Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 04:08
Static task
static1
Behavioral task
behavioral1
Sample
06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe
Resource
win10v2004-20230703-en
General
-
Target
06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe
-
Size
560KB
-
MD5
29567669b6ff91eab7196788f482d88c
-
SHA1
22dbae4e57e06c5cc7c9dfeae6be4ef9085cf974
-
SHA256
06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3
-
SHA512
13b6f13a1012dd77c9a6b372a968fc61381db0c645ee9affd15074fc45b62278cb321b2c763cd6d9b49f7be93d697fd9927b00f808edf2c18bf38aff24d5e239
-
SSDEEP
12288:oMrcy902Y9A7GINf9I12zwioycVNiosYOluIfM1Rzp:0y/YYp3MnyUN10lu8M1Rzp
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
savin
77.91.124.156:19071
-
auth_value
a1a05b810428195ab7bb63b132ea0c8d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000800000002321a-152.dat healer behavioral1/files/0x000800000002321a-153.dat healer behavioral1/memory/4728-154-0x0000000000FB0000-0x0000000000FBA000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p1625687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p1625687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p1625687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p1625687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p1625687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p1625687.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 2676 z3812184.exe 3848 z6756068.exe 4728 p1625687.exe 1020 r5426926.exe 4388 legosa.exe 5008 s5120406.exe 1544 legosa.exe 4848 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 4476 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1625687.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3812184.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z6756068.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5096 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4728 p1625687.exe 4728 p1625687.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4728 p1625687.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 944 wrote to memory of 2676 944 06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe 81 PID 944 wrote to memory of 2676 944 06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe 81 PID 944 wrote to memory of 2676 944 06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe 81 PID 2676 wrote to memory of 3848 2676 z3812184.exe 82 PID 2676 wrote to memory of 3848 2676 z3812184.exe 82 PID 2676 wrote to memory of 3848 2676 z3812184.exe 82 PID 3848 wrote to memory of 4728 3848 z6756068.exe 83 PID 3848 wrote to memory of 4728 3848 z6756068.exe 83 PID 3848 wrote to memory of 1020 3848 z6756068.exe 92 PID 3848 wrote to memory of 1020 3848 z6756068.exe 92 PID 3848 wrote to memory of 1020 3848 z6756068.exe 92 PID 1020 wrote to memory of 4388 1020 r5426926.exe 93 PID 1020 wrote to memory of 4388 1020 r5426926.exe 93 PID 1020 wrote to memory of 4388 1020 r5426926.exe 93 PID 2676 wrote to memory of 5008 2676 z3812184.exe 94 PID 2676 wrote to memory of 5008 2676 z3812184.exe 94 PID 2676 wrote to memory of 5008 2676 z3812184.exe 94 PID 4388 wrote to memory of 5096 4388 legosa.exe 96 PID 4388 wrote to memory of 5096 4388 legosa.exe 96 PID 4388 wrote to memory of 5096 4388 legosa.exe 96 PID 4388 wrote to memory of 3028 4388 legosa.exe 98 PID 4388 wrote to memory of 3028 4388 legosa.exe 98 PID 4388 wrote to memory of 3028 4388 legosa.exe 98 PID 3028 wrote to memory of 1960 3028 cmd.exe 100 PID 3028 wrote to memory of 1960 3028 cmd.exe 100 PID 3028 wrote to memory of 1960 3028 cmd.exe 100 PID 3028 wrote to memory of 1964 3028 cmd.exe 101 PID 3028 wrote to memory of 1964 3028 cmd.exe 101 PID 3028 wrote to memory of 1964 3028 cmd.exe 101 PID 3028 wrote to memory of 2536 3028 cmd.exe 102 PID 3028 wrote to memory of 2536 3028 cmd.exe 102 PID 3028 wrote to memory of 2536 3028 cmd.exe 