567b88f6a5f29fe983311d9d3c06dde025ae8692e8479fae100382c3f6e8f9c541
SHA512ebbbc89f8f8bfe57b52eec60d29de56ca2782e19bd03a63d5cbd08e20a96ec9cd79dde496f5f17125b56b1b8cd75b1024508f0c4c6df527929fd5f853e4ab53e
-
Filesize
235KB
MD5363477cd0a90bbe7b7bf9307c18d0fa5
SHA11b7d0fdf35ea8e141af978eeecef7e7b2345e8ab
SHA2565d2a81bd20f934ab1660185e835256a2cd767f458c86e2f3b93509fa7e059b67
SHA51283baa13974dd29573a645ce474d9144049b875b28427d3911c1b69a37e73da6a6b257482eada14a2c32b3efff84841313bd26e3a6302b8c0694903cde5c400d8
-
Filesize
235KB
MD5363477cd0a90bbe7b7bf9307c18d0fa5
SHA11b7d0fdf35ea8e141af978eeecef7e7b2345e8ab
SHA2565d2a81bd20f934ab1660185e835256a2cd767f458c86e2f3b93509fa7e059b67
SHA51283baa13974dd29573a645ce474d9144049b875b28427d3911c1b69a37e73da6a6b257482eada14a2c32b3efff84841313bd26e3a6302b8c0694903cde5c400d8
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9