Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 12:22
Static task
static1
Behavioral task
behavioral1
Sample
5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe
Resource
win10v2004-20230703-en
General
-
Target
5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe
-
Size
560KB
-
MD5
8ca7941073ffd7cf0b1619a59f2c9b64
-
SHA1
624de254a18e185cd0d2c5ba926e66e3992fba35
-
SHA256
5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06
-
SHA512
ffe700354fbc9297c7d2f43377fbcdab06c51157565b01fe69ad7e90b18801a9979b44800072f50bdc92150ad1438a1af703b63bf8e3f5813b6ec8a76d551901
-
SSDEEP
12288:jMrky908uVZICTmg9YZNgrfIsdHNOxVTndQ3XaoBjY:LyAwiHINgrXdtOzTndqO
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
savin
77.91.124.156:19071
-
auth_value
a1a05b810428195ab7bb63b132ea0c8d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x0007000000023087-152.dat healer behavioral1/files/0x0007000000023087-153.dat healer behavioral1/memory/1544-154-0x0000000000A90000-0x0000000000A9A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p1583746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p1583746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p1583746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p1583746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p1583746.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p1583746.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3696 z1826080.exe 1112 z9339394.exe 1544 p1583746.exe 1376 r8965773.exe 1416 legosa.exe 392 s8048081.exe 4276 legosa.exe 4408 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 4268 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1583746.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1826080.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9339394.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1088 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1544 p1583746.exe 1544 p1583746.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1544 p1583746.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3472 wrote to memory of 3696 3472 5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe 81 PID 3472 wrote to memory of 3696 3472 5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe 81 PID 3472 wrote to memory of 3696 3472 5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe 81 PID 3696 wrote to memory of 1112 3696 z1826080.exe 82 PID 3696 wrote to memory of 1112 3696 z1826080.exe 82 PID 3696 wrote to memory of 1112 3696 z1826080.exe 82 PID 1112 wrote to memory of 1544 1112 z9339394.exe 83 PID 1112 wrote to memory of 1544 1112 z9339394.exe 83 PID 1112 wrote to memory of 1376 1112 z9339394.exe 90 PID 1112 wrote to memory of 1376 1112 z9339394.exe 90 PID 1112 wrote to memory of 1376 1112 z9339394.exe 90 PID 1376 wrote to memory of 1416 1376 r8965773.exe 93 PID 1376 wrote to memory of 1416 1376 r8965773.exe 93 PID 1376 wrote to memory of 1416 1376 r8965773.exe 93 PID 3696 wrote to memory of 392 3696 z1826080.exe 94 PID 3696 wrote to memory of 392 3696 z1826080.exe 94 PID 3696 wrote to memory of 392 3696 z1826080.exe 94 PID 1416 wrote to memory of 1088 1416 legosa.exe 95 PID 1416 wrote to memory of 1088 1416 legosa.exe 95 PID 1416 wrote to memory of 1088 1416 legosa.exe 95 PID 1416 wrote to memory of 3816 1416 legosa.exe 98 PID 1416 wrote to memory of 3816 1416 legosa.exe 98 PID 1416 wrote to memory of 3816 1416 legosa.exe 98 PID 3816 wrote to memory of 4340 3816 cmd.exe 100 PID 3816 wrote to memory of 4340 3816 cmd.exe 100 PID 3816 wrote to memory of 4340 3816 cmd.exe 100 PID 3816 wrote to memory of 1644 3816 cmd.exe 101 PID 3816 wrote to memory of 1644 3816 cmd.exe 101 PID 3816 wrote to memory of 1644 3816 cmd.exe 101 PID 3816 wrote to memory of 4788 3816 cmd.exe 102 PID 3816 wrote to memory of 4788 3816 cmd.exe 102 PID 3816 wrote to memory of 4788 3816 cmd.exe 102 PID 3816 wrote to memory of 3412 3816 cmd.exe 103 PID 3816 wrote to memory of 3412 3816 cmd.exe 103 PID 3816 wrote to memory of 3412 3816 cmd.exe 103 PID 3816 wrote to memory of 3524 3816 cmd.exe 104 PID 3816 wrote to memory of 3524 3816 cmd.exe 104 PID 3816 wrote to memory of 3524 3816 cmd.exe 104 PID 3816 wrote to memory of 1256 3816 cmd.exe 105 PID 3816 wrote to memory of 1256 3816 cmd.exe 105 PID 3816 wrote to memory of 1256 3816 cmd.exe 105 PID 1416 wrote to memory of 4268 1416 legosa.exe 108 PID 1416 wrote to memory of 4268 1416 legosa.exe 108 PID 1416 wrote to memory of 4268 1416 legosa.