Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
24/08/2023, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe
Resource
win10-20230703-en
General
-
Target
7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe
-
Size
705KB
-
MD5
6105c63e873685d41e7e0fdbeef23e22
-
SHA1
b1e4dfb0a294ae02d15931c3f69c6d426acc98b4
-
SHA256
7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0
-
SHA512
e6630e8f63e28f092684a437d2e569ba974db449055a0f10afc33d094751be9d6322a2705e4c56dcc820c4e81af7994879e42fb10dc83d097adaa06a9bf87510
-
SSDEEP
12288:MMrTy900xgG7ONqZZEYem8xbdTznfnBCQXdLaLAmh1VS0Wk5qy2kdXrmMJy:PyFNyqXcbdTDfnBCQXoLjc0Wk5qywMJy
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
rwan
77.91.124.73:19071
-
auth_value
7c40eda5da4f888d6f61befbf947d9fe
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b047-26.dat healer behavioral1/files/0x000700000001b047-27.dat healer behavioral1/memory/844-28-0x0000000000E90000-0x0000000000E9A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g5565598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g5565598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g5565598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g5565598.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g5565598.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 1760 x7033208.exe 2188 x6030567.exe 4936 x3684287.exe 844 g5565598.exe 2080 h5775681.exe 4336 saves.exe 4520 i8160803.exe 4932 saves.exe 4812 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 5116 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g5565598.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x7033208.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x6030567.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x3684287.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 844 g5565598.exe 844 g5565598.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 844 g5565598.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1760 1656 7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe 70 PID 1656 wrote to memory of 1760 1656 7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe 70 PID 1656 wrote to memory of 1760 1656 7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe 70 PID 1760 wrote to memory of 2188 1760 x7033208.exe 71 PID 1760 wrote to memory of 2188 1760 x7033208.exe 71 PID 1760 wrote to memory of 2188 1760 x7033208.exe 71 PID 2188 wrote to memory of 4936 2188 x6030567.exe 72 PID 2188 wrote to memory of 4936 2188 x6030567.exe 72 PID 2188 wrote to memory of 4936 2188 x6030567.exe 72 PID 4936 wrote to memory of 844 4936 x3684287.exe 73 PID 4936 wrote to memory of 844 4936 x3684287.exe 73 PID 4936 wrote to memory of 2080 4936 x3684287.exe 74 PID 4936 wrote to memory of 2080 4936 x3684287.exe 74 PID 4936 wrote to memory of 2080 4936 x3684287.exe 74 PID 2080 wrote to memory of 4336 2080 h5775681.exe 75 PID 2080 wrote to memory of 4336 2080 h5775681.exe 75 PID 2080 wrote to memory of 4336 2080 h5775681.exe 75 PID 2188 wrote to memory of 4520 2188 x6030567.exe 76 PID 2188 wrote to memory of 4520 2188 x6030567.exe 76 PID 2188 wrote to memory of 4520 2188 x6030567.exe 76 PID 4336 wrote to memory of 3552 4336 saves.exe 77 PID 4336 wrote to memory of 3552 4336 saves.exe 77 PID 4336 wrote to memory of 3552 4336 saves.exe 77 PID 4336 wrote to memory of 4180 4336 saves.exe 78 PID 4336 wrote to memory of 4180 4336 saves.exe 78 PID 4336 wrote to memory of 4180 4336 saves.exe 78 PID 4180 wrote to memory of 3184 4180 cmd.exe 81 PID 4180 wrote to memory of 3184 4180 cmd.exe 81 PID 4180 wrote to memory of 3184 4180 cmd.exe 81 PID 4180 wrote to memory of 3076 4180 cmd.exe 82 PID 4180 wrote to memory of 3076 4180 cmd.exe 82 PID 4180 wrote to memory of 3076 4180 cmd.exe 82 PID 4180 wrote to memory of 1248 4180 cmd.exe 83 PID 4180 wrote to memory of 1248 4180 cmd.exe 83 PID 4180 wrote to memory of 1248 4180 cmd.exe 83 PID 4180 wrote to memory of 3848 4180 cmd.exe 84 PID 4180 wrote to memory of 3848 4180 cmd.exe 84 PID 4180 wrote to memory of 3848 4180 cmd.exe 84 PID 4180 wrote to memory of 4824 4180 cmd.exe 85 PID 4180 wrote to memory of 4824 4180 cmd.exe 85 PID 4180 wrote to memory of 4824 4180 cmd.exe 85 PID 4180 wrote to memory of 3484 4180 cmd.exe 86 PID 4180 wrote to memory of 3484 4180 cmd.exe 86 PID 4180 wrote to memory of 3484 4180 cmd.exe 86 PID 4336 wrote to memory of 5116 4336 saves.exe 88 PID 4336 wrote to memory of 5116 4336 saves.exe 88 PID 4336 wrote to memory of 5116 4336 saves.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe"C:\Users\Admin\AppData\Local\Temp\7e75fffde343291aa8cc81b99e4a01f115728f765db95a27069d713d1b9feab0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7033208.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7033208.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6030567.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6030567.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x3684287.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x3684287.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5565598.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5565598.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5775681.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5775681.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:3552
