Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
04/08/2023, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe
Resource
win10-20230703-en
General
-
Target
97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe
-
Size
560KB
-
MD5
3c87e6578cd781050f00d7919580a550
-
SHA1
874f7988fbe25f81748406718abc9724ef53daa2
-
SHA256
97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078
-
SHA512
469769d1fe66c0c30f2937f1faf099c08d09744f796f3d5c30fa955bec841b7dbd7cbc035bcae9d49537934620913293ec054b3fedb41dc0f23666ef5905b9c6
-
SSDEEP
6144:Kgy+bnr+Ap0yN90QEAmP72GPJGHQ7k28bAghFzmKLycX4y54+rip80LPK6X53ITS:oMr0y90Fz2GwQ7k7z1X1riyp9NiupCZ
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001afe9-139.dat healer behavioral1/files/0x000700000001afe9-140.dat healer behavioral1/memory/2212-141-0x0000000000B20000-0x0000000000B2A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p6833833.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p6833833.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p6833833.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p6833833.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p6833833.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 4316 z6757522.exe 4968 z5087069.exe 2212 p6833833.exe 4976 r4740096.exe 1596 legosa.exe 3272 s5530932.exe 5060 legosa.exe 792 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 3044 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p6833833.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6757522.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5087069.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5052 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2212 p6833833.exe 2212 p6833833.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2212 p6833833.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4316 3948 97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe 70 PID 3948 wrote to memory of 4316 3948 97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe 70 PID 3948 wrote to memory of 4316 3948 97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe 70 PID 4316 wrote to memory of 4968 4316 z6757522.exe 71 PID 4316 wrote to memory of 4968 4316 z6757522.exe 71 PID 4316 wrote to memory of 4968 4316 z6757522.exe 71 PID 4968 wrote to memory of 2212 4968 z5087069.exe 72 PID 4968 wrote to memory of 2212 4968 z5087069.exe 72 PID 4968 wrote to memory of 4976 4968 z5087069.exe 73 PID 4968 wrote to memory of 4976 4968 z5087069.exe 73 PID 4968 wrote to memory of 4976 4968 z5087069.exe 73 PID 4976 wrote to memory of 1596 4976 r4740096.exe 74 PID 4976 wrote to memory of 1596 4976 r4740096.exe 74 PID 4976 wrote to memory of 1596 4976 r4740096.exe 74 PID 4316 wrote to memory of 3272 4316 z6757522.exe 75 PID 4316 wrote to memory of 3272 4316 z6757522.exe 75 PID 4316 wrote to memory of 3272 4316 z6757522.exe 75 PID 1596 wrote to memory of 5052 1596 legosa.exe 76 PID 1596 wrote to memory of 5052 1596 legosa.exe 76 PID 1596 wrote to memory of 5052 1596 legosa.exe 76 PID 1596 wrote to memory of 2508 1596 legosa.exe 77 PID 1596 wrote to memory of 2508 1596 legosa.exe 77 PID 1596 wrote to memory of 2508 1596 legosa.exe 77 PID 2508 wrote to memory of 4460 2508 cmd.exe 80 PID 2508 wrote to memory of 4460 2508 cmd.exe 80 PID 2508 wrote to memory of 4460 2508 cmd.exe 80 PID 2508 wrote to memory of 3264 2508 cmd.exe 81 PID 2508 wrote to memory of 3264 2508 cmd.exe 81 PID 2508 wrote to memory of 3264 2508 cmd.exe 81 PID 2508 wrote to memory of 2612 2508 cmd.exe 82 PID 2508 wrote to memory of 2612 2508 cmd.exe 82 PID 2508 wrote to memory of 2612 2508 cmd.exe 82 PID 2508 wrote to memory of 3768 2508 cmd.exe 83 PID 2508 wrote to memory of 3768 2508 cmd.exe 83 PID 2508 wrote to memory of 3768 2508 cmd.exe 83 PID 2508 wrote to memory of 2536 2508 cmd.exe 84 PID 2508 wrote to memory of 2536 2508 cmd.exe 84 PID 2508 wrote to memory of 2536 2508 cmd.exe 84 PID 2508 wrote to memory of 4052 2508 cmd.exe 85 PID 2508 wrote to memory of 4052 2508 cmd.exe 85 PID 2508 wrote to memory of 4052 2508 cmd.exe 85 PID 1596 wrote to memory of 3044 1596 legosa.exe 87 PID 1596 wrote to memory of 3044 1596 legosa.exe 87 PID 1596 wrote to memory of 3044 1596 legosa.