Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe
Resource
win10v2004-20230703-en
General
-
Target
c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe
-
Size
560KB
-
MD5
16884b080f07e6f17ebfaf4b1e95bbea
-
SHA1
7f3d418352e585891d6c274d2bb6af43aedafe42
-
SHA256
c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04
-
SHA512
b21e9f80099206fa540707de5eace3ccfcf63e0f58434bf8f8b10090e07b37e78b6307c08b2a42316b71e53c94ac45a1c80b890ce7011f496c9b70812f99317a
-
SSDEEP
12288:9Mr8y903nXfkvbi1VkR31qdJzOuQyDw4iecy:RyKPkvbUVkR3UdXQyU4J
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
savin
77.91.124.156:19071
-
auth_value
a1a05b810428195ab7bb63b132ea0c8d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000002327c-152.dat healer behavioral1/files/0x000700000002327c-153.dat healer behavioral1/memory/1492-154-0x0000000000060000-0x000000000006A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p9313679.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p9313679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p9313679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p9313679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p9313679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p9313679.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 2860 z4888173.exe 972 z3517165.exe 1492 p9313679.exe 5028 r4003602.exe 2432 legosa.exe 4500 s3472643.exe 2364 legosa.exe 1888 legosa.exe 3248 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 4708 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p9313679.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4888173.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3517165.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2004 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1952 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1492 p9313679.exe 1492 p9313679.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1492 p9313679.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2860 1968 c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe 80 PID 1968 wrote to memory of 2860 1968 c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe 80 PID 1968 wrote to memory of 2860 1968 c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe 80 PID 2860 wrote to memory of 972 2860 z4888173.exe 81 PID 2860 wrote to memory of 972 2860 z4888173.exe 81 PID 2860 wrote to memory of 972 2860 z4888173.exe 81 PID 972 wrote to memory of 1492 972 z3517165.exe 82 PID 972 wrote to memory of 1492 972 z3517165.exe 82 PID 972 wrote to memory of 5028 972 z3517165.exe 88 PID 972 wrote to memory of 5028 972 z3517165.exe 88 PID 972 wrote to memory of 5028 972 z3517165.exe 88 PID 5028 wrote to memory of 2432 5028 r4003602.exe 89 PID 5028 wrote to memory of 2432 5028 r4003602.exe 89 PID 5028 wrote to memory of 2432 5028 r4003602.exe 89 PID 2860 wrote to memory of 4500 2860 z4888173.exe 90 PID 2860 wrote to memory of 4500 2860 z4888173.exe 90 PID 2860 wrote to memory of 4500 2860 z4888173.exe 90 PID 2432 wrote to memory of 1952 2432 legosa.exe 91 PID 2432 wrote to memory of 1952 2432 legosa.exe 91 PID 2432 wrote to memory of 1952 2432 legosa.exe 91 PID 2432 wrote to memory of 1784 2432 legosa.exe 93 PID 2432 wrote to memory of 1784 2432 legosa.exe 93 PID 2432 wrote to memory of 1784 2432 legosa.exe 93 PID 1784 wrote to memory of 3004 1784 cmd.exe 95 PID 1784 wrote to memory of 3004 1784 cmd.exe 95 PID 1784 wrote to memory of 3004 1784 cmd.exe 95 PID 1784 wrote to memory of 3400 1784 cmd.exe 96 PID 1784 wrote to memory of 3400 1784 cmd.exe 96 PID 1784 wrote to memory of 3400 1784 cmd.exe 96 PID 1784 wrote to memory of 4332 1784 cmd.exe 97 PID 1784 wrote to memory of 4332 1784 cmd.exe 97 PID 1784 wrote to memory of 4332 1784 cmd.exe 97 PID 1784 wrote to memory of 2036 1784 cmd.exe 98 PID 1784 wrote to memory of 2036 1784 cmd.exe 98 PID 1784 wrote to memory of 2036 1784 cmd.exe 98 PID 1784 wrote to memory of 2256 1784 cmd.exe 99 PID 1784 wrote to memory of 2256 1784 cmd.exe 99 PID 1784 wrote to memory of 2256 1784 cmd.exe 99 PID 1784 wrote to memory of 3188 1784 cmd.exe 100 PID 1784 wrote to memory of 3188 1784 cmd.exe 100 PID 1784 wrote to memory of 3188 1784 cmd.exe 100 PID 2432 wrote to memory of 4708 2432 legosa.exe 107 PID 2432 wrote to memory of 4708 2432 legosa.exe 107 PID 2432 wrote to memory of 4708 2432 legosa.