Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/08/2023, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe
Resource
win10-20230703-en
General
-
Target
fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe
-
Size
730KB
-
MD5
ded9222b1ec124c1e87242a648243106
-
SHA1
0768c81a1fe04c35b35583b9c3938c4dd6ca5bdb
-
SHA256
fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5
-
SHA512
04c06883c436a57f21bc76189aa4b96126ee34dcb0f01541fbe9034a4d068629e6a4dab1552252a1b453608a47a294991e70e3a0922b6bfdb163e83ad5c89f67
-
SSDEEP
12288:8Mr+y90NB8lyIRUbAL8GuF5KVG7FKZ+e7llcKRRDXVp752KBksUVfh:SygB8AYraSGpSl7l+KTD3Afh
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
maga
77.91.124.54:19071
-
auth_value
9dd7a0be219be9b6228dc9b4e112b812
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000600000001afe9-152.dat healer behavioral1/files/0x000600000001afe9-153.dat healer behavioral1/memory/2084-154-0x0000000000EE0000-0x0000000000EEA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h0659142.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h0659142.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h0659142.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h0659142.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h0659142.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3420 x6395297.exe 4884 x5138591.exe 4940 x7883852.exe 1224 g6205653.exe 2660 saves.exe 2084 h0659142.exe 2792 i8467457.exe 1188 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4932 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h0659142.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x6395297.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x5138591.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x7883852.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2084 h0659142.exe 2084 h0659142.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2084 h0659142.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3420 4472 fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe 70 PID 4472 wrote to memory of 3420 4472 fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe 70 PID 4472 wrote to memory of 3420 4472 fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe 70 PID 3420 wrote to memory of 4884 3420 x6395297.exe 71 PID 3420 wrote to memory of 4884 3420 x6395297.exe 71 PID 3420 wrote to memory of 4884 3420 x6395297.exe 71 PID 4884 wrote to memory of 4940 4884 x5138591.exe 72 PID 4884 wrote to memory of 4940 4884 x5138591.exe 72 PID 4884 wrote to memory of 4940 4884 x5138591.exe 72 PID 4940 wrote to memory of 1224 4940 x7883852.exe 73 PID 4940 wrote to memory of 1224 4940 x7883852.exe 73 PID 4940 wrote to memory of 1224 4940 x7883852.exe 73 PID 1224 wrote to memory of 2660 1224 g6205653.exe 74 PID 1224 wrote to memory of 2660 1224 g6205653.exe 74 PID 1224 wrote to memory of 2660 1224 g6205653.exe 74 PID 4940 wrote to memory of 2084 4940 x7883852.exe 75 PID 4940 wrote to memory of 2084 4940 x7883852.exe 75 PID 2660 wrote to memory of 1576 2660 saves.exe 76 PID 2660 wrote to memory of 1576 2660 saves.exe 76 PID 2660 wrote to memory of 1576 2660 saves.exe 76 PID 2660 wrote to memory of 620 2660 saves.exe 78 PID 2660 wrote to memory of 620 2660 saves.exe 78 PID 2660 wrote to memory of 620 2660 saves.exe 78 PID 620 wrote to memory of 2720 620 cmd.exe 80 PID 620 wrote to memory of 2720 620 cmd.exe 80 PID 620 wrote to memory of 2720 620 cmd.exe 80 PID 620 wrote to memory of 1884 620 cmd.exe 81 PID 620 wrote to memory of 1884 620 cmd.exe 81 PID 620 wrote to memory of 1884 620 cmd.exe 81 PID 620 wrote to memory of 196 620 cmd.exe 82 PID 620 wrote to memory of 196 620 cmd.exe 82 PID 620 wrote to memory of 196 620 cmd.exe 82 PID 620 wrote to memory of 5044 620 cmd.exe 83 PID 620 wrote to memory of 5044 620 cmd.exe 83 PID 620 wrote to memory of 5044 620 cmd.exe 83 PID 620 wrote to memory of 4392 620 cmd.exe 84 PID 620 wrote to memory of 4392 620 cmd.exe 84 PID 620 wrote to memory of 4392 620 cmd.exe 84 PID 620 wrote to memory of 4984 620 cmd.exe 85 PID 620 wrote to memory of 4984 620 cmd.exe 85 PID 620 wrote to memory of 4984 620 cmd.exe 85 PID 4884 wrote to memory of 2792 4884 x5138591.exe 86 PID 4884 wrote to memory of 2792 4884 x5138591.exe 86 PID 4884 wrote to memory of 2792 4884 x5138591.exe 86 PID 2660 wrote to memory of 4932 2660 saves.exe 88 PID 2660 wrote to memory of 4932 2660 saves.exe 88 PID 2660 wrote to memory of 4932 2660 saves.