102 PID 3028 wrote to memory of 4712 3028 cmd.exe 103 PID 3028 wrote to memory of 4712 3028 cmd.exe 103 PID 3028 wrote to memory of 4712 3028 cmd.exe 103 PID 3028 wrote to memory of 928 3028 cmd.exe 104 PID 3028 wrote to memory of 928 3028 cmd.exe 104 PID 3028 wrote to memory of 928 3028 cmd.exe 104 PID 3028 wrote to memory of 3852 3028 cmd.exe 105 PID 3028 wrote to memory of 3852 3028 cmd.exe 105 PID 3028 wrote to memory of 3852 3028 cmd.exe 105 PID 4388 wrote to memory of 4476 4388 legosa.exe 107 PID 4388 wrote to memory of 4476 4388 legosa.exe 107 PID 4388 wrote to memory of 4476 4388 legosa.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe"C:\Users\Admin\AppData\Local\Temp\06b2f6fbd6b56aa3b4eac4a037dcbcc96b7dab504bd273208cccd3bd403d85a3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3812184.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3812184.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6756068.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6756068.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1625687.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1625687.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5426926.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r5426926.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:5096
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1960
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:1964
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4712
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:928
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:3852
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4476
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5120406.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s5120406.exe3⤵
- Executes dropped EXE
PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:1544
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4848
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD5721ffccd7176c9303831ff5e35126259
SHA152321df256deb761968cf7322544e187a3866330
SHA256bb3685e181b8dbaaa20e2d255b299a6a68445736473781cbd150b512ba1cce35
SHA512198e65d438cd2c15ba361a2d9e89bdc48b66df661370a40f389ebc530a8c5da23f04f3732072e0feda2afba9f6f42da7246da359809ea2133e2c4b91dd501c0f
-
Filesize
433KB
MD5721ffccd7176c9303831ff5e35126259
SHA152321df256deb761968cf7322544e187a3866330
SHA256bb3685e181b8dbaaa20e2d255b299a6a68445736473781cbd150b512ba1cce35
SHA512198e65d438cd2c15ba361a2d9e89bdc48b66df661370a40f389ebc530a8c5da23f04f3732072e0feda2afba9f6f42da7246da359809ea2133e2c4b91dd501c0f
-
Filesize
174KB
MD5e05f0a7f1dcca1b6321fa6def4062c7c
SHA10cb2f6a3db12c989089f67ce9a200d896398a2e5
SHA256750c89dbfe2079dd1ef447bbe5a5cc33ef8a5ccae541a94aaff8f8ccd1bc1109
SHA5121c6ffca387e9e282fdbf6f30844d7205f75baa83b3cd771e01984663b396e934668937cb6378354ba3928f5690e7db7c8eae2de95f119f1f2ba3220a3b358611
-
Filesize
174KB
MD5e05f0a7f1dcca1b6321fa6def4062c7c
SHA10cb2f6a3db12c989089f67ce9a200d896398a2e5
SHA256750c89dbfe2079dd1ef447bbe5a5cc33ef8a5ccae541a94aaff8f8ccd1bc1109
SHA5121c6ffca387e9e282fdbf6f30844d7205f75baa83b3cd771e01984663b396e934668937cb6378354ba3928f5690e7db7c8eae2de95f119f1f2ba3220a3b358611
-
Filesize
277KB
MD591448809e30d1d5a18cb5f1bcafdc0af
SHA152d79fdc3af17f2ccd39dc40e5fbbbf726f133d9
SHA256fe6aef5995774a8bdac0d9bf0dff7f23e6826e50882ecb72d2c034c182f1e7f6
SHA512c258be27416cec9a209553b002d466c50db874f5e26d8a332bd335edf8f289a82261db3f55620eb1184c0a9e29d1befc818992a2f39825aafd7d901b20e40d09
-
Filesize
277KB
MD591448809e30d1d5a18cb5f1bcafdc0af
SHA152d79fdc3af17f2ccd39dc40e5fbbbf726f133d9
SHA256fe6aef5995774a8bdac0d9bf0dff7f23e6826e50882ecb72d2c034c182f1e7f6
SHA512c258be27416cec9a209553b002d466c50db874f5e26d8a332bd335edf8f289a82261db3f55620eb1184c0a9e29d1befc818992a2f39825aafd7d901b20e40d09
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5