Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe
Resource
win10v2004-20230703-en
General
-
Target
a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe
-
Size
560KB
-
MD5
67debd3fbfa546c861feecad25a77daf
-
SHA1
4e762912627a297538329a781d523ad27e45d982
-
SHA256
a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77
-
SHA512
6fabdc89b4be3ab84f30a0f11c1b3314ec0d166baf0b547491bf0698efdc33b478b75df191ded55972a9df9af9ea81f1a5c07eb334b47c1748142e3dcd449c1f
-
SSDEEP
12288:/Mrny90RU3Al/bUcBLQvuE8UTYsSe7LR3TWVRmR36MeU/:Yy6UwJbUcB05V/S6L9TqmR36Me4
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
micky
77.91.124.172:19071
-
auth_value
748f3c67c004f4a994500f05127b4428
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000002322a-152.dat healer behavioral1/files/0x000700000002322a-153.dat healer behavioral1/memory/4304-154-0x0000000000790000-0x000000000079A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p1027057.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p1027057.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p1027057.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p1027057.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p1027057.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p1027057.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 1832 z5945295.exe 3764 z9693644.exe 4304 p1027057.exe 5044 r5052792.exe 2212 legosa.exe 3464 s7651088.exe 3476 legosa.exe 2920 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 3324 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1027057.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5945295.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9693644.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4304 p1027057.exe 4304 p1027057.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4304 p1027057.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1832 4664 a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe 84 PID 4664 wrote to memory of 1832 4664 a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe 84 PID 4664 wrote to memory of 1832 4664 a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe 84 PID 1832 wrote to memory of 3764 1832 z5945295.exe 86 PID 1832 wrote to memory of 3764 1832 z5945295.exe 86 PID 1832 wrote to memory of 3764 1832 z5945295.exe 86 PID 3764 wrote to memory of 4304 3764 z9693644.exe 87 PID 3764 wrote to memory of 4304 3764 z9693644.exe 87 PID 3764 wrote to memory of 5044 3764 z9693644.exe 93 PID 3764 wrote to memory of 5044 3764 z9693644.exe 93 PID 3764 wrote to memory of 5044 3764 z9693644.exe 93 PID 5044 wrote to memory of 2212 5044 r5052792.exe 96 PID 5044 wrote to memory of 2212 5044 r5052792.exe 96 PID 5044 wrote to memory of 2212 5044 r5052792.exe 96 PID 1832 wrote to memory of 3464 1832 z5945295.exe 97 PID 1832 wrote to memory of 3464 1832 z5945295.exe 97 PID 1832 wrote to memory of 3464 1832 z5945295.exe 97 PID 2212 wrote to memory of 4680 2212 legosa.exe 98 PID 2212 wrote to memory of 4680 2212 legosa.exe 98 PID 2212 wrote to memory of 4680 2212 legosa.exe 98 PID 2212 wrote to memory of 3388 2212 legosa.exe 100 PID 2212 wrote to memory of 3388 2212 legosa.exe 100 PID 2212 wrote to memory of 3388 2212 legosa.exe 100 PID 3388 wrote to memory of 1476 3388 cmd.exe 102 PID 3388 wrote to memory of 1476 3388 cmd.exe 102 PID 3388 wrote to memory of 1476 3388 cmd.exe 102 PID 3388 wrote to memory of 3064 3388 cmd.exe 103 PID 3388 wrote to memory of 3064 3388 cmd.exe 103 PID 3388 wrote to memory of 3064 3388 cmd.exe 103 PID 3388 wrote to memory of 4940 3388 cmd.exe 104 PID 3388 wrote to memory of 4940 3388 cmd.exe 104 PID 3388 wrote to memory of 4940 3388 cmd.exe 104 PID 3388 wrote to memory of 872 3388 cmd.exe 105 PID 3388 wrote to memory of 872 3388 cmd.exe 105 PID 3388 wrote to memory of 872 3388 cmd.exe 105 PID 3388 wrote to memory of 3248 3388 cmd.exe 106 PID 3388 wrote to memory of 3248 3388 cmd.exe 106 PID 3388 wrote to memory of 3248 3388 cmd.exe 106 PID 3388 wrote to memory of 688 3388 cmd.exe 107 PID 3388 wrote to memory of 688 3388 cmd.exe 107 PID 3388 wrote to memory of 688 3388 cmd.exe 107 PID 2212 wrote to memory of 3324 2212 legosa.exe 112 PID 2212 wrote to memory of 3324 2212 legosa.exe 112 PID 2212 wrote to memory of 3324 2212 legosa.