Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe
Resource
win10v2004-20230703-en
General
-
Target
e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe
-
Size
560KB
-
MD5
3c0a0f89082953f2896ef98472ac0171
-
SHA1
4c66f1cc50b248280daf789f0e8068fc866a5371
-
SHA256
e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a
-
SHA512
1ab28f4961ed6c54a0951aacf97c3422922937d71caa77fe5a1d315f57f244a2671b484d3a8da91e143f1023a37862831d7a2436ea2d2af790f9c4ebef320c38
-
SSDEEP
12288:yMrCy90sDeq3qA++kcbiNim29cT9iQBIW34Pi:sylDjaVNxNg929Hj
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
savin
77.91.124.156:19071
-
auth_value
a1a05b810428195ab7bb63b132ea0c8d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000002325e-152.dat healer behavioral1/files/0x000700000002325e-153.dat healer behavioral1/memory/3848-154-0x0000000000200000-0x000000000020A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p1830141.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p1830141.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p1830141.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p1830141.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p1830141.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p1830141.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 4696 z8233982.exe 1152 z0527462.exe 3848 p1830141.exe 3364 r7808440.exe 4124 legosa.exe 4424 s0959676.exe 4984 legosa.exe 3244 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 4832 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1830141.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8233982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0527462.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1536 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3848 p1830141.exe 3848 p1830141.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3848 p1830141.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4696 3928 e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe 81 PID 3928 wrote to memory of 4696 3928 e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe 81 PID 3928 wrote to memory of 4696 3928 e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe 81 PID 4696 wrote to memory of 1152 4696 z8233982.exe 82 PID 4696 wrote to memory of 1152 4696 z8233982.exe 82 PID 4696 wrote to memory of 1152 4696 z8233982.exe 82 PID 1152 wrote to memory of 3848 1152 z0527462.exe 83 PID 1152 wrote to memory of 3848 1152 z0527462.exe 83 PID 1152 wrote to memory of 3364 1152 z0527462.exe 89 PID 1152 wrote to memory of 3364 1152 z0527462.exe 89 PID 1152 wrote to memory of 3364 1152 z0527462.exe 89 PID 3364 wrote to memory of 4124 3364 r7808440.exe 90 PID 3364 wrote to memory of 4124 3364 r7808440.exe 90 PID 3364 wrote to memory of 4124 3364 r7808440.exe 90 PID 4696 wrote to memory of 4424 4696 z8233982.exe 91 PID 4696 wrote to memory of 4424 4696 z8233982.exe 91 PID 4696 wrote to memory of 4424 4696 z8233982.exe 91 PID 4124 wrote to memory of 1536 4124 legosa.exe 92 PID 4124 wrote to memory of 1536 4124 legosa.exe 92 PID 4124 wrote to memory of 1536 4124 legosa.exe 92 PID 4124 wrote to memory of 3260 4124 legosa.exe 94 PID 4124 wrote to memory of 3260 4124 legosa.exe 94 PID 4124 wrote to memory of 3260 4124 legosa.exe 94 PID 3260 wrote to memory of 4264 3260 cmd.exe 96 PID 3260 wrote to memory of 4264 3260 cmd.exe 96 PID 3260 wrote to memory of 4264 3260 cmd.exe 96 PID 3260 wrote to memory of 4848 3260 cmd.exe 97 PID 3260 wrote to memory of 4848 3260 cmd.exe 97 PID 3260 wrote to memory of 4848 3260 cmd.exe 97 PID 3260 wrote to memory of 2948 3260 cmd.exe 98 PID 3260 wrote to memory of 2948 3260 cmd.exe 98 PID 3260 wrote to memory of 2948 3260 cmd.exe 98 PID 3260 wrote to memory of 3768 3260 cmd.exe 100 PID 3260 wrote to memory of 3768 3260 cmd.exe 100 PID 3260 wrote to memory of 3768 3260 cmd.exe 100 PID 3260 wrote to memory of 4200 3260 cmd.exe 99 PID 3260 wrote to memory of 4200 3260 cmd.exe 99 PID 3260 wrote to memory of 4200 3260 cmd.exe 99 PID 3260 wrote to memory of 3736 3260 cmd.exe 101 PID 3260 wrote to memory of 3736 3260 cmd.exe 101 PID 3260 wrote to memory of 3736 3260 cmd.exe 101 PID 4124 wrote to memory of 4832 4124 legosa.exe 108 PID 4124 wrote to memory of 4832 4124 legosa.exe 108 PID 4124 wrote to memory of 4832 4124 legosa.