Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/08/2023, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe
Resource
win10-20230703-en
General
-
Target
8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe
-
Size
730KB
-
MD5
ba41598209ef18502cabb04517cd9488
-
SHA1
6dba18626f5f26d163ed9d518b6577928ba1e5c6
-
SHA256
8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75
-
SHA512
fd5e9cc62a312b2b907da4c95113bbfc802f38b98dcd7b3b37c94f19fea8dd692feec81d89f2e38b39ad11f8398a04cd347b92149b3c549c7d2ea251bc939425
-
SSDEEP
12288:xMrMy90ymvugFRAKagkasDe876e0WI6A2X8ko6fJSp6ZkoDgQaQGae8C0ZnGu:9yKnnvkrx76TWIutoGJSpu/gQw0ZnGu
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
maga
77.91.124.54:19071
-
auth_value
9dd7a0be219be9b6228dc9b4e112b812
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001afe6-143.dat healer behavioral1/files/0x000700000001afe6-144.dat healer behavioral1/memory/1224-145-0x0000000000940000-0x000000000094A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l1435791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l1435791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l1435791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l1435791.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l1435791.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3420 y1180265.exe 4884 y5885302.exe 4940 y3495872.exe 1224 l1435791.exe 5036 m3765817.exe 4628 saves.exe 4736 n0248883.exe 4484 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 2980 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" l1435791.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y3495872.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1180265.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y5885302.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1572 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1224 l1435791.exe 1224 l1435791.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1224 l1435791.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3420 4472 8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe 70 PID 4472 wrote to memory of 3420 4472 8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe 70 PID 4472 wrote to memory of 3420 4472 8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe 70 PID 3420 wrote to memory of 4884 3420 y1180265.exe 71 PID 3420 wrote to memory of 4884 3420 y1180265.exe 71 PID 3420 wrote to memory of 4884 3420 y1180265.exe 71 PID 4884 wrote to memory of 4940 4884 y5885302.exe 72 PID 4884 wrote to memory of 4940 4884 y5885302.exe 72 PID 4884 wrote to memory of 4940 4884 y5885302.exe 72 PID 4940 wrote to memory of 1224 4940 y3495872.exe 73 PID 4940 wrote to memory of 1224 4940 y3495872.exe 73 PID 4940 wrote to memory of 5036 4940 y3495872.exe 74 PID 4940 wrote to memory of 5036 4940 y3495872.exe 74 PID 4940 wrote to memory of 5036 4940 y3495872.exe 74 PID 5036 wrote to memory of 4628 5036 m3765817.exe 75 PID 5036 wrote to memory of 4628 5036 m3765817.exe 75 PID 5036 wrote to memory of 4628 5036 m3765817.exe 75 PID 4884 wrote to memory of 4736 4884 y5885302.exe 76 PID 4884 wrote to memory of 4736 4884 y5885302.exe 76 PID 4884 wrote to memory of 4736 4884 y5885302.exe 76 PID 4628 wrote to memory of 1572 4628 saves.exe 77 PID 4628 wrote to memory of 1572 4628 saves.exe 77 PID 4628 wrote to memory of 1572 4628 saves.exe 77 PID 4628 wrote to memory of 828 4628 saves.exe 79 PID 4628 wrote to memory of 828 4628 saves.exe 79 PID 4628 wrote to memory of 828 4628 saves.exe 79 PID 828 wrote to memory of 4900 828 cmd.exe 81 PID 828 wrote to memory of 4900 828 cmd.exe 81 PID 828 wrote to memory of 4900 828 cmd.exe 81 PID 828 wrote to memory of 696 828 cmd.exe 82 PID 828 wrote to memory of 696 828 cmd.exe 82 PID 828 wrote to memory of 696 828 cmd.exe 82 PID 828 wrote to memory of 4636 828 cmd.exe 83 PID 828 wrote to memory of 4636 828 cmd.exe 83 PID 828 wrote to memory of 4636 828 cmd.exe 83 PID 828 wrote to memory of 2792 828 cmd.exe 84 PID 828 wrote to memory of 2792 828 cmd.exe 84 PID 828 wrote to memory of 2792 828 cmd.exe 84 PID 828 wrote to memory of 3632 828 cmd.exe 85 PID 828 wrote to memory of 3632 828 cmd.exe 85 PID 828 wrote to memory of 3632 828 cmd.exe 85 PID 828 wrote to memory of 3488 828 cmd.exe 86 PID 828 wrote to memory of 3488 828 cmd.exe 86 PID 828 wrote to memory of 3488 828 cmd.exe 86 PID 4628 wrote to memory of 2980 4628 saves.exe 88 PID 4628 wrote to memory of 2980 4628 saves.exe 88 PID 4628 wrote to memory of 2980 4628 saves.