Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
08/08/2023, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe
Resource
win10-20230703-en
General
-
Target
adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe
-
Size
556KB
-
MD5
ded289a5745b67e83176eb278da14a4d
-
SHA1
fc12c999f035b96d310155d3d9fe352c43c472dd
-
SHA256
adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2
-
SHA512
6400cd1c9bbd87fb8b55aaf64505cf0724faa13b605fe6b1b569bb3900f17de1a1fe2bc8e7eb4216fa446958de24ddb2bdca4e542cd3c6007068cfb173c5b002
-
SSDEEP
12288:mMr2y90RYAeOWAGCaK0wIFHlSYfwoDWngBYCXNQUpIIv0NR4uV:UySxeDAGvKD00YRPzGUqg0NfV
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Extracted
redline
dodge
77.91.124.156:19071
-
auth_value
3372223e987be2a16148c072df30163d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000600000001afb4-149.dat healer behavioral1/files/0x000600000001afb4-150.dat healer behavioral1/memory/3812-151-0x0000000000930000-0x000000000093A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h5889995.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h5889995.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h5889995.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h5889995.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h5889995.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
pid Process 4892 x7684491.exe 1816 x4976479.exe 2884 g4652801.exe 808 pdates.exe 3812 h5889995.exe 2536 i6083797.exe 4296 pdates.exe -
Loads dropped DLL 1 IoCs
pid Process 204 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h5889995.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x7684491.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x4976479.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3812 h5889995.exe 3812 h5889995.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3812 h5889995.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 g4652801.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4804 wrote to memory of 4892 4804 adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe 70 PID 4804 wrote to memory of 4892 4804 adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe 70 PID 4804 wrote to memory of 4892 4804 adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe 70 PID 4892 wrote to memory of 1816 4892 x7684491.exe 71 PID 4892 wrote to memory of 1816 4892 x7684491.exe 71 PID 4892 wrote to memory of 1816 4892 x7684491.exe 71 PID 1816 wrote to memory of 2884 1816 x4976479.exe 72 PID 1816 wrote to memory of 2884 1816 x4976479.exe 72 PID 1816 wrote to memory of 2884 1816 x4976479.exe 72 PID 2884 wrote to memory of 808 2884 g4652801.exe 73 PID 2884 wrote to memory of 808 2884 g4652801.exe 73 PID 2884 wrote to memory of 808 2884 g4652801.exe 73 PID 1816 wrote to memory of 3812 1816 x4976479.exe 74 PID 1816 wrote to memory of 3812 1816 x4976479.exe 74 PID 808 wrote to memory of 4920 808 pdates.exe 75 PID 808 wrote to memory of 4920 808 pdates.exe 75 PID 808 wrote to memory of 4920 808 pdates.exe 75 PID 808 wrote to memory of 2112 808 pdates.exe 77 PID 808 wrote to memory of 2112 808 pdates.exe 77 PID 808 wrote to memory of 2112 808 pdates.exe 77 PID 2112 wrote to memory of 2408 2112 cmd.exe 79 PID 2112 wrote to memory of 2408 2112 cmd.exe 79 PID 2112 wrote to memory of 2408 2112 cmd.exe 79 PID 2112 wrote to memory of 1100 2112 cmd.exe 80 PID 2112 wrote to memory of 1100 2112 cmd.exe 80 PID 2112 wrote to memory of 1100 2112 cmd.exe 80 PID 2112 wrote to memory of 4884 2112 cmd.exe 81 PID 2112 wrote to memory of 4884 2112 cmd.exe 81 PID 2112 wrote to memory of 4884 2112 cmd.exe 81 PID 2112 wrote to memory of 224 2112 cmd.exe 82 PID 2112 wrote to memory of 224 2112 cmd.exe 82 PID 2112 wrote to memory of 224 2112 cmd.exe 82 PID 2112 wrote to memory of 168 2112 cmd.exe 83 PID 2112 wrote to memory of 168 2112 cmd.exe 83 PID 2112 wrote to memory of 168 2112 cmd.exe 83 PID 2112 wrote to memory of 936 2112 cmd.exe 84 PID 2112 wrote to memory of 936 2112 cmd.exe 84 PID 2112 wrote to memory of 936 2112 cmd.exe 84 PID 4892 wrote to memory of 2536 4892 x7684491.exe 85 PID 4892 wrote to memory of 2536 4892 x7684491.exe 85 PID 4892 wrote to memory of 2536 4892 x7684491.exe 85 PID 808 wrote to memory of 204 808 pdates.exe 86 PID 808 wrote to memory of 204 808 pdates.exe 86 PID 808 wrote to memory of 204 808 pdates.