Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    193s
  • max time network
    262s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/08/2023, 04:35

General

  • Target

    x1808531.exe

  • Size

    277KB

  • MD5

    e4bd7dd0f7a9ee83fa0cd67d00291299

  • SHA1

    5e24746b7bd12aaa92023651a8c0bfd0eb1b20d3

  • SHA256

    fcc9e74391bbe8472d0bc4f83acc950a492656351f271eae5e576d704f1c2067

  • SHA512

    799479c620163a45bd0e97e458d9adc16cd9aded4cb207b1b2d5b48fc885f40ca04f778b5f20d146cf15291cfc53fd4163782359cc7a03fc261b5d2099167b73

  • SSDEEP

    6144:KFy+bnr+0p0yN90QEDLYwPn8UpZMr9ZoPjK0TvVol:XMrMy905YYn8Us4m0TV0

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x1808531.exe
    "C:\Users\Admin\AppData\Local\Temp\x1808531.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g4284908.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g4284908.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h5382705.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h5382705.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
        "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5032
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2828
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4008
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "saves.exe" /P "Admin:N"
              5⤵
                PID:4392
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "saves.exe" /P "Admin:R" /E
                5⤵
                  PID:2128
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4696
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\b40d11255d" /P "Admin:N"
                    5⤵
                      PID:5000
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\b40d11255d" /P "Admin:R" /E
                      5⤵
                        PID:4204
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:4252
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:3612

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g4284908.exe

                Filesize

                15KB

                MD5

                ba16bc9eb507a6cecb0963e7515bd28e

                SHA1

                1e4e2a8f4f72cedabf7852c39b6a851cb8be5b24

                SHA256

                54ce26f0ae00fe4aba75d78b50c59b5d077cbb69ed778aa2e8c8cb7af18dae08

                SHA512

                e3833614b50598f3e0518ec2505547aab6a69e1c651268a67fe0cd62bcdbdc5934fdb2df388643fb136bbb2c7b2faa9d08913a50fd5f1d6d575d5fea48cb8398

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g4284908.exe

                Filesize

                15KB

                MD5

                ba16bc9eb507a6cecb0963e7515bd28e

                SHA1

                1e4e2a8f4f72cedabf7852c39b6a851cb8be5b24

                SHA256

                54ce26f0ae00fe4aba75d78b50c59b5d077cbb69ed778aa2e8c8cb7af18dae08

                SHA512

                e3833614b50598f3e0518ec2505547aab6a69e1c651268a67fe0cd62bcdbdc5934fdb2df388643fb136bbb2c7b2faa9d08913a50fd5f1d6d575d5fea48cb8398

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h5382705.exe

                Filesize

                323KB

                MD5

                13686b923c60956db909c2b39599a646

                SHA1

                228da2b12bd6c3719855774a74c542d99b0f66b4

                SHA256

                f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5

                SHA512

                f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h5382705.exe

                Filesize

                323KB

                MD5

                13686b923c60956db909c2b39599a646

                SHA1

                228da2b12bd6c3719855774a74c542d99b0f66b4

                SHA256

                f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5

                SHA512

                f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                13686b923c60956db909c2b39599a646

                SHA1

                228da2b12bd6c3719855774a74c542d99b0f66b4

                SHA256

                f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5

                SHA512

                f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                13686b923c60956db909c2b39599a646

                SHA1

                228da2b12bd6c3719855774a74c542d99b0f66b4

                SHA256

                f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5

                SHA512

                f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                13686b923c60956db909c2b39599a646

                SHA1

                228da2b12bd6c3719855774a74c542d99b0f66b4

                SHA256

                f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5

                SHA512

                f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                13686b923c60956db909c2b39599a646

                SHA1

                228da2b12bd6c3719855774a74c542d99b0f66b4

                SHA256

                f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5

                SHA512

                f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • memory/4964-10-0x00007FF943E00000-0x00007FF9447EC000-memory.dmp

                Filesize

                9.9MB

              • memory/4964-8-0x00007FF943E00000-0x00007FF9447EC000-memory.dmp

                Filesize

                9.9MB

              • memory/4964-7-0x0000000000C30000-0x0000000000C3A000-memory.dmp

                Filesize

                40KB