Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
21/08/2023, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe
Resource
win10-20230703-en
General
-
Target
40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe
-
Size
712KB
-
MD5
3edcf30897f4a6ce86dbc38e0043560a
-
SHA1
745090dc90b012e24548b27e0f079aa9b0add314
-
SHA256
40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d
-
SHA512
981de8eedaaf0a758c5d8a3085e8f17c3f13dc58680b87f0f98c1e40d8d63d0ee4d7aae8e13ff7d0f264300745093ff5d06d9d40a222d0eb9f7b4ee14400301a
-
SSDEEP
12288:1Mrty90KZ1zf5RpG9UFshBkvmYO6E3YKEoOdfQfHeDFfWRVN8RD:QypZBE+FEW+YO6AE5NRfWRVN8RD
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
lang
77.91.124.73:19071
-
auth_value
92c0fc2b7a8b3fc5a01baa1abf31c42a
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001afb9-146.dat healer behavioral1/files/0x000700000001afb9-147.dat healer behavioral1/memory/4628-148-0x0000000000580000-0x000000000058A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g9857327.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g9857327.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g9857327.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g9857327.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g9857327.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 4780 x3936602.exe 4612 x7790116.exe 1972 x7368997.exe 4628 g9857327.exe 1876 h2428433.exe 4724 saves.exe 2056 i6586553.exe 204 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 2168 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g9857327.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x3936602.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x7790116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x7368997.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4380 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4628 g9857327.exe 4628 g9857327.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4628 g9857327.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3256 wrote to memory of 4780 3256 40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe 69 PID 3256 wrote to memory of 4780 3256 40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe 69 PID 3256 wrote to memory of 4780 3256 40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe 69 PID 4780 wrote to memory of 4612 4780 x3936602.exe 70 PID 4780 wrote to memory of 4612 4780 x3936602.exe 70 PID 4780 wrote to memory of 4612 4780 x3936602.exe 70 PID 4612 wrote to memory of 1972 4612 x7790116.exe 71 PID 4612 wrote to memory of 1972 4612 x7790116.exe 71 PID 4612 wrote to memory of 1972 4612 x7790116.exe 71 PID 1972 wrote to memory of 4628 1972 x7368997.exe 72 PID 1972 wrote to memory of 4628 1972 x7368997.exe 72 PID 1972 wrote to memory of 1876 1972 x7368997.exe 73 PID 1972 wrote to memory of 1876 1972 x7368997.exe 73 PID 1972 wrote to memory of 1876 1972 x7368997.exe 73 PID 1876 wrote to memory of 4724 1876 h2428433.exe 74 PID 1876 wrote to memory of 4724 1876 h2428433.exe 74 PID 1876 wrote to memory of 4724 1876 h2428433.exe 74 PID 4612 wrote to memory of 2056 4612 x7790116.exe 75 PID 4612 wrote to memory of 2056 4612 x7790116.exe 75 PID 4612 wrote to memory of 2056 4612 x7790116.exe 75 PID 4724 wrote to memory of 4380 4724 saves.exe 76 PID 4724 wrote to memory of 4380 4724 saves.exe 76 PID 4724 wrote to memory of 4380 4724 saves.exe 76 PID 4724 wrote to memory of 5104 4724 saves.exe 78 PID 4724 wrote to memory of 5104 4724 saves.exe 78 PID 4724 wrote to memory of 5104 4724 saves.exe 78 PID 5104 wrote to memory of 4760 5104 cmd.exe 80 PID 5104 wrote to memory of 4760 5104 cmd.exe 80 PID 5104 wrote to memory of 4760 5104 