Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/08/2023, 23:03
Behavioral task
behavioral1
Sample
0x000600000001b004-150.exe
Resource
win7-20230712-en
General
-
Target
0x000600000001b004-150.exe
-
Size
226KB
-
MD5
c6270071dfcb3d167956b9ab583a8fac
-
SHA1
a84dfacedfc66188e239415948cd669badf7001a
-
SHA256
7a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
-
SHA512
ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
SSDEEP
3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2400 pdates.exe 3060 pdates.exe 2224 pdates.exe -
Loads dropped DLL 5 IoCs
pid Process 2208 0x000600000001b004-150.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2512 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 0x000600000001b004-150.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2400 2208 0x000600000001b004-150.exe 28 PID 2208 wrote to memory of 2400 2208 0x000600000001b004-150.exe 28 PID 2208 wrote to memory of 2400 2208 0x000600000001b004-150.exe 28 PID 2208 wrote to memory of 2400 2208 0x000600000001b004-150.exe 28 PID 2400 wrote to memory of 2512 2400 pdates.exe 29 PID 2400 wrote to memory of 2512 2400 pdates.exe 29 PID 2400 wrote to memory of 2512 2400 pdates.exe 29 PID 2400 wrote to memory of 2512 2400 pdates.exe 29 PID 2400 wrote to memory of 2872 2400 pdates.exe 31 PID 2400 wrote to memory of 2872 2400 pdates.exe 31 PID 2400 wrote to memory of 2872 2400 pdates.exe 31 PID 2400 wrote to memory of 2872 2400 pdates.exe 31 PID 2872 wrote to memory of 3008 2872 cmd.exe 33 PID 2872 wrote to memory of 3008 2872 cmd.exe 33 PID 2872 wrote to memory of 3008 2872 cmd.exe 33 PID 2872 wrote to memory of 3008 2872 cmd.exe 33 PID 2872 wrote to memory of 2956 2872 cmd.exe 34 PID 2872 wrote to memory of 2956 2872 cmd.exe 34 PID 2872 wrote to memory of 2956 2872 cmd.exe 34 PID 2872 wrote to memory of 2956 2872 cmd.exe 34 PID 2872 wrote to memory of 2832 2872 cmd.exe 35 PID 2872 wrote to memory of 2832 2872 cmd.exe 35 PID 2872 wrote to memory of 2832 2872 cmd.exe 35 PID 2872 wrote to memory of 2832 2872 cmd.exe 35 PID 2872 wrote to memory of 2024 2872 cmd.exe 37 PID 2872 wrote to memory of 2024 2872 cmd.exe 37 PID 2872 wrote to memory of 2024 2872 cmd.exe 37 PID 2872 wrote to memory of 2024 2872 cmd.exe 37 PID 2872 wrote to memory of 2944 2872 cmd.exe 36 PID 2872 wrote to memory of 2944 2872 cmd.exe 36 PID 2872 wrote to memory of 2944 2872 cmd.exe 36 PID 2872 wrote to memory of 2944 2872 cmd.exe 36 PID 2872 wrote to memory of 2928 2872 cmd.exe 38 PID 2872 wrote to memory of 2928 2872 cmd.exe 38 PID 2872 wrote to memory of 2928 2872 cmd.exe 38 PID 2872 wrote to memory of 2928 2872 cmd.exe 38 PID 820 wrote to memory of 3060 820 taskeng.exe 43 PID 820 wrote to memory of 3060 820 taskeng.exe 43 PID 820 wrote to memory of 3060 820 taskeng.exe 43 PID 820 wrote to memory of 3060 820 taskeng.exe 43 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 2400 wrote to memory of 1708 2400 pdates.exe 44 PID 820 wrote to memory of 2224 820 taskeng.exe 45 PID 820 wrote to memory of 2224 820 taskeng.exe 45 PID 820 wrote to memory of 2224 820 taskeng.exe 45 PID 820 wrote to memory of 2224 820 taskeng.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000600000001b004-150.exe"C:\Users\Admin\AppData\Local\Temp\0x000600000001b004-150.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F3⤵
- Creates scheduled task(s)
PID:2512
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:3008
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"4⤵PID:2956
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E4⤵PID:2832
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"4⤵PID:2944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2024
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E4⤵PID:2928
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:1708
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {796E33CD-1F8D-435F-B8C1-5246143809BF} S-1-5-21-4219371764-2579186923-3390623117-1000:NVACMPYA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe2⤵
- Executes dropped EXE
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe2⤵
- Executes dropped EXE
PID:2224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD5c6270071dfcb3d167956b9ab583a8fac
SHA1a84dfacedfc66188e239415948cd669badf7001a
SHA2567a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
SHA512ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
Filesize
226KB
MD5c6270071dfcb3d167956b9ab583a8fac
SHA1a84dfacedfc66188e239415948cd669badf7001a
SHA2567a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
SHA512ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
Filesize
226KB
MD5c6270071dfcb3d167956b9ab583a8fac
SHA1a84dfacedfc66188e239415948cd669badf7001a
SHA2567a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
SHA512ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
Filesize
226KB
MD5c6270071dfcb3d167956b9ab583a8fac
SHA1a84dfacedfc66188e239415948cd669badf7001a
SHA2567a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
SHA512ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
Filesize
226KB
MD5c6270071dfcb3d167956b9ab583a8fac
SHA1a84dfacedfc66188e239415948cd669badf7001a
SHA2567a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
SHA512ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
273B
MD59851b884bf4aadfade57d911a3f03332
SHA1aaadd1c1856c22844bb9fbb030cf4f586ed8866a
SHA25603afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f
SHA512a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327
-
Filesize
226KB
MD5c6270071dfcb3d167956b9ab583a8fac
SHA1a84dfacedfc66188e239415948cd669badf7001a
SHA2567a258db39fc1ad859df2dc060b5c37195680256e636fc64cd4751faaff91e2b2
SHA512ffbc1c09e9dbd7e325d26e254affeece3c181ea15aebe79265e2ac9fb8e2b78315fe7129e68fd10ede92112df9458b1a9bca5237454ea8cfcaf332cbec1309e4
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34