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe"C:\Users\Admin\AppData\Local\Temp\adb12fa36096ae8a17af4e6215acc371236db5e167655ac8db8483357c1ad4c2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7684491.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7684491.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4976479.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4976479.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4652801.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4652801.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F6⤵
- Creates scheduled task(s)
PID:4920
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2408
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"7⤵PID:1100
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E7⤵PID:4884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:224
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"7⤵PID:168
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E7⤵PID:936
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h5889995.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h5889995.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i6083797.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i6083797.exe3⤵
- Executes dropped EXE
PID:2536
-
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4296
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
390KB
MD5c2e20c35dffd79e12fef04f0bed9ad4e
SHA1fab9aadb9e13466332e5169e09a9c563ffa0a8c4
SHA25626c4b42f645acd12df177c1acaa9d0002dc7b9c07bae8e2901503fe260481542
SHA512077599c8b89f4e45d818d73d8d4544e3da42895d2afe5a9650ff122bb96b942a12e3a12eabfc7c361c022b73ca7ade2c338aee119d08c4e95d75228c2531697e
-
Filesize
390KB
MD5c2e20c35dffd79e12fef04f0bed9ad4e
SHA1fab9aadb9e13466332e5169e09a9c563ffa0a8c4
SHA25626c4b42f645acd12df177c1acaa9d0002dc7b9c07bae8e2901503fe260481542
SHA512077599c8b89f4e45d818d73d8d4544e3da42895d2afe5a9650ff122bb96b942a12e3a12eabfc7c361c022b73ca7ade2c338aee119d08c4e95d75228c2531697e
-
Filesize
177KB
MD5a5e922385eacb1ef0f3c58f67977ae45
SHA1bf8ad407f677353f4a806367134a3f688c09d397
SHA256bdaddbf7a13392abda231c3989f6eec8611381dfbff992e05bc9f1dff89ab04a
SHA512d9b10d77dda926911707dcf3eb35399b3c350383b531f7eb208bbd35437b8d17d237dc6681ffa40d7e08b803e852a6df2a2e72548c5228c11894f6d34a5af1a1
-
Filesize
177KB
MD5a5e922385eacb1ef0f3c58f67977ae45
SHA1bf8ad407f677353f4a806367134a3f688c09d397
SHA256bdaddbf7a13392abda231c3989f6eec8611381dfbff992e05bc9f1dff89ab04a
SHA512d9b10d77dda926911707dcf3eb35399b3c350383b531f7eb208bbd35437b8d17d237dc6681ffa40d7e08b803e852a6df2a2e72548c5228c11894f6d34a5af1a1
-
Filesize
234KB
MD561eba9c72afd99272af9ab46ad70d67b
SHA1bfc59c2605e942d733e9dba4fb0f0705a9e0c1a9
SHA256829936807e59197e734409d2fb996052d4132d49d6091b7d8cc5348d6fb2bf9d
SHA512e1d66b67ddba439a2ba69d12ab73ed79054c1436c8ffd264208fd1d329b30312f10adf80f21ad0dcb6bc93c674d209fca802680d0a2c7e98f10628b1871fdb71
-
Filesize
234KB
MD561eba9c72afd99272af9ab46ad70d67b
SHA1bfc59c2605e942d733e9dba4fb0f0705a9e0c1a9
SHA256829936807e59197e734409d2fb996052d4132d49d6091b7d8cc5348d6fb2bf9d
SHA512e1d66b67ddba439a2ba69d12ab73ed79054c1436c8ffd264208fd1d329b30312f10adf80f21ad0dcb6bc93c674d209fca802680d0a2c7e98f10628b1871fdb71
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
273B
MD59851b884bf4aadfade57d911a3f03332
SHA1aaadd1c1856c22844bb9fbb030cf4f586ed8866a
SHA25603afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f
SHA512a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34