cmd.exe 80 PID 5104 wrote to memory of 2456 5104 cmd.exe 81 PID 5104 wrote to memory of 2456 5104 cmd.exe 81 PID 5104 wrote to memory of 2456 5104 cmd.exe 81 PID 5104 wrote to memory of 1424 5104 cmd.exe 82 PID 5104 wrote to memory of 1424 5104 cmd.exe 82 PID 5104 wrote to memory of 1424 5104 cmd.exe 82 PID 5104 wrote to memory of 3736 5104 cmd.exe 83 PID 5104 wrote to memory of 3736 5104 cmd.exe 83 PID 5104 wrote to memory of 3736 5104 cmd.exe 83 PID 5104 wrote to memory of 4880 5104 cmd.exe 84 PID 5104 wrote to memory of 4880 5104 cmd.exe 84 PID 5104 wrote to memory of 4880 5104 cmd.exe 84 PID 5104 wrote to memory of 312 5104 cmd.exe 85 PID 5104 wrote to memory of 312 5104 cmd.exe 85 PID 5104 wrote to memory of 312 5104 cmd.exe 85 PID 4724 wrote to memory of 2168 4724 saves.exe 86 PID 4724 wrote to memory of 2168 4724 saves.exe 86 PID 4724 wrote to memory of 2168 4724 saves.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe"C:\Users\Admin\AppData\Local\Temp\40f32b67d0690509a81b423a871318b16cf57b1987076a70f36076c6200f151d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3936602.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3936602.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7790116.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7790116.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7368997.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7368997.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9857327.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9857327.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2428433.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2428433.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:4380
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4760
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2456
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:1424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3736
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:4880
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:312
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:2168
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6586553.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6586553.exe4⤵
- Executes dropped EXE
PID:2056
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:204
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5f9c2649ee1e50d367d5c59f3b01da285
SHA1a3b1fffb01a26df3d93ff58625d8636529c50e40
SHA256911e7cbf05e145c8ed85a0909d17678a9ddac5ad3cea0ff7fefc85c02d90b17b
SHA51244d67331062e056c1d3d5e36e8de0781f70f8f7a21c50c5743b1aa8b74240a3491166cf92c242e7c370d80a8f7e41ec44f659c78acde6aa9846696c50784baa3
-
Filesize
599KB
MD5f9c2649ee1e50d367d5c59f3b01da285
SHA1a3b1fffb01a26df3d93ff58625d8636529c50e40
SHA256911e7cbf05e145c8ed85a0909d17678a9ddac5ad3cea0ff7fefc85c02d90b17b
SHA51244d67331062e056c1d3d5e36e8de0781f70f8f7a21c50c5743b1aa8b74240a3491166cf92c242e7c370d80a8f7e41ec44f659c78acde6aa9846696c50784baa3
-
Filesize
433KB
MD54b14bb6e923dfa9932f91f119a55595e
SHA1c9c5e3774cf2edc75138db2e598e733ae009e6aa
SHA2565b346d4034b7380c53edc6a78982be66337f835f37c93a5e1bad6527d205972a
SHA5120b24ca69ddcb7429dc90689ae4db7eb079ebf71e392638ae5230fc9e0a197cb32b016e1ecf1d814fc85d8eea605b2b30006d2577a14382af836676f46fed17ca
-
Filesize
433KB
MD54b14bb6e923dfa9932f91f119a55595e
SHA1c9c5e3774cf2edc75138db2e598e733ae009e6aa
SHA2565b346d4034b7380c53edc6a78982be66337f835f37c93a5e1bad6527d205972a
SHA5120b24ca69ddcb7429dc90689ae4db7eb079ebf71e392638ae5230fc9e0a197cb32b016e1ecf1d814fc85d8eea605b2b30006d2577a14382af836676f46fed17ca
-
Filesize
174KB
MD5c0f5ac505663ecb49b3c18f167df31dd