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe"C:\Users\Admin\AppData\Local\Temp\fd075d1012bfcaf42e4ba8ff15939ebc7026f16e3ade1477cf2d228ba5018ac5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6395297.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6395297.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5138591.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5138591.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7883852.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7883852.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g6205653.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g6205653.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:1576
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2720
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:1884
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:5044
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:4392
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4984
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4932
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h0659142.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h0659142.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8467457.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8467457.exe4⤵
- Executes dropped EXE
PID:2792
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1188
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597KB
MD57d3991d810560833f4f9730252b4a1a1
SHA1ad216b3dd1064f4446481874a2359d57f97f7894
SHA2560471f185df92635659fcc327e7e486325eff369cc63ae6145869bc39b2c7fde4
SHA512732e17ce6b4ba577ee61fc83f3822dec6c2f95f0003f085efc482192a5804f7e9eaebb04fb21495dd6702e2c3784963e4309d7989795edb72b8ac257ce897b35
-
Filesize
597KB
MD57d3991d810560833f4f9730252b4a1a1
SHA1ad216b3dd1064f4446481874a2359d57f97f7894
SHA2560471f185df92635659fcc327e7e486325eff369cc63ae6145869bc39b2c7fde4
SHA512732e17ce6b4ba577ee61fc83f3822dec6c2f95f0003f085efc482192a5804f7e9eaebb04fb21495dd6702e2c3784963e4309d7989795edb72b8ac257ce897b35
-
Filesize
432KB
MD5da6b20ef26bb1bfc45d32fee887a29d9
SHA1365015ac62187c9219aeee76254254685fc12bca
SHA256a4cc5f2765685ea4c21d7154e96ff560d08d368a367bd39e4aec4db4c080d04a
SHA51255e907b2fc5018ab1a2d23dc2297af53b4b8c418186ce8dc98e9400ef692cd247822bddc79b2878e286e8d259e90f38cd2467fba02777efa451ba55d0c7aa9db
-
Filesize
432KB
MD5da6b20ef26bb1bfc45d32fee887a29d9
SHA1365015ac62187c9219aeee76254254685fc12bca
SHA256a4cc5f2765685ea4c21d7154e96ff560d08d368a367bd39e4aec4db4c080d04a
SHA51255e907b2fc5018ab1a2d23dc2297af53b4b8c418186ce8dc98e9400ef692cd247822bddc79b2878e286e8d259e90f38cd2467fba02777efa451ba55d0c7aa9db
-
Filesize
174KB
MD5bf0fd4e71108e93494e95a241138b453
SHA14da4ba48a20e1113a595eaa1aab012e8a425e970
SHA256dc29ba68388d07e4930b8bb81b2a4f0d9031d297e1f11235011eb386739290eb
SHA512b1aa93916636e5924f484454d82a077f7e03a0ed91c6bc523a4d3aeb025550bc7072e171c562a7c3839e6c256123aa98285a281e7fc8a73c52d2675437740575
-
Filesize
174KB
MD5bf0fd4e71108e93494e95a241138b453
SHA14da4ba48a20e1113a595eaa1aab012e8a425e970
SHA256dc29ba68388d07e4930b8bb81b2a4f0d9031d297e1f11235011eb386739290eb
SHA512b1aa93916636e5924f484454d82a077f7e03a0ed91c6bc523a4d3aeb025550bc7072e171c562a7c3839e6c256123aa98285a281e7fc8a73c52d2675437740575
-
Filesize
276KB
MD52fb8714ba0d0deee00c315d3f5c967f8
SHA17c1adfa78d494b4f773e14836de54d8a0667437c
SHA25665835c278b03eec46680840e1a52c762915b6da8fce0f6c14018a11d1b57275d
SHA512e9d09f8858cbc821ad54e24939fd59660720751c35ea17167a42e607662c2b9d97989348a505eb8547a8b934a83d4851702bce334b3e7b81ff9a0abda2cc476f
-
Filesize
276KB
MD52fb8714ba0d0deee00c315d3f5c967f8
SHA17c1adfa78d494b4f773e14836de54d8a0667437c
SHA25665835c278b03eec46680840e1a52c762915b6da8fce0f6c14018a11d1b57275d
SHA512e9d09f8858cbc821ad54e24939fd59660720751c35ea17167a42e607662c2b9d97989348a505eb8547a8b934a83d4851702bce334b3e7b81ff9a0abda2cc476f
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b