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe"C:\Users\Admin\AppData\Local\Temp\c6c9ffc6046f64d9c62b72fb75b9ee8c7fdfdafef86582fbf9291cbe6e9bdc04.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4888173.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4888173.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3517165.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3517165.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9313679.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9313679.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4003602.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4003602.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:1952
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3004
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:3400
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:4332
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2036
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:2256
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:3188
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4708
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s3472643.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s3472643.exe3⤵
- Executes dropped EXE
PID:4500
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:2364
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:1888
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:2004
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3248
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD52cbcd5910b9457f6d9f8a172f784d80a
SHA1425f627d1dcc61597166ea2c5f76038bde252d35
SHA256e13c6aad1b94e1a2858e437b9e42a709080d983871505acbe886476d941eb0d8
SHA5122ede8323f9207bf7b7d7fbced05bddd3bc979f3d7183050a2eb6dbc42b8af511197b86cf5aea2e58c9fe30c3ce322a279627f8661fcb2740a036565887c2b85a
-
Filesize
433KB
MD52cbcd5910b9457f6d9f8a172f784d80a
SHA1425f627d1dcc61597166ea2c5f76038bde252d35
SHA256e13c6aad1b94e1a2858e437b9e42a709080d983871505acbe886476d941eb0d8
SHA5122ede8323f9207bf7b7d7fbced05bddd3bc979f3d7183050a2eb6dbc42b8af511197b86cf5aea2e58c9fe30c3ce322a279627f8661fcb2740a036565887c2b85a
-
Filesize
175KB
MD5400e8f854733d6a1a1054d3b21e512c9
SHA1b6eeea45533c775f558a2eac7baacd49fb8eb5dd
SHA25616b12e37b6ced2e639e8781b5323fef2f4743c517bf05d4a0863ce8868d3f76a
SHA51246c12027c110ac9468328564026d654326746c6e23f410f258607c49c5f36b25db3e1afa38d3d1a532b42faaee2e663ab51fd4d67e0d3df1ed0302d6299dee20
-
Filesize
175KB
MD5400e8f854733d6a1a1054d3b21e512c9
SHA1b6eeea45533c775f558a2eac7baacd49fb8eb5dd
SHA25616b12e37b6ced2e639e8781b5323fef2f4743c517bf05d4a0863ce8868d3f76a
SHA51246c12027c110ac9468328564026d654326746c6e23f410f258607c49c5f36b25db3e1afa38d3d1a532b42faaee2e663ab51fd4d67e0d3df1ed0302d6299dee20
-
Filesize
277KB
MD5aff5b2414152cb6a0e66a1f164e8e7b2
SHA1c569a703fa8e44a16314923585bbf8381567b68e
SHA25682c025297e26de0d1c748b50c8dae17d169ad1eede38d176ad1f604ebfc7588c
SHA512fbd8f143f091f08417e2927ef35ae882af1ca7891cd4d197513179849ffc46e03639c24d55f41cf8c1716596df4db4757e32a57aa2e7854813ec97b648423b6c
-
Filesize
277KB
MD5aff5b2414152cb6a0e66a1f164e8e7b2
SHA1c569a703fa8e44a16314923585bbf8381567b68e
SHA25682c025297e26de0d1c748b50c8dae17d169ad1eede38d176ad1f604ebfc7588c
SHA512fbd8f143f091f08417e2927ef35ae882af1ca7891cd4d197513179849ffc46e03639c24d55f41cf8c1716596df4db4757e32a57aa2e7854813ec97b648423b6c
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5