SHA18fa19799bf884d21cd5d7679046bff4ccb750d81
SHA2564d1077a59e2c64ce4eeabc31efa7d700f5dd25d47d43bec56df29d9fe538e595
SHA5126ceb5c8ed0ba3cad0961f89541b7535c912755761d3b7a51d591812aad2c57abf974463c12ad18531838166dd7c48e6967894e721489048feebe4eee405b48be
-
Filesize
174KB
MD5c0f5ac505663ecb49b3c18f167df31dd
SHA18fa19799bf884d21cd5d7679046bff4ccb750d81
SHA2564d1077a59e2c64ce4eeabc31efa7d700f5dd25d47d43bec56df29d9fe538e595
SHA5126ceb5c8ed0ba3cad0961f89541b7535c912755761d3b7a51d591812aad2c57abf974463c12ad18531838166dd7c48e6967894e721489048feebe4eee405b48be
-
Filesize
277KB
MD5446eb2c30d4775f01f500a82e0cc87be
SHA1f343960140b64cb7a411e74d4b667f14bebe58c6
SHA256990e99c0fd6ebeb4e3d3748c78f5fc6e6c2a7b1d27f4c2b4747d32e0997b6893
SHA5122562331fdf9004cf9434c86c8be2641600d547d0e10dc6ced811aaf11eab83ccbfa73a11315caeaca71f8b7659af48780fdb5cd4ac907b8a783d888a3da7ec6b
-
Filesize
277KB
MD5446eb2c30d4775f01f500a82e0cc87be
SHA1f343960140b64cb7a411e74d4b667f14bebe58c6
SHA256990e99c0fd6ebeb4e3d3748c78f5fc6e6c2a7b1d27f4c2b4747d32e0997b6893
SHA5122562331fdf9004cf9434c86c8be2641600d547d0e10dc6ced811aaf11eab83ccbfa73a11315caeaca71f8b7659af48780fdb5cd4ac907b8a783d888a3da7ec6b
-
Filesize
11KB
MD5228a6331e7080324c6fb2033fd49d0ac
SHA1c656f156c7a56347b3a0a45e46171e9f2e9101c8
SHA256ae1712595adb8b5a82214b7cb12ccd0db4db71561adfb0b2742ca8aae824835d
SHA512756d1a2150180228ed165d5cd0573d0c989a4a5afe1d4f8a50b276b86a8463f97f4e5b01d1f241b8fa3d42268e0e02ca97b5fa9fcc783c0b5cfd5d9b2526afc3
-
Filesize
11KB
MD5228a6331e7080324c6fb2033fd49d0ac
SHA1c656f156c7a56347b3a0a45e46171e9f2e9101c8
SHA256ae1712595adb8b5a82214b7cb12ccd0db4db71561adfb0b2742ca8aae824835d
SHA512756d1a2150180228ed165d5cd0573d0c989a4a5afe1d4f8a50b276b86a8463f97f4e5b01d1f241b8fa3d42268e0e02ca97b5fa9fcc783c0b5cfd5d9b2526afc3
-
Filesize
314KB
MD52a3d6f1f7493570ac4f3b4c5e0e278f4
SHA1ee32ad0a7c1fb407fcfdcb5fb8e24a005d986b80
SHA256d7f69ca0675ea748d55d2f6e25b0f5748e043dc3ed70698d7cc007ad92ba5085
SHA51282b153b6738611fcb3eceb92eb4cf6d33b99489ebb0bf16e8930c2b9fbff91042ae58908758178dd15a443abf87c1ffe4f0e3ecffdc84c0d1fb9ffba115a3489
-
Filesize
314KB
MD52a3d6f1f7493570ac4f3b4c5e0e278f4
SHA1ee32ad0a7c1fb407fcfdcb5fb8e24a005d986b80
SHA256d7f69ca0675ea748d55d2f6e25b0f5748e043dc3ed70698d7cc007ad92ba5085
SHA51282b153b6738611fcb3eceb92eb4cf6d33b99489ebb0bf16e8930c2b9fbff91042ae58908758178dd15a443abf87c1ffe4f0e3ecffdc84c0d1fb9ffba115a3489
-
Filesize
314KB
MD52a3d6f1f7493570ac4f3b4c5e0e278f4
SHA1ee32ad0a7c1fb407fcfdcb5fb8e24a005d986b80
SHA256d7f69ca0675ea748d55d2f6e25b0f5748e043dc3ed70698d7cc007ad92ba5085
SHA51282b153b6738611fcb3eceb92eb4cf6d33b99489ebb0bf16e8930c2b9fbff91042ae58908758178dd15a443abf87c1ffe4f0e3ecffdc84c0d1fb9ffba115a3489
-
Filesize
314KB
MD52a3d6f1f7493570ac4f3b4c5e0e278f4
SHA1ee32ad0a7c1fb407fcfdcb5fb8e24a005d986b80
SHA256d7f69ca0675ea748d55d2f6e25b0f5748e043dc3ed70698d7cc007ad92ba5085
SHA51282b153b6738611fcb3eceb92eb4cf6d33b99489ebb0bf16e8930c2b9fbff91042ae58908758178dd15a443abf87c1ffe4f0e3ecffdc84c0d1fb9ffba115a3489
-
Filesize
314KB
MD52a3d6f1f7493570ac4f3b4c5e0e278f4
SHA1ee32ad0a7c1fb407fcfdcb5fb8e24a005d986b80
SHA256d7f69ca0675ea748d55d2f6e25b0f5748e043dc3ed70698d7cc007ad92ba5085
SHA51282b153b6738611fcb3eceb92eb4cf6d33b99489ebb0bf16e8930c2b9fbff91042ae58908758178dd15a443abf87c1ffe4f0e3ecffdc84c0d1fb9ffba115a3489
-
Filesize
314KB
MD52a3d6f1f7493570ac4f3b4c5e0e278f4
SHA1ee32ad0a7c1fb407fcfdcb5fb8e24a005d986b80
SHA256d7f69ca0675ea748d55d2f6e25b0f5748e043dc3ed70698d7cc007ad92ba5085
SHA51282b153b6738611fcb3eceb92eb4cf6d33b99489ebb0bf16e8930c2b9fbff91042ae58908758178dd15a443abf87c1ffe4f0e3ecffdc84c0d1fb9ffba115a3489
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b