Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
25/08/2023, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe
Resource
win10-20230703-en
General
-
Target
6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe
-
Size
705KB
-
MD5
63ed49672bb9bc4b20408c95c2b7b9e0
-
SHA1
8ad51885b5bceeac3280986a7ccb72b7931f620f
-
SHA256
6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09
-
SHA512
8225de8f9dfa20d57689e82edb2d3d7e28715bf4353139e9782148ab05da856a7399d31462c0fe42e7e36e729ac49827feef03d399df7a1b965dc7ee61df95c2
-
SSDEEP
12288:rMr/y90EsKRCo9+jsvx7FiRg+dvNr5OT1SkSf4cSmIhejPtJo:Yyxsg++F+BNr5aSEcLIhej0
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
jaja
77.91.124.73:19071
-
auth_value
3670179d176ca399ed08e7914610b43c
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001af99-26.dat healer behavioral1/files/0x000700000001af99-27.dat healer behavioral1/memory/1988-28-0x0000000000870000-0x000000000087A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g5670045.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g5670045.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g5670045.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g5670045.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g5670045.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 2168 x7431456.exe 1808 x6730886.exe 4436 x7684269.exe 1988 g5670045.exe 1392 h9987831.exe 4768 saves.exe 2424 i9799882.exe 3760 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4996 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g5670045.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x7431456.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x6730886.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x7684269.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1988 g5670045.exe 1988 g5670045.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1988 g5670045.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4876 wrote to memory of 2168 4876 6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe 69 PID 4876 wrote to memory of 2168 4876 6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe 69 PID 4876 wrote to memory of 2168 4876 6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe 69 PID 2168 wrote to memory of 1808 2168 x7431456.exe 70 PID 2168 wrote to memory of 1808 2168 x7431456.exe 70 PID 2168 wrote to memory of 1808 2168 x7431456.exe 70 PID 1808 wrote to memory of 4436 1808 x6730886.exe 71 PID 1808 wrote to memory of 4436 1808 x6730886.exe 71 PID 1808 wrote to memory of 4436 1808 x6730886.exe 71 PID 4436 wrote to memory of 1988 4436 x7684269.exe 72 PID 4436 wrote to memory of 1988 4436 x7684269.exe 72 PID 4436 wrote to memory of 1392 4436 x7684269.exe 73 PID 4436 wrote to memory of 1392 4436 x7684269.exe 73 PID 4436 wrote to memory of 1392 4436 x7684269.exe 73 PID 1392 wrote to memory of 4768 1392 h9987831.exe 74 PID 1392 wrote to memory of 4768 1392 h9987831.exe 74 PID 1392 wrote to memory of 4768 1392 h9987831.exe 74 PID 1808 wrote to memory of 2424 1808 x6730886.exe 75 PID 1808 wrote to memory of 2424 1808 x6730886.exe 75 PID 1808 wrote to memory of 2424 1808 x6730886.exe 75 PID 4768 wrote to memory of 2796 4768 saves.exe 76 PID 4768 wrote to memory of 2796 4768 saves.exe 76 PID 4768 wrote to memory of 2796 4768 saves.exe 76 PID 4768 wrote to memory of 4852 4768 saves.exe 78 PID 4768 wrote to memory of 4852 4768 saves.exe 78 PID 4768 wrote to memory of 4852 4768 saves.exe 78 PID 4852 wrote to memory of 2632 4852 cmd.exe 80 PID 4852 wrote to memory of 2632 4852 cmd.exe 80 PID 4852 wrote to memory of 2632 4852 cmd.exe 80 PID 4852 wrote to