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe"C:\Users\Admin\AppData\Local\Temp\97ab6d22a1f028037ffdf17a5bbaea9f35969c2e1516205a8f3090c22e386078.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6757522.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6757522.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5087069.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5087069.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6833833.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6833833.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4740096.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4740096.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:5052
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4460
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:3264
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:2612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3768
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:2536
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:4052
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3044
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5530932.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5530932.exe3⤵
- Executes dropped EXE
PID:3272
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:5060
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD585aac8f527bc411844a1a759aac8766a
SHA147d21f3e5075474f374b374b19589362330fa834
SHA2568452244a2a71e000a687f60979cdaa6665358d70f3c1d67a44e69cf45f85cd1b
SHA512126b4dc3b794289f5bc77459e8dea6fc2e8cd410fe6ed636fadfd45947cda1e50cb7e1a20a2426822732298d4e4b9b4afe0cd51cc4c6e8cdbf57f4a0a98b8cbe
-
Filesize
432KB
MD585aac8f527bc411844a1a759aac8766a
SHA147d21f3e5075474f374b374b19589362330fa834
SHA2568452244a2a71e000a687f60979cdaa6665358d70f3c1d67a44e69cf45f85cd1b
SHA512126b4dc3b794289f5bc77459e8dea6fc2e8cd410fe6ed636fadfd45947cda1e50cb7e1a20a2426822732298d4e4b9b4afe0cd51cc4c6e8cdbf57f4a0a98b8cbe
-
Filesize
177KB
MD50cd867fd58e69d5eed23946c90189bf9
SHA1a133fc29d379999d82589b8a2f27de1912cbe5ae
SHA256e6a4dfd454ee0f51e78fc657209623350f39178ff77101c228293fd4ee29e1a3
SHA5121a666f9336ca1066825acc910e7f939874e504d6983536619edebdb355e642351d635936c1a88132512b895e540cfc5a9b2a808a11ae9b4d7ffd7c58c7167e58
-
Filesize
177KB
MD50cd867fd58e69d5eed23946c90189bf9
SHA1a133fc29d379999d82589b8a2f27de1912cbe5ae
SHA256e6a4dfd454ee0f51e78fc657209623350f39178ff77101c228293fd4ee29e1a3
SHA5121a666f9336ca1066825acc910e7f939874e504d6983536619edebdb355e642351d635936c1a88132512b895e540cfc5a9b2a808a11ae9b4d7ffd7c58c7167e58
-
Filesize
277KB
MD5c75ac2e75f5bca15154933c613f047aa
SHA1d134f0f0438850fc54a1c3c440bd992bb3247aea
SHA256f3eaf2f0bf78daf627385af15cbec5d7f6f576938f44665bf7dadd4ae2774124
SHA512a7eb4d1fa4d031d0894983d07113dfd3f2b99309ec61dd00e90fc124c7aa8c9fe00e0dbc3b24c1c5f72c5473d13204c1e9918949bd4a68cc8f7905be2b330402
-
Filesize
277KB
MD5c75ac2e75f5bca15154933c613f047aa
SHA1d134f0f0438850fc54a1c3c440bd992bb3247aea
SHA256f3eaf2f0bf78daf627385af15cbec5d7f6f576938f44665bf7dadd4ae2774124
SHA512a7eb4d1fa4d031d0894983d07113dfd3f2b99309ec61dd00e90fc124c7aa8c9fe00e0dbc3b24c1c5f72c5473d13204c1e9918949bd4a68cc8f7905be2b330402
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651