Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
262s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
28/08/2023, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
x1808531.exe
Resource
win7-20230712-en
General
-
Target
x1808531.exe
-
Size
277KB
-
MD5
e4bd7dd0f7a9ee83fa0cd67d00291299
-
SHA1
5e24746b7bd12aaa92023651a8c0bfd0eb1b20d3
-
SHA256
fcc9e74391bbe8472d0bc4f83acc950a492656351f271eae5e576d704f1c2067
-
SHA512
799479c620163a45bd0e97e458d9adc16cd9aded4cb207b1b2d5b48fc885f40ca04f778b5f20d146cf15291cfc53fd4163782359cc7a03fc261b5d2099167b73
-
SSDEEP
6144:KFy+bnr+0p0yN90QEDLYwPn8UpZMr9ZoPjK0TvVol:XMrMy905YYn8Us4m0TV0
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral2/files/0x000800000001b01b-5.dat healer behavioral2/files/0x000800000001b01b-6.dat healer behavioral2/memory/4964-7-0x0000000000C30000-0x0000000000C3A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g4284908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g4284908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g4284908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g4284908.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g4284908.exe -
Executes dropped EXE 4 IoCs
pid Process 4964 g4284908.exe 4236 h5382705.exe 4720 saves.exe 3612 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4252 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g4284908.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" x1808531.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5032 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 g4284908.exe 4964 g4284908.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4964 g4284908.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4248 wrote to memory of 4964 4248 x1808531.exe 70 PID 4248 wrote to memory of 4964 4248 x1808531.exe 70 PID 4248 wrote to memory of 4236 4248 x1808531.exe 71 PID 4248 wrote to memory of 4236 4248 x1808531.exe 71 PID 4248 wrote to memory of 4236 4248 x1808531.exe 71 PID 4236 wrote to memory of 4720 4236 h5382705.exe 72 PID 4236 wrote to memory of 4720 4236 h5382705.exe 72 PID 4236 wrote to memory of 4720 4236 h5382705.exe 72 PID 4720 wrote to memory of 5032 4720 saves.exe 73 PID 4720 wrote to memory of 5032 4720 saves.exe 73 PID 4720 wrote to memory of 5032 4720 saves.exe 73 PID 4720 wrote to memory of 2828 4720 saves.exe 75 PID 4720 wrote to memory of 2828 4720 saves.exe 75 PID 4720 wrote to memory of 2828 4720 saves.exe 75 PID 2828 wrote to memory of 4008 2828 cmd.exe 77 PID 2828 wrote to memory of 4008 2828 cmd.exe 77 PID 2828 wrote to memory of 4008 2828 cmd.exe 77 PID 2828 wrote to memory of 4392 2828 cmd.exe 78 PID 2828 wrote to memory of 4392 2828 cmd.exe 78 PID 2828 wrote to memory of 4392 2828 cmd.exe 78 PID 2828 wrote to memory of 2128 2828 cmd.exe 79 PID 2828 wrote to memory of 2128 2828 cmd.exe 79 PID 2828 wrote to memory of 2128 2828 cmd.exe 79 PID 2828 wrote to memory of 4696 2828 cmd.exe 80 PID 2828 wrote to memory of 4696 2828 cmd.exe 80 PID 2828 wrote to memory of 4696 2828 cmd.exe 80 PID 2828 wrote to memory of 5000 2828 cmd.exe 81 PID 2828 wrote to memory of 5000 2828 cmd.exe 81 PID 2828 wrote to memory of 5000 2828 cmd.exe 81 PID 2828 wrote to memory of 4204 2828 cmd.exe 82 PID 2828 wrote to memory of 4204 2828 cmd.exe 82 PID 2828 wrote to memory of 4204 2828 cmd.exe 82 PID 4720 wrote to memory of 4252 4720 saves.exe 84 PID 4720 wrote to memory of 4252 4720 saves.exe 84 PID 4720 wrote to memory of 4252 4720 saves.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\x1808531.exe"C:\Users\Admin\AppData\Local\Temp\x1808531.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g4284908.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g4284908.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h5382705.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h5382705.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F4⤵
- Creates scheduled task(s)
PID:5032
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4008
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"5⤵PID:4392
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E5⤵PID:2128
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"5⤵PID:5000
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E5⤵PID:4204
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3612
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5ba16bc9eb507a6cecb0963e7515bd28e
SHA11e4e2a8f4f72cedabf7852c39b6a851cb8be5b24
SHA25654ce26f0ae00fe4aba75d78b50c59b5d077cbb69ed778aa2e8c8cb7af18dae08
SHA512e3833614b50598f3e0518ec2505547aab6a69e1c651268a67fe0cd62bcdbdc5934fdb2df388643fb136bbb2c7b2faa9d08913a50fd5f1d6d575d5fea48cb8398
-
Filesize
15KB
MD5ba16bc9eb507a6cecb0963e7515bd28e
SHA11e4e2a8f4f72cedabf7852c39b6a851cb8be5b24
SHA25654ce26f0ae00fe4aba75d78b50c59b5d077cbb69ed778aa2e8c8cb7af18dae08
SHA512e3833614b50598f3e0518ec2505547aab6a69e1c651268a67fe0cd62bcdbdc5934fdb2df388643fb136bbb2c7b2faa9d08913a50fd5f1d6d575d5fea48cb8398
-
Filesize
323KB
MD513686b923c60956db909c2b39599a646
SHA1228da2b12bd6c3719855774a74c542d99b0f66b4
SHA256f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5
SHA512f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b
-
Filesize
323KB
MD513686b923c60956db909c2b39599a646
SHA1228da2b12bd6c3719855774a74c542d99b0f66b4
SHA256f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5
SHA512f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b
-
Filesize
323KB
MD513686b923c60956db909c2b39599a646
SHA1228da2b12bd6c3719855774a74c542d99b0f66b4
SHA256f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5
SHA512f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b
-
Filesize
323KB
MD513686b923c60956db909c2b39599a646
SHA1228da2b12bd6c3719855774a74c542d99b0f66b4
SHA256f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5
SHA512f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b
-
Filesize
323KB
MD513686b923c60956db909c2b39599a646
SHA1228da2b12bd6c3719855774a74c542d99b0f66b4
SHA256f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5
SHA512f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b
-
Filesize
323KB
MD513686b923c60956db909c2b39599a646
SHA1228da2b12bd6c3719855774a74c542d99b0f66b4
SHA256f38c0fcc92e228f63d714e83b1db29847ca4642780b0feba85efe2ef1108e8e5
SHA512f28044b437d6a78b2fe2b034b54ce644f76f671d38a44aea42ef5ee213815d9b17047270390ce9691fc6ddcc4ef006b063077728a2482ade0031176dd490529b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b