Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2023, 20:56
Static task
static1
Behavioral task
behavioral1
Sample
f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe
Resource
win10v2004-20230703-en
General
-
Target
f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe
-
Size
560KB
-
MD5
7fcddfdbb4274641fe030b6ecaa763f2
-
SHA1
eb5da7375ddc26af5bbe08f94f5e69f13c12a49b
-
SHA256
f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9
-
SHA512
80d4ff4f6bbcb15f7f698fbcb0e1f5a1a497f9876283a001de511ff22561be48e9edbcd7f6df7d9ac79a05c6a3d0784908f80f73987ed23585d3510366dd981c
-
SSDEEP
12288:9Mrgy90GGZEIrNqwMH/uPepQ00iHOy82giSTT:1ypeNqwMfIep10SOyDgfTT
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00060000000224dc-152.dat healer behavioral1/files/0x00060000000224dc-153.dat healer behavioral1/memory/928-154-0x00000000002A0000-0x00000000002AA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p3913924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p3913924.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p3913924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p3913924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p3913924.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p3913924.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 760 z9199618.exe 5048 z6711587.exe 928 p3913924.exe 1080 r7880950.exe 1560 legosa.exe 3956 s9898546.exe 3380 legosa.exe 3876 legosa.exe 1472 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 1200 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p3913924.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9199618.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z6711587.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 928 p3913924.exe 928 p3913924.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 928 p3913924.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3208 wrote to memory of 760 3208 f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe 86 PID 3208 wrote to memory of 760 3208 f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe 86 PID 3208 wrote to memory of 760 3208 f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe 86 PID 760 wrote to memory of 5048 760 z9199618.exe 87 PID 760 wrote to memory of 5048 760 z9199618.exe 87 PID 760 wrote to memory of 5048 760 z9199618.exe 87 PID 5048 wrote to memory of 928 5048 z6711587.exe 88 PID 5048 wrote to memory of 928 5048 z6711587.exe 88 PID 5048 wrote to memory of 1080 5048 z6711587.exe 94 PID 5048 wrote to memory of 1080 5048 z6711587.exe 94 PID 5048 wrote to memory of 1080 5048 z6711587.exe 94 PID 1080 wrote to memory of 1560 1080 r7880950.exe 97 PID 1080 wrote to memory of 1560 1080 r7880950.exe 97 PID 1080 wrote to memory of 1560 1080 r7880950.exe 97 PID 760 wrote to memory of 3956 760 z9199618.exe 98 PID 760 wrote to memory of 3956 760 z9199618.exe 98 PID 760 wrote to memory of 3956 760 z9199618.exe 98 PID 1560 wrote to memory of 1520 1560 legosa.exe 99 PID 1560 wrote to memory of 1520 1560 legosa.exe 99 PID 1560 wrote to memory of 1520 1560 legosa.exe 99 PID 1560 wrote to memory of 4064 1560 legosa.exe 101 PID 1560 wrote to memory of 4064 1560 legosa.exe 101 PID 1560 wrote to memory of 4064 1560 legosa.exe 101 PID 4064 wrote to memory of 4568 4064 cmd.exe 103 PID 4064 wrote to memory of 4568 4064 cmd.exe 103 PID 4064 wrote to memory of 4568 4064 cmd.exe 103 PID 4064 wrote to memory of 680 4064 cmd.exe 104 PID 4064 wrote to memory of 680 4064 cmd.exe 104 PID 4064 wrote to memory of 680 4064 cmd.exe 104 PID 4064 wrote to memory of 4408 4064 cmd.exe 105 PID 4064 wrote to memory of 4408 4064 cmd.exe 105 PID 4064 wrote to memory of 4408 4064 cmd.exe 105 PID 4064 wrote to memory of 1368 4064 cmd.exe 106 PID 4064 wrote to memory of 1368 4064 cmd.exe 106 PID 4064 wrote to memory of 1368 4064 cmd.exe 106 PID 4064 wrote to memory of 3132 4064 cmd.exe 107 PID 4064 wrote to memory of 3132 4064 cmd.exe 107 PID 4064 wrote to memory of 3132 4064 cmd.exe 107 PID 4064 wrote to memory of 3088 4064 cmd.exe 108 PID 4064 wrote to memory of 3088 4064 cmd.exe 108 PID 4064 wrote to memory of 3088 4064 cmd.exe 108 PID 1560 wrote to memory of 1200 1560 legosa.exe 115 PID 1560 wrote to memory of 1200 1560 legosa.exe 115 PID 1560 wrote to memory of 1200 1560 legosa.