memory of 2144 4852 cmd.exe 81 PID 4852 wrote to memory of 2144 4852 cmd.exe 81 PID 4852 wrote to memory of 2144 4852 cmd.exe 81 PID 4852 wrote to memory of 1532 4852 cmd.exe 82 PID 4852 wrote to memory of 1532 4852 cmd.exe 82 PID 4852 wrote to memory of 1532 4852 cmd.exe 82 PID 4852 wrote to memory of 1436 4852 cmd.exe 83 PID 4852 wrote to memory of 1436 4852 cmd.exe 83 PID 4852 wrote to memory of 1436 4852 cmd.exe 83 PID 4852 wrote to memory of 1704 4852 cmd.exe 84 PID 4852 wrote to memory of 1704 4852 cmd.exe 84 PID 4852 wrote to memory of 1704 4852 cmd.exe 84 PID 4852 wrote to memory of 4476 4852 cmd.exe 85 PID 4852 wrote to memory of 4476 4852 cmd.exe 85 PID 4852 wrote to memory of 4476 4852 cmd.exe 85 PID 4768 wrote to memory of 4996 4768 saves.exe 87 PID 4768 wrote to memory of 4996 4768 saves.exe 87 PID 4768 wrote to memory of 4996 4768 saves.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe"C:\Users\Admin\AppData\Local\Temp\6c0e3613f2ff184834499bceccb320e0a99690150977d7f41e1127c067c49b09.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7431456.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7431456.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6730886.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6730886.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7684269.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7684269.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5670045.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5670045.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9987831.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9987831.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:2796
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2632
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2144
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:1532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:1436
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:1704
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4476
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4996
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i9799882.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i9799882.exe4⤵
- Executes dropped EXE
PID:2424
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD516d2d3e932e8c8d76a34b698ec15d103
SHA135fecd30f012f731ea0225c7df5272203a8375b3
SHA2569ecf9445308171364a2c557ef3fdd031f82229201e832e0d49ef399ab397e76f
SHA512f4b416c6ef999555d19c35f13b1268491a4806d583de4744cbc9ca075eafa9e7150747da71cebbddd58f7967dc5652a1515b21570001f3d7c2cc96aa5691777c
-
Filesize
599KB
MD516d2d3e932e8c8d76a34b698ec15d103
SHA135fecd30f012f731ea0225c7df5272203a8375b3
SHA2569ecf9445308171364a2c557ef3fdd031f82229201e832e0d49ef399ab397e76f
SHA512f4b416c6ef999555d19c35f13b1268491a4806d583de4744cbc9ca075eafa9e7150747da71cebbddd58f7967dc5652a1515b21570001f3d7c2cc96aa5691777c
-
Filesize
433KB
MD52a7a1fb34cf7e3595a16524fe449a7f9
SHA111129c9d2656a7194c2888ceb4f74dd17ab0700c
SHA256d7df6ed1ff23bcba4ce5ff6ff1df42580db7a2e2810ffc33890aab97c5d8e529
SHA512fed7f95e11ba73be79041148a56dc9f8ada24f453a79a368c7a19a9336567c2f5f91afd1b6ae2dae2f17af676f00af35217f1a700de90b527a8c744213af657f
-
Filesize
433KB
MD52a7a1fb34cf7e3595a16524fe449a7f9
SHA111129c9d2656a7194c2888ceb4f74dd17ab0700c
SHA256d7df6ed1ff23bcba4ce5ff6ff1df42580db7a2e2810ffc33890aab97c5d8e529
SHA512fed7f95e11ba73be79041148a56dc9f8ada24f453a79a368c7a19a9336567c2f5f91afd1b6ae2dae2f17af676f00af35217f1a700de90b527a8c744213af657f
-
Filesize
174KB
MD5d1a71d0ac55e70e9f53a35a2e8370d15
SHA15e82cac6e9571c0aed4c4cfd471f491b96ae3d33
SHA256504caada43dd03363edd5cc13d7482addc6f1d178ccc5d9c2ff50875fae78aba
SHA5126f23de156f80ff0b682d9ef0cb9807ba7e5ab607dd9beedca2c83f59118e3daae78157efb3c954559fc75b46f75d424eada63ed5a94699d5dcf240e33567edbf
-
Filesize
174KB
MD5d1a71d0ac55e70e9f53a35a2e8370d15
SHA15e82cac6e9571c0aed4c4cfd471f491b96ae3d33
SHA256504caada43dd03363edd5cc13d7482addc6f1d178ccc5d9c2ff50875fae78aba
SHA5126f23de156f80ff0b682d9ef0cb9807ba7e5ab607dd9beedca2c83f59118e3daae78157efb3c954559fc75b46f75d424eada63ed5a94699d5dcf240e33567edbf
-
Filesize
277KB
MD547a7f19992626cca963706a361dc63bb
SHA1c7dc1ca7b07fe71242ae60b070438b5ea375bf5a
SHA2569681f8cadc96c5ee9518c8aaab439cfe70f5ccc9dc33dfc815b94131734a26d4
SHA51226016a59095646a08e6844554037e801596d2d5e44fbb2157780890eb3bb78fe29fd5cebedc324758a5d1df7c170ce34f8601e8ad5f444d04c83b17515f8cb80
-
Filesize
277KB
MD547a7f19992626cca963706a361dc63bb
SHA1c7dc1ca7b07fe71242ae60b070438b5ea375bf5a
SHA2569681f8cadc96c5ee9518c8aaab439cfe70f5ccc9dc33dfc815b94131734a26d4
SHA51226016a59095646a08e6844554037e801596d2d5e44fbb2157780890eb3bb78fe29fd5cebedc324758a5d1df7c170ce34f8601e8ad5f444d04c83b17515f8cb80
-
Filesize
14KB
MD585dca170d602e42c5399e0a87c8ce867
SHA1e7c0a36fd55a01fde8e6fb5787698a5810c93a90
SHA256b72f2a87724004d7a14ea8d8497b9813fde18c592a67b25ae6e3bf0c38d3e6fc
SHA5120b498e3cce7db70410226281ede47847d3b1c8878de2abc01e9e50fd70e5c0c8d73f9aaf2344a2f3b92917f6811370d85544a777ac7b6e865a71b191ebf9c3c5
-
Filesize
14KB
MD585dca170d602e42c5399e0a87c8ce867
SHA1e7c0a36fd55a01fde8e6fb5787698a5810c93a90
SHA256b72f2a87724004d7a14ea8d8497b9813fde18c592a67b25ae6e3bf0c38d3e6fc
SHA5120b498e3cce7db70410226281ede47847d3b1c8878de2abc01e9e50fd70e5c0c8d73f9aaf2344a2f3b92917f6811370d85544a777ac7b6e865a71b191ebf9c3c5
-
Filesize
319KB
MD5816687f06231aaa62a6b85efd507b856
SHA19e07de0ec52ce8e75bb1555daa5b5e5f0f537848
SHA256b3ccc3b7575855b0ce3443ee41a2cfee92a74941b6f18b6e0dd27468751c25c1
SHA5122e71bf328b1de8cbd3c5a09e703e02860dc7f28a2ff1bef8eaf95368b59b1324e22748b61ceb868c9100ec62bc8ae9bb7bf00f3eeff9611b13e7d7da70542acb
-
Filesize
319KB
MD5816687f06231aaa62a6b85efd507b856
SHA19e07de0ec52ce8e75bb1555daa5b5e5f0f537848
SHA256b3ccc3b7575855b0ce3443ee41a2cfee92a74941b6f18b6e0dd27468751c25c1
SHA5122e71bf328b1de8cbd3c5a09e703e02860dc7f28a2ff1bef8eaf95368b59b1324e22748b61ceb868c9100ec62bc8ae9bb7bf00f3eeff9611b13e7d7da70542acb
-
Filesize
319KB
MD5816687f06231aaa62a6b85efd507b856
SHA19e07de0ec52ce8e75bb1555daa5b5e5f0f537848
SHA256b3ccc3b7575855b0ce3443ee41a2cfee92a74941b6f18b6e0dd27468751c25c1
SHA5122e71bf328b1de8cbd3c5a09e703e02860dc7f28a2ff1bef8eaf95368b59b1324e22748b61ceb868c9100ec62bc8ae9bb7bf00f3eeff9611b13e7d7da70542acb
-
Filesize
319KB
MD5816687f06231aaa62a6b85efd507b856
SHA19e07de0ec52ce8e75bb1555daa5b5e5f0f537848
SHA256b3ccc3b7575855b0ce3443ee41a2cfee92a74941b6f18b6e0dd27468751c25c1
SHA5122e71bf328b1de8cbd3c5a09e703e02860dc7f28a2ff1bef8eaf95368b59b1324e22748b61ceb868c9100ec62bc8ae9bb7bf00f3eeff9611b13e7d7da70542acb
-
Filesize
319KB
MD5816687f06231aaa62a6b85efd507b856
SHA19e07de0ec52ce8e75bb1555daa5b5e5f0f537848
SHA256b3ccc3b7575855b0ce3443ee41a2cfee92a74941b6f18b6e0dd27468751c25c1
SHA5122e71bf328b1de8cbd3c5a09e703e02860dc7f28a2ff1bef8eaf95368b59b1324e22748b61ceb868c9100ec62bc8ae9bb7bf00f3eeff9611b13e7d7da70542acb
-
Filesize
319KB
MD5816687f06231aaa62a6b85efd507b856
SHA19e07de0ec52ce8e75bb1555daa5b5e5f0f537848
SHA256b3ccc3b7575855b0ce3443ee41a2cfee92a74941b6f18b6e0dd27468751c25c1
SHA5122e71bf328b1de8cbd3c5a09e703e02860dc7f28a2ff1bef8eaf95368b59b1324e22748b61ceb868c9100ec62bc8ae9bb7bf00f3eeff9611b13e7d7da70542acb
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b