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe"C:\Users\Admin\AppData\Local\Temp\a4d9d3bbb314df82cbaefd71b066db6e0f26ec7df9bc50d6d6464410f6461d77.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5945295.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5945295.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9693644.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9693644.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1027057.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1027057.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5052792.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5052792.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:4680
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1476
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:3064
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:4940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:872
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:3248
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:688
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3324
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7651088.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7651088.exe3⤵
- Executes dropped EXE
PID:3464
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3476
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:2920
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD502a9c41cec69e7480b5e0457308d07b1
SHA1313952d5ecab11245c38f275a7edce3dbaca9d5f
SHA256ce996dd07c83108bbe80aab3ecc34cabd2c8abb570896ec512c2a15584993166
SHA512c132878c2bb84d70c63268d7b3dc2007555762b1eacef9afe554ec01aae5f3e0f56a2063b6fdb852c771c8d00efaaa07bb48fc18171b5b76e2e65339514ec7a6
-
Filesize
432KB
MD502a9c41cec69e7480b5e0457308d07b1
SHA1313952d5ecab11245c38f275a7edce3dbaca9d5f
SHA256ce996dd07c83108bbe80aab3ecc34cabd2c8abb570896ec512c2a15584993166
SHA512c132878c2bb84d70c63268d7b3dc2007555762b1eacef9afe554ec01aae5f3e0f56a2063b6fdb852c771c8d00efaaa07bb48fc18171b5b76e2e65339514ec7a6
-
Filesize
174KB
MD5d9c810ffa7ab1e6eb13b013caa85c64f
SHA16ed984de8f71608fc9d16af3628e956c38b338c2
SHA2561a6265d5e976be9c5bd76bd3c5a2e2f229aaf4425f019a4a5fca0e07ab3df827
SHA51247aa07584be471a79d6d10cabf2e714814f4028d7e4e1dc164d52ee470a9459b32b5e68449210dfe7879250a4b095b4bd0a52340d867dfec852f2a82ea96df36
-
Filesize
174KB
MD5d9c810ffa7ab1e6eb13b013caa85c64f
SHA16ed984de8f71608fc9d16af3628e956c38b338c2
SHA2561a6265d5e976be9c5bd76bd3c5a2e2f229aaf4425f019a4a5fca0e07ab3df827
SHA51247aa07584be471a79d6d10cabf2e714814f4028d7e4e1dc164d52ee470a9459b32b5e68449210dfe7879250a4b095b4bd0a52340d867dfec852f2a82ea96df36
-
Filesize
277KB
MD5abd96682cc33c939af3337a83b6d55ae
SHA1d832bc6a92ee7ba77617413a8b3709ecb86703ff
SHA256cf8380bd16b4a35ef2a7a499fde97da5a0be741435c12f02239d6d9f329957d9
SHA5126d706665ece245983de8e6cffbabecf936d2d4d9ec0e892df23860c841647481dbee5ad0ed6ac0a99dcfb1289b2f99ac908f3a3f01d64e1e28f4e86b5d4eeca6
-
Filesize
277KB
MD5abd96682cc33c939af3337a83b6d55ae
SHA1d832bc6a92ee7ba77617413a8b3709ecb86703ff
SHA256cf8380bd16b4a35ef2a7a499fde97da5a0be741435c12f02239d6d9f329957d9
SHA5126d706665ece245983de8e6cffbabecf936d2d4d9ec0e892df23860c841647481dbee5ad0ed6ac0a99dcfb1289b2f99ac908f3a3f01d64e1e28f4e86b5d4eeca6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5