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe"C:\Users\Admin\AppData\Local\Temp\f88735003a9e85845e0360e13dbdcb05fa3a4d6d1d486d1d4445bd33ea435ff9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9199618.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9199618.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6711587.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6711587.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3913924.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3913924.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7880950.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7880950.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:1520
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4568
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:680
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:4408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1368
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:3132
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:3088
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:1200
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s9898546.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s9898546.exe3⤵
- Executes dropped EXE
PID:3956
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3380
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3876
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:1472
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD5d4b897bf51ed089c6fa1331accff3e5b
SHA13328591ca8ed0e3b87fea29c93a0bad579e01ba8
SHA256e34ea1db1b12c71bb8fa5a81e054d81ff1ea15ef05c55611e55c628f30b07915
SHA5126cddbc1e57fb45984d1a21c5641990f7466df1619bc46bcd839afecabac7e9657f7e9054acd0b368c26cd333abd9c7b25ff391abd5cd432e504c074beb52238c
-
Filesize
432KB
MD5d4b897bf51ed089c6fa1331accff3e5b
SHA13328591ca8ed0e3b87fea29c93a0bad579e01ba8
SHA256e34ea1db1b12c71bb8fa5a81e054d81ff1ea15ef05c55611e55c628f30b07915
SHA5126cddbc1e57fb45984d1a21c5641990f7466df1619bc46bcd839afecabac7e9657f7e9054acd0b368c26cd333abd9c7b25ff391abd5cd432e504c074beb52238c
-
Filesize
176KB
MD5b411ead647787cf309ddb2369bfa9ee9
SHA1c3f58ef47ac2aa1f406a454f282d6ae0d31b521b
SHA256a5deba151f5d0c7e6c27809bb971a421f1a3527fd1a6dd57351a0f9cf9993d28
SHA512b2b44608609772d7dbe3ed291e96bc7c4b2fecfed371dfb8feed54909b45935b6fa0317ce449daef893d340a73a7fc1afe0175c405f21a7cc61eee5e72553cfc
-
Filesize
176KB
MD5b411ead647787cf309ddb2369bfa9ee9
SHA1c3f58ef47ac2aa1f406a454f282d6ae0d31b521b
SHA256a5deba151f5d0c7e6c27809bb971a421f1a3527fd1a6dd57351a0f9cf9993d28
SHA512b2b44608609772d7dbe3ed291e96bc7c4b2fecfed371dfb8feed54909b45935b6fa0317ce449daef893d340a73a7fc1afe0175c405f21a7cc61eee5e72553cfc
-
Filesize
277KB
MD55e45116a9aacad8baef6de67d149417b
SHA19d44c4ef82f42af41fa6bd6ed472cf42c994f666
SHA256c1b8e65444f32f24aba90e855ceb653260cb3dcad3760f0b068f13bdd41326e4
SHA51291ad163d2e176911251fe4f224f48a7a7d49e2574d87101877657ec54b0993756b4821d01ef9019c1e58bd4636806a07736855c4e801afdc69fabb482f1e4039
-
Filesize
277KB
MD55e45116a9aacad8baef6de67d149417b
SHA19d44c4ef82f42af41fa6bd6ed472cf42c994f666
SHA256c1b8e65444f32f24aba90e855ceb653260cb3dcad3760f0b068f13bdd41326e4
SHA51291ad163d2e176911251fe4f224f48a7a7d49e2574d87101877657ec54b0993756b4821d01ef9019c1e58bd4636806a07736855c4e801afdc69fabb482f1e4039
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5