Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
05/08/2023, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe
Resource
win10-20230703-en
General
-
Target
f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe
-
Size
560KB
-
MD5
85820e761cfd0eced9a810a0cbeadd9f
-
SHA1
0053f9c16f45e2c159d2219906ecb24682a85d0e
-
SHA256
f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6
-
SHA512
651d863f231bbba28f82faa61af352a1a7d4e9655edfa72ba78657e46c555e8b932f24d6edb05cb1a1cbbf2f022e436304fd5589be731b6de5456fd1430f1265
-
SSDEEP
12288:TMryy90TQzuu73eqppbeSzbKctPyndNi4zR:Zyqauujeq3iSzbrPydNDt
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
micky
77.91.124.172:19071
-
auth_value
748f3c67c004f4a994500f05127b4428
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001aff0-137.dat healer behavioral1/files/0x000700000001aff0-138.dat healer behavioral1/memory/984-139-0x0000000000010000-0x000000000001A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p7905557.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p7905557.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p7905557.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p7905557.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p7905557.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 824 z7590466.exe 4568 z5955551.exe 984 p7905557.exe 2188 r9429822.exe 1556 legosa.exe 1832 s8167903.exe 4920 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 672 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p7905557.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z7590466.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5955551.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1868 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 984 p7905557.exe 984 p7905557.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 984 p7905557.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 5020 wrote to memory of 824 5020 f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe 70 PID 5020 wrote to memory of 824 5020 f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe 70 PID 5020 wrote to memory of 824 5020 f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe 70 PID 824 wrote to memory of 4568 824 z7590466.exe 71 PID 824 wrote to memory of 4568 824 z7590466.exe 71 PID 824 wrote to memory of 4568 824 z7590466.exe 71 PID 4568 wrote to memory of 984 4568 z5955551.exe 72 PID 4568 wrote to memory of 984 4568 z5955551.exe 72 PID 4568 wrote to memory of 2188 4568 z5955551.exe 73 PID 4568 wrote to memory of 2188 4568 z5955551.exe 73 PID 4568 wrote to memory of 2188 4568 z5955551.exe 73 PID 2188 wrote to memory of 1556 2188 r9429822.exe 74 PID 2188 wrote to memory of 1556 2188 r9429822.exe 74 PID 2188 wrote to memory of 1556 2188 r9429822.exe 74 PID 824 wrote to memory of 1832 824 z7590466.exe 75 PID 824 wrote to memory of 1832 824 z7590466.exe 75 PID 824 wrote to memory of 1832 824 z7590466.exe 75 PID 1556 wrote to memory of 1868 1556 legosa.exe 76 PID 1556 wrote to memory of 1868 1556 legosa.exe 76 PID 1556 wrote to memory of 1868 1556 legosa.exe 76 PID 1556 wrote to memory of 3220 1556 legosa.exe 77 PID 1556 wrote to memory of 3220 1556 legosa.exe 77 PID 1556 wrote to memory of 3220 1556 legosa.exe 77 PID 3220 wrote to memory of 2828 3220 cmd.exe 80 PID 3220 wrote to memory of 2828 3220 cmd.exe 80 PID 3220 wrote to memory of 2828 3220 cmd.exe 80 PID 3220 wrote to memory of 3108 3220 cmd.exe 81 PID 3220 wrote to memory of 3108 3220 cmd.exe 81 PID 3220 wrote to memory of 3108 3220 cmd.exe 81 PID 3220 wrote to memory of 4972 3220 cmd.exe 82 PID 3220 wrote to memory of 4972 3220 cmd.exe 82 PID 3220 wrote to memory of 4972 3220 cmd.exe 82 PID 3220 wrote to memory of 4820 3220 cmd.exe 84 PID 3220 wrote to memory of 4820 3220 cmd.exe 84 PID 3220 wrote to memory of 4820 3220 cmd.exe 84 PID 3220 wrote to memory of 1588 3220 cmd.exe 83 PID 3220 wrote to memory of 1588 3220 cmd.exe 83 PID 3220 wrote to memory of 1588 3220 cmd.exe 83 PID 3220 wrote to memory of 4824 3220 cmd.exe 85 PID 3220 wrote to memory of 4824 3220 cmd.exe 85 PID 3220 wrote to memory of 4824 3220 cmd.exe 85 PID 1556 wrote to memory of 672 1556 legosa.exe 87 PID 1556 wrote to memory of 672 1556 legosa.exe 87 PID 1556 wrote to memory of 672 1556 legosa.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe"C:\Users\Admin\AppData\Local\Temp\f19d5090ac319f31b80cc84a5c8cd7f61d2511a2af8a367fb2488fdb4c32fcd6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7590466.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7590466.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5955551.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5955551.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7905557.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7905557.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r9429822.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r9429822.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:1868
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2828
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:3108
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:4972
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:1588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4820
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:4824
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:672
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8167903.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8167903.exe3⤵
- Executes dropped EXE
PID:1832
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4920
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD51ad443f9816cd9b26c003703b797e86a
SHA1a60c39c5378dc33ee889f92ce7ba0016030f5b31
SHA256bc8e2193a96ae7011f5944b3a687e066a5a9060804a8de9f7a07f73a8480b5ab
SHA5123719ce4b132362ff5ebc0c870324aede3ac24e703a526a70c67d4ca19767f52021366b93b7df918ede2454f563857a1ce7dad3bde0027bcda4b3c788413b09b4
-
Filesize
433KB
MD51ad443f9816cd9b26c003703b797e86a
SHA1a60c39c5378dc33ee889f92ce7ba0016030f5b31
SHA256bc8e2193a96ae7011f5944b3a687e066a5a9060804a8de9f7a07f73a8480b5ab
SHA5123719ce4b132362ff5ebc0c870324aede3ac24e703a526a70c67d4ca19767f52021366b93b7df918ede2454f563857a1ce7dad3bde0027bcda4b3c788413b09b4
-
Filesize
174KB
MD55292a2053441b02dc201633a9ec33499
SHA15654687301f6834f66641e96a3c39bee5e117537
SHA2561f2c1488eabb444faf47a40bd19f4a6ff23a491a9c94a03085351fc4f066f9d3
SHA512da6616aae200c5086c7194909aa675831d2f23a03b3043ca8341e86582ddf1f2d06cebf82f59ac99ba9f20828be0365e4e2346977bb69c7410fcc82e1428c4b8
-
Filesize
174KB
MD55292a2053441b02dc201633a9ec33499
SHA15654687301f6834f66641e96a3c39bee5e117537
SHA2561f2c1488eabb444faf47a40bd19f4a6ff23a491a9c94a03085351fc4f066f9d3
SHA512da6616aae200c5086c7194909aa675831d2f23a03b3043ca8341e86582ddf1f2d06cebf82f59ac99ba9f20828be0365e4e2346977bb69c7410fcc82e1428c4b8
-
Filesize
277KB
MD57a3229e8104ce29eb659c0ff51116acb
SHA1f836e9449dbe47f9b8a5e2afb2ba28538ac75baa
SHA25687d901c9314eddc89bca43be561fdf1958fe151907edbf6a86a8b560d6f6cd89
SHA512f835f67d2ab1feee307168ef1123595b84f997f7f92e771f9276fa593ab044626a36d36e4ac4b4e482477198ed168d47ad3c8d3d64032fdb5aeb592ef99b68b2
-
Filesize
277KB
MD57a3229e8104ce29eb659c0ff51116acb
SHA1f836e9449dbe47f9b8a5e2afb2ba28538ac75baa
SHA25687d901c9314eddc89bca43be561fdf1958fe151907edbf6a86a8b560d6f6cd89
SHA512f835f67d2ab1feee307168ef1123595b84f997f7f92e771f9276fa593ab044626a36d36e4ac4b4e482477198ed168d47ad3c8d3d64032fdb5aeb592ef99b68b2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651