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe"C:\Users\Admin\AppData\Local\Temp\8162a60710b5f5c29aaf10435ee357f7684936e650fe7e90771ffe859827ec75.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1180265.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1180265.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5885302.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5885302.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3495872.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3495872.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l1435791.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l1435791.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m3765817.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m3765817.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:1572
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4900
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:4636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2792
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3632
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:3488
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:2980
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0248883.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n0248883.exe4⤵
- Executes dropped EXE
PID:4736
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4484
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5bdcbee7150e952fdc143d673fd213036
SHA1073e814ab1faaf28d5cf51b63caac8b9a7b01997
SHA256682638bfc2ff7c7808163f186db54cb2003f5517f8ea7059a63c86ca63b9a490
SHA5121b5cb4097f71cfc7ede31dd4e5b8d7312ae6fcd5b866dfbf6138c0667d8bd50feea72ae01aaeb70a0a0f8bc6d3eee7ef04a183ab229ae0bdc163e66eff8f97d9
-
Filesize
599KB
MD5bdcbee7150e952fdc143d673fd213036
SHA1073e814ab1faaf28d5cf51b63caac8b9a7b01997
SHA256682638bfc2ff7c7808163f186db54cb2003f5517f8ea7059a63c86ca63b9a490
SHA5121b5cb4097f71cfc7ede31dd4e5b8d7312ae6fcd5b866dfbf6138c0667d8bd50feea72ae01aaeb70a0a0f8bc6d3eee7ef04a183ab229ae0bdc163e66eff8f97d9
-
Filesize
433KB
MD5dc6c6a1475ea683937fafd8f03e99b7c
SHA108211df80afba15f393c93fd7d882eb261fc5be9
SHA2564543bd9a51f00061f9ada0db4615e606e162492084df84eeecd2e6630355ba47
SHA512a05c449d94fb4a1baba5c61523a27368927060fa806650f1fef4e7a4081dba440890ee02ac0a746df7e644cc6c3fc53123ddeed4d73947dbaaad82b47eea5b8b
-
Filesize
433KB
MD5dc6c6a1475ea683937fafd8f03e99b7c
SHA108211df80afba15f393c93fd7d882eb261fc5be9
SHA2564543bd9a51f00061f9ada0db4615e606e162492084df84eeecd2e6630355ba47
SHA512a05c449d94fb4a1baba5c61523a27368927060fa806650f1fef4e7a4081dba440890ee02ac0a746df7e644cc6c3fc53123ddeed4d73947dbaaad82b47eea5b8b
-
Filesize
174KB
MD5c0ee3a62b7ebcdf9b096572cb9e961b7
SHA13cf447988bca1ae8272cacfca16f4f8561394de0
SHA256a00389179bf184b84c4a497d8083994302eb844388c0173b74a58feabd7d08a2
SHA512443da4b710e6825fc096b2d9d3ed3e758c58370ff48ae4b57c2c3aaee4d1999d000f8d41c3e83ee15ff43e341c20364c8b16d1ec63cd2ace99a198f28294ac7e
-
Filesize
174KB
MD5c0ee3a62b7ebcdf9b096572cb9e961b7
SHA13cf447988bca1ae8272cacfca16f4f8561394de0
SHA256a00389179bf184b84c4a497d8083994302eb844388c0173b74a58feabd7d08a2
SHA512443da4b710e6825fc096b2d9d3ed3e758c58370ff48ae4b57c2c3aaee4d1999d000f8d41c3e83ee15ff43e341c20364c8b16d1ec63cd2ace99a198f28294ac7e
-
Filesize
277KB
MD5282a44146c84812ff777eae993137acd
SHA117715ec8ba999dcf5f29009890de0b7f845076b8
SHA2563193418d2c0e685fed9168b10ca7f7596f5a56a5b85ef1634f71fe75e8ff266b
SHA51204ccfa1bfcc69808597474479e1d5f17c36664bc8da8ca101d8e7251e4cc2bf845337e1d1f4a3d0234f65b248e557868bd3102fad09c4577dc08f2455e89ae66
-
Filesize
277KB
MD5282a44146c84812ff777eae993137acd
SHA117715ec8ba999dcf5f29009890de0b7f845076b8
SHA2563193418d2c0e685fed9168b10ca7f7596f5a56a5b85ef1634f71fe75e8ff266b
SHA51204ccfa1bfcc69808597474479e1d5f17c36664bc8da8ca101d8e7251e4cc2bf845337e1d1f4a3d0234f65b248e557868bd3102fad09c4577dc08f2455e89ae66
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b