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe"C:\Users\Admin\AppData\Local\Temp\e2e9b1383dbf2f8023031d87bbedf873b0247bfbabeb76cb8609c048a4349a4a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8233982.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8233982.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0527462.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0527462.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1830141.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1830141.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7808440.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7808440.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:1536
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4264
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:4848
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:2948
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:4200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3768
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:3736
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4832
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0959676.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0959676.exe3⤵
- Executes dropped EXE
PID:4424
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4984
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3244
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD56da61e13c713ff71422322df1c11f268
SHA1711d50622821a11fc53adb5a240ac3bc60ea491b
SHA2567e4fe206bc286f3ac07bced9ca2187030a4fa8932e7062f1256c5e40a546220b
SHA512f7511aa4482f66dec947882fd56180f69f582fad02c625e37259f00f3210dcb554389543868074e4b45dda5fdd4513b59d195d1745cd11959bf2d663e7f4c305
-
Filesize
433KB
MD56da61e13c713ff71422322df1c11f268
SHA1711d50622821a11fc53adb5a240ac3bc60ea491b
SHA2567e4fe206bc286f3ac07bced9ca2187030a4fa8932e7062f1256c5e40a546220b
SHA512f7511aa4482f66dec947882fd56180f69f582fad02c625e37259f00f3210dcb554389543868074e4b45dda5fdd4513b59d195d1745cd11959bf2d663e7f4c305
-
Filesize
174KB
MD52f5a01611846d82fd947b79ad07dddd0
SHA1a1b7b4ced356316ee351df585ab5d7d59b59d91f
SHA256ea163e19e588e0da132171da0abd5cd7922f6f8d68ceff0d0875d0c2a0ef1ac4
SHA512a8efd9543a739567a82a74196a8f81c229405092bcef579cff469cb8e86a087d2483bbf60f31bb466212e3ed932c405041cac65130479d084dc1e6a05c4e50ba
-
Filesize
174KB
MD52f5a01611846d82fd947b79ad07dddd0
SHA1a1b7b4ced356316ee351df585ab5d7d59b59d91f
SHA256ea163e19e588e0da132171da0abd5cd7922f6f8d68ceff0d0875d0c2a0ef1ac4
SHA512a8efd9543a739567a82a74196a8f81c229405092bcef579cff469cb8e86a087d2483bbf60f31bb466212e3ed932c405041cac65130479d084dc1e6a05c4e50ba
-
Filesize
277KB
MD53b930153cb10122b8bd84dc3cd9fadad
SHA1f7d748a8c9f85d2622b5a2ed96b52dd4039e096d
SHA256564f0f9113085b9b4f3455dc79e379feabeb1e31feb69aae6f0bafe45f7d0886
SHA51252658d7cd2b8aabec7d772502bcbf0d6e3e80fa5bddbe3fa4168c013fd338d0884f14585048412e1a3baea187a294163528543ac64b7e18f00c3c2986c9b8d9a
-
Filesize
277KB
MD53b930153cb10122b8bd84dc3cd9fadad
SHA1f7d748a8c9f85d2622b5a2ed96b52dd4039e096d
SHA256564f0f9113085b9b4f3455dc79e379feabeb1e31feb69aae6f0bafe45f7d0886
SHA51252658d7cd2b8aabec7d772502bcbf0d6e3e80fa5bddbe3fa4168c013fd338d0884f14585048412e1a3baea187a294163528543ac64b7e18f00c3c2986c9b8d9a
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5