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3184
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:3076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3848
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:4824
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:3484
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:5116
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8160803.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8160803.exe4⤵
- Executes dropped EXE
PID:4520
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4932
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4812
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600KB
MD5ac37ab72a7adf332f70112939d29e164
SHA17bf0e03ea39b48e0a1c0526264b736dece22852b
SHA2565e66aa9f51637d72e6f9af49410338aaa89b5428316012dd373ad048296dd23b
SHA512cd4e72bc887e498531e217ada1f5e86e15d88609f39db7a69149ec5fa640b486ae1edf19795e1176071321e255d90c5607a6a22a332773b424c5b20b33f8a2be
-
Filesize
600KB
MD5ac37ab72a7adf332f70112939d29e164
SHA17bf0e03ea39b48e0a1c0526264b736dece22852b
SHA2565e66aa9f51637d72e6f9af49410338aaa89b5428316012dd373ad048296dd23b
SHA512cd4e72bc887e498531e217ada1f5e86e15d88609f39db7a69149ec5fa640b486ae1edf19795e1176071321e255d90c5607a6a22a332773b424c5b20b33f8a2be
-
Filesize
434KB
MD544e39df92aa3ea8bb04c61056c3bf622
SHA1554c8e3dc057411b1e638981d47c933168ce6a1d
SHA256ad0c40cc442f8365f1ecae62aaf2bd8586cdaa611f029b067ccaeef7cb6c3a22
SHA512145e2704a7c000c2f031743b0d297091fd17c757630511935cde42c9502fb068fa080b6d35d45985a817b8d21cdb60fd9f81e74652cba7465bb4af8e979b6483
-
Filesize
434KB
MD544e39df92aa3ea8bb04c61056c3bf622
SHA1554c8e3dc057411b1e638981d47c933168ce6a1d
SHA256ad0c40cc442f8365f1ecae62aaf2bd8586cdaa611f029b067ccaeef7cb6c3a22
SHA512145e2704a7c000c2f031743b0d297091fd17c757630511935cde42c9502fb068fa080b6d35d45985a817b8d21cdb60fd9f81e74652cba7465bb4af8e979b6483
-
Filesize
174KB
MD58b80dbb70fc1723845e5d172bfc25828
SHA1e237048982e4d7dfc7dd716730e51e1f0e79953e
SHA2565f4c513fa4ca9176c4aaab406e754fbf2e08146b5044759e63a69a354b1071de
SHA5122d07d5e89e23c05716b940c173f38938e4801f36ac4c7c2240f4fb9dee509a64d97b87e4d5bf52739b782d73994d70208962dd5c4cc131162943b8ab1d414eac
-
Filesize
174KB
MD58b80dbb70fc1723845e5d172bfc25828
SHA1e237048982e4d7dfc7dd716730e51e1f0e79953e
SHA2565f4c513fa4ca9176c4aaab406e754fbf2e08146b5044759e63a69a354b1071de
SHA5122d07d5e89e23c05716b940c173f38938e4801f36ac4c7c2240f4fb9dee509a64d97b87e4d5bf52739b782d73994d70208962dd5c4cc131162943b8ab1d414eac
-
Filesize
277KB
MD5422b148b9402cdbfeae59bba788c44ff
SHA1cc6e1fe5c41b8a7ed3947b2cf8f8805c1166cfad
SHA256c3f47a31641eb01ffd33140bed03bfa61ca6d40718dc3bd261ac0b5d89bf37e7
SHA51232d512cd02408f2f2bce57bb403aa9b966a31e9f89f3177a2069820374715adcff2f8eb00e30e31fd68ea2b78ad295417d3db446e4e1393a64e8f3bcc700f42b
-
Filesize
277KB
MD5422b148b9402cdbfeae59bba788c44ff
SHA1cc6e1fe5c41b8a7ed3947b2cf8f8805c1166cfad
SHA256c3f47a31641eb01ffd33140bed03bfa61ca6d40718dc3bd261ac0b5d89bf37e7
SHA51232d512cd02408f2f2bce57bb403aa9b966a31e9f89f3177a2069820374715adcff2f8eb00e30e31fd68ea2b78ad295417d3db446e4e1393a64e8f3bcc700f42b
-
Filesize
13KB
MD5ff2af103c11346d7aa25b78238663207
SHA1bdbf1e167941da040e7424f57bcc703149a4b583
SHA25691f9d9337cae4e074b0c2cc975e1ae0780d9d1cd8781569ed3016410b3de0eff
SHA5127e654c06380f1c31ff0e5546576dc870ed8cf9bca6c2909dfd96696775234393164d30236fb138405c42aedbeef9408eb0167c31187e9c733b6d53dabd4b383f
-
Filesize
13KB
MD5ff2af103c11346d7aa25b78238663207
SHA1bdbf1e167941da040e7424f57bcc703149a4b583
SHA25691f9d9337cae4e074b0c2cc975e1ae0780d9d1cd8781569ed3016410b3de0eff
SHA5127e654c06380f1c31ff0e5546576dc870ed8cf9bca6c2909dfd96696775234393164d30236fb138405c42aedbeef9408eb0167c31187e9c733b6d53dabd4b383f
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
318KB
MD5915079226539fbc7e22b6d9b63fdd2ff
SHA1553bd4c96e9808db09c9bd9e05c9aec278266f3c
SHA256350c35710d895596c597114d729aae696c975eba55b66b384a799dcd3525519a
SHA51270e4b60b002f74833b061a11374cdc6fe6cdfdca19ff0b229964af184b36c948c762d869743086270f78dc19e0ccdcc5874faac03d5858c79b54e027b48adc03
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b