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe"C:\Users\Admin\AppData\Local\Temp\5ea21cc37933023788868a4a35c9efd5add4bdad333e17ca5ef4c9ad7a155c06.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1826080.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1826080.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9339394.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9339394.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1583746.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p1583746.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8965773.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8965773.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:1088
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4340
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:1644
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:4788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3412
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:3524
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:1256
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4268
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8048081.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s8048081.exe3⤵
- Executes dropped EXE
PID:392
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4276
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4408
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD5dda331fb8001a115512dc93a1ff0f2ac
SHA176d45c5ed4951525976e87893df3598ac484d2db
SHA2563a7d6360cbca03e4ff1c146d20ecb986b67cf80856d10957756852ef95a41644
SHA512e7937b9bfaca63dfe4f5a1d8606df6ed89f51119f0687176336414c600867ea444c7fe1f804f7d1597287da6fa9c75bd5e8f3c1f437fbba3420d755dde001092
-
Filesize
432KB
MD5dda331fb8001a115512dc93a1ff0f2ac
SHA176d45c5ed4951525976e87893df3598ac484d2db
SHA2563a7d6360cbca03e4ff1c146d20ecb986b67cf80856d10957756852ef95a41644
SHA512e7937b9bfaca63dfe4f5a1d8606df6ed89f51119f0687176336414c600867ea444c7fe1f804f7d1597287da6fa9c75bd5e8f3c1f437fbba3420d755dde001092
-
Filesize
175KB
MD540c5d22a386a8eec48452275221bd265
SHA1a151da1aaa67b2d975fed20d6b8c03c20a63e3a6
SHA2567588ebae5cb6bda443150de4dfa8e31b0347587723ac031f8fd244641057ef2b
SHA5120a0da5b0f58f639ba8df9949ec343be91e34961d4c8170687a6affca563d7520cdc1cac3a21b45dd96eec8937f364cc44f7d6fa9c9a12f871605e424b5ce4eb6
-
Filesize
175KB
MD540c5d22a386a8eec48452275221bd265
SHA1a151da1aaa67b2d975fed20d6b8c03c20a63e3a6
SHA2567588ebae5cb6bda443150de4dfa8e31b0347587723ac031f8fd244641057ef2b
SHA5120a0da5b0f58f639ba8df9949ec343be91e34961d4c8170687a6affca563d7520cdc1cac3a21b45dd96eec8937f364cc44f7d6fa9c9a12f871605e424b5ce4eb6
-
Filesize
277KB
MD575d01d99ab7fb151c15614923360cce7
SHA19c5f73ee759a53be619526c16f2955485fd3ef55
SHA256f83c22daff6c6bf6a1d11f58ca00d097b03bf9cad4458a7d5d8118c00d4c2715
SHA512b1f10c7da0c3d721f276be4b8cfe621fa111ac7361468040e19c9d77b0a1d43707c5a525213c5ecc790efa2ec0c89a678ed433092e7b05c8e0ca308fcd1e0198
-
Filesize
277KB
MD575d01d99ab7fb151c15614923360cce7
SHA19c5f73ee759a53be619526c16f2955485fd3ef55
SHA256f83c22daff6c6bf6a1d11f58ca00d097b03bf9cad4458a7d5d8118c00d4c2715
SHA512b1f10c7da0c3d721f276be4b8cfe621fa111ac7361468040e19c9d77b0a1d43707c5a525213c5ecc790efa2ec0c89a678ed433092e7b05c8e0ca308fcd1e0198
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5