Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
29/08/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe
Resource
win10-20230703-en
General
-
Target
c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe
-
Size
704KB
-
MD5
165d7eca17598c763fab95a3ac39a0f8
-
SHA1
c3942133bbd530eebd410a49089365b314836bf0
-
SHA256
c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b
-
SHA512
916512577c81be591d2a6cb060826fae219f7e267256afa1e0d8603fb98cc1a0adf8fc03a4c8b18d4c7a1e4fc94e0b091719a65b3cd1654769838bca564d629c
-
SSDEEP
12288:KMrhy90WgsFgK/rqA7rdK1eUdBzbtu0LryuTZ3cjck/qIw5Y4NhiB24p:7y0sFNxrae8trLryqTKw5Y4bMx
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
sruta
77.91.124.82:19071
-
auth_value
c556edcd49703319eca74247de20c236
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b01c-26.dat healer behavioral1/files/0x000700000001b01c-27.dat healer behavioral1/memory/5052-28-0x0000000000440000-0x000000000044A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g7151445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g7151445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g7151445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g7151445.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g7151445.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 2344 x3151900.exe 4460 x7168354.exe 640 x6883375.exe 5052 g7151445.exe 3184 h1993551.exe 4620 saves.exe 196 i1966465.exe 4780 saves.exe 4912 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4040 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g7151445.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x7168354.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x6883375.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x3151900.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4284 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5052 g7151445.exe 5052 g7151445.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5052 g7151445.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4156 wrote to memory of 2344 4156 c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe 70 PID 4156 wrote to memory of 2344 4156 c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe 70 PID 4156 wrote to memory of 2344 4156 c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe 70 PID 2344 wrote to memory of 4460 2344 x3151900.exe 71 PID 2344 wrote to memory of 4460 2344 x3151900.exe 71 PID 2344 wrote to memory of 4460 2344 x3151900.exe 71 PID 4460 wrote to memory of 640 4460 x7168354.exe 72 PID 4460 wrote to memory of 640 4460 x7168354.exe 72 PID 4460 wrote to memory of 640 4460 x7168354.exe 72 PID 640 wrote to memory of 5052 640 x6883375.exe 73 PID 640 wrote to memory of 5052 640 x6883375.exe 73 PID 640 wrote to memory of 3184 640 x6883375.exe 74 PID 640 wrote to memory of 3184 640 x6883375.exe 74 PID 640 wrote to memory of 3184 640 x6883375.exe 74 PID 3184 wrote to memory of 4620 3184 h1993551.exe 75 PID 3184 wrote to memory of 4620 3184 h1993551.exe 75 PID 3184 wrote to memory of 4620 3184 h1993551.exe 75 PID 4460 wrote to memory of 196 4460 x7168354.exe 76 PID 4460 wrote to memory of 196 4460 x7168354.exe 76 PID 4460 wrote to memory of 196 4460 x7168354.exe 76 PID 4620 wrote to memory of 4284 4620 saves.exe 77 PID 4620 wrote to memory of 4284 4620 saves.exe 77 PID 4620 wrote to memory of 4284 4620 saves.exe 77 PID 4620 wrote to memory of 4936 4620 saves.exe 78 PID 4620 wrote to memory of 4936 4620 saves.exe 78 PID 4620 wrote to memory of 4936 4620 saves.exe 78 PID 4936 wrote to memory of 2932 4936 cmd.exe 81 PID 4936 wrote to memory of 2932 4936 cmd.exe 81 PID 4936 wrote to memory of 2932 4936 cmd.exe 81 PID 4936 wrote to memory of 1360 4936 cmd.exe 82 PID 4936 wrote to memory of 1360 4936 cmd.exe 82 PID 4936 wrote to memory of 1360 4936 cmd.exe 82 PID 4936 wrote to memory of 1568 4936 cmd.exe 83 PID 4936 wrote to memory of 1568 4936 cmd.exe 83 PID 4936 wrote to memory of 1568 4936 cmd.exe 83 PID 4936 wrote to memory of 3760 4936 cmd.exe 84 PID 4936 wrote to memory of 3760 4936 cmd.exe 84 PID 4936 wrote to memory of 3760 4936 cmd.exe 84 PID 4936 wrote to memory of 3692 4936 cmd.exe 85 PID 4936 wrote to memory of 3692 4936 cmd.exe 85 PID 4936 wrote to memory of 3692 4936 cmd.exe 85 PID 4936 wrote to memory of 4292 4936 cmd.exe 86 PID 4936 wrote to memory of 4292 4936 cmd.exe 86 PID 4936 wrote to memory of 4292 4936 cmd.exe 86 PID 4620 wrote to memory of 4040 4620 saves.exe 88 PID 4620 wrote to memory of 4040 4620 saves.exe 88 PID 4620 wrote to memory of 4040 4620 saves.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe"C:\Users\Admin\AppData\Local\Temp\c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3151900.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3151900.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7168354.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7168354.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x6883375.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x6883375.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7151445.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7151445.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h1993551.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h1993551.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:4284
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:1360
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:1568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3760
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3692
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4292
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4040
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1966465.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1966465.exe4⤵
- Executes dropped EXE
PID:196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4780
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4912
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5182ffa85c4126fc32d1a7e58c6529d52
SHA10076902e05af25318198c0c019becea40008e135
SHA256b3144ddb5b87462c05dc0b888d3b7f80cb07729cca41794e27482e1def43e4ae
SHA5120de6097e2fe09b074a36ee0445ec58424e295510a39edd62a1e761195232a8c78ca005748c5f2eec65f9a547c8c79d6dd38246501e12d79beb23b6db30bd5baf
-
Filesize
599KB
MD5182ffa85c4126fc32d1a7e58c6529d52
SHA10076902e05af25318198c0c019becea40008e135
SHA256b3144ddb5b87462c05dc0b888d3b7f80cb07729cca41794e27482e1def43e4ae
SHA5120de6097e2fe09b074a36ee0445ec58424e295510a39edd62a1e761195232a8c78ca005748c5f2eec65f9a547c8c79d6dd38246501e12d79beb23b6db30bd5baf
-
Filesize
432KB
MD52c298b6b4e16f04aef85f02ed3dd2ffc
SHA19d0fd920e2d92a659a6377cbfb96359abaccaf5f
SHA25684af2f5b0026674757b6c5410bc4ebfb799d42d8e88ce0bcc4a19fd834124ee1
SHA512f773faff1ce2804f07dac16582b93e00deb3d6adf36d248134452d333d7abab5b9c979460b9aed23853effd87235594f7bff1c205d61db6722a06df9159dea50
-
Filesize
432KB
MD52c298b6b4e16f04aef85f02ed3dd2ffc
SHA19d0fd920e2d92a659a6377cbfb96359abaccaf5f
SHA25684af2f5b0026674757b6c5410bc4ebfb799d42d8e88ce0bcc4a19fd834124ee1
SHA512f773faff1ce2804f07dac16582b93e00deb3d6adf36d248134452d333d7abab5b9c979460b9aed23853effd87235594f7bff1c205d61db6722a06df9159dea50
-
Filesize
174KB
MD5003f51a81e4992e9636b574f52085c64
SHA142fc611e9bf3390ceb5e70ffae5ffb8b77fb505b
SHA2569e8933a946de6105443ec8f003aa2681aeb66c0f7421c92050fc1598dda04c0d
SHA512cc8213dfa65eda135bb57bff51bf2d1eb8c9a4f1c54753176da97db5e7c0aa562a8d5bd53b631addb8db51f89fd3fd679bac040e63653a5c4e18d3a4de39e0d0
-
Filesize
174KB
MD5003f51a81e4992e9636b574f52085c64
SHA142fc611e9bf3390ceb5e70ffae5ffb8b77fb505b
SHA2569e8933a946de6105443ec8f003aