Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 16:07
Behavioral task
behavioral1
Sample
0x0006000000016d0a-96.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0x0006000000016d0a-96.exe
Resource
win10v2004-20230703-en
General
-
Target
0x0006000000016d0a-96.exe
-
Size
232KB
-
MD5
743b5c9f6f5fbb5059346a2376985923
-
SHA1
f3d448aa71523d8684958845e8f6dfdf7d6a9b67
-
SHA256
3c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
-
SHA512
510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
SSDEEP
3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 1760 pdates.exe 4768 faman.exe 4748 pdates.exe 1712 pdates.exe 2020 pdates.exe -
Loads dropped DLL 3 IoCs
pid Process 3304 regsvr32.exe 3304 regsvr32.exe 552 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faman.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000025051\\faman.exe" pdates.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4524 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5088 0x0006000000016d0a-96.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 5088 wrote to memory of 1760 5088 0x0006000000016d0a-96.exe 81 PID 5088 wrote to memory of 1760 5088 0x0006000000016d0a-96.exe 81 PID 5088 wrote to memory of 1760 5088 0x0006000000016d0a-96.exe 81 PID 1760 wrote to memory of 4524 1760 pdates.exe 82 PID 1760 wrote to memory of 4524 1760 pdates.exe 82 PID 1760 wrote to memory of 4524 1760 pdates.exe 82 PID 1760 wrote to memory of 1460 1760 pdates.exe 84 PID 1760 wrote to memory of 1460 1760 pdates.exe 84 PID 1760 wrote to memory of 1460 1760 pdates.exe 84 PID 1460 wrote to memory of 2096 1460 cmd.exe 88 PID 1460 wrote to memory of 2096 1460 cmd.exe 88 PID 1460 wrote to memory of 2096 1460 cmd.exe 88 PID 1460 wrote to memory of 1696 1460 cmd.exe 87 PID 1460 wrote to memory of 1696 1460 cmd.exe 87 PID 1460 wrote to memory of 1696 1460 cmd.exe 87 PID 1460 wrote to memory of 2356 1460 cmd.exe 89 PID 1460 wrote to memory of 2356 1460 cmd.exe 89 PID 1460 wrote to memory of 2356 1460 cmd.exe 89 PID 1460 wrote to memory of 2280 1460 cmd.exe 90 PID 1460 wrote to memory of 2280 1460 cmd.exe 90 PID 1460 wrote to memory of 2280 1460 cmd.exe 90 PID 1460 wrote to memory of 1556 1460 cmd.exe 91 PID 1460 wrote to memory of 1556 1460 cmd.exe 91 PID 1460 wrote to memory of 1556 1460 cmd.exe 91 PID 1460 wrote to memory of 4300 1460 cmd.exe 92 PID 1460 wrote to memory of 4300 1460 cmd.exe 92 PID 1460 wrote to memory of 4300 1460 cmd.exe 92 PID 1760 wrote to memory of 4768 1760 pdates.exe 95 PID 1760 wrote to memory of 4768 1760 pdates.exe 95 PID 1760 wrote to memory of 4768 1760 pdates.exe 95 PID 4768 wrote to memory of 3304 4768 faman.exe 98 PID 4768 wrote to memory of 3304 4768 faman.exe 98 PID 4768 wrote to memory of 3304 4768 faman.exe 98 PID 1760 wrote to memory of 552 1760 pdates.exe 104 PID 1760 wrote to memory of 552 1760 pdates.exe 104 PID 1760 wrote to memory of 552 1760 pdates.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0006000000016d0a-96.exe"C:\Users\Admin\AppData\Local\Temp\0x0006000000016d0a-96.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F3⤵
- Creates scheduled task(s)
PID:4524
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"4⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2096
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E4⤵PID:2356
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2280
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"4⤵PID:1556
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E4⤵PID:4300
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000025051\faman.exe"C:\Users\Admin\AppData\Local\Temp\1000025051\faman.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /u G_YhMAeO.C /s4⤵
- Loads dropped DLL
PID:3304
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:552
-
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4748
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:1712
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:2020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5e1d2add4263bd1864f7e6911686247cb
SHA10d80e8d20a015a2243e16f4d49f81b1d4e9831b2
SHA256262557cb12fb62cedd8e0256d845ac0cd2c087fed82a7cf3e78573f5b0f953ef
SHA5125acd9cb8709b92b667ae4654c62b58644c85648dcfdcd1f3ff921aae12846df066a59e1d1352a4f84026dbf6ac7cf2abef1b416a23c12a1f310a2760924aaf7b
-
Filesize
2.5MB
MD5e1d2add4263bd1864f7e6911686247cb
SHA10d80e8d20a015a2243e16f4d49f81b1d4e9831b2
SHA256262557cb12fb62cedd8e0256d845ac0cd2c087fed82a7cf3e78573f5b0f953ef
SHA5125acd9cb8709b92b667ae4654c62b58644c85648dcfdcd1f3ff921aae12846df066a59e1d1352a4f84026dbf6ac7cf2abef1b416a23c12a1f310a2760924aaf7b
-
Filesize
2.5MB
MD5e1d2add4263bd1864f7e6911686247cb
SHA10d80e8d20a015a2243e16f4d49f81b1d4e9831b2
SHA256262557cb12fb62cedd8e0256d845ac0cd2c087fed82a7cf3e78573f5b0f953ef
SHA5125acd9cb8709b92b667ae4654c62b58644c85648dcfdcd1f3ff921aae12846df066a59e1d1352a4f84026dbf6ac7cf2abef1b416a23c12a1f310a2760924aaf7b
-
Filesize
232KB
MD5743b5c9f6f5fbb5059346a2376985923
SHA1f3d448aa71523d8684958845e8f6dfdf7d6a9b67
SHA2563c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
SHA512510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
Filesize
232KB
MD5743b5c9f6f5fbb5059346a2376985923
SHA1f3d448aa71523d8684958845e8f6dfdf7d6a9b67
SHA2563c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
SHA512510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
Filesize
232KB
MD5743b5c9f6f5fbb5059346a2376985923
SHA1f3d448aa71523d8684958845e8f6dfdf7d6a9b67
SHA2563c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
SHA512510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
Filesize
232KB
MD5743b5c9f6f5fbb5059346a2376985923
SHA1f3d448aa71523d8684958845e8f6dfdf7d6a9b67
SHA2563c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
SHA512510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
Filesize
232KB
MD5743b5c9f6f5fbb5059346a2376985923
SHA1f3d448aa71523d8684958845e8f6dfdf7d6a9b67
SHA2563c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
SHA512510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
Filesize
232KB
MD5743b5c9f6f5fbb5059346a2376985923
SHA1f3d448aa71523d8684958845e8f6dfdf7d6a9b67
SHA2563c01340745ceefc84969818dc24e3e766fca00df81d75a97e97a16f3af8db8fd
SHA512510fdefcc9f72bc8b8395304a4137a85011bf2c7454b3ca37c42711899a4abb97507a9074bb35648b6c77b567e55a40b0676c4f5b5a4cdb2b1aa91a6eb94ff9c
-
Filesize
2.4MB
MD586ed27f97783f47a2ccd529042117de6
SHA160e16cfd4b7d9700b5eca61059790ab2b77c2aa7
SHA25673514aa180d5c145d511270bea11061e1c56b530b5dc20b25c13b77b553cc50a
SHA512eac16d22276338f41b253b19f38ac6315a393a53a65cb893fb962b9312ba46ae82c2626dd78aadeca4ab4afd7f7c49c1ad486964aae1589ea30254b312a8359a
-
Filesize
2.4MB
MD586ed27f97783f47a2ccd529042117de6
SHA160e16cfd4b7d9700b5eca61059790ab2b77c2aa7
SHA25673514aa180d5c145d511270bea11061e1c56b530b5dc20b25c13b77b553cc50a
SHA512eac16d22276338f41b253b19f38ac6315a393a53a65cb893fb962b9312ba46ae82c2626dd78aadeca4ab4afd7f7c49c1ad486964aae1589ea30254b312a8359a
-
Filesize
2.4MB
MD586ed27f97783f47a2ccd529042117de6
SHA160e16cfd4b7d9700b5eca61059790ab2b77c2aa7
SHA25673514aa180d5c145d511270bea11061e1c56b530b5dc20b25c13b77b553cc50a
SHA512eac16d22276338f41b253b19f38ac6315a393a53a65cb893fb962b9312ba46ae82c2626dd78aadeca4ab4afd7f7c49c1ad486964aae1589ea30254b312a8359a
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
273B
MD59851b884bf4aadfade57d911a3f03332
SHA1aaadd1c1856c22844bb9fbb030cf4f586ed8866a
SHA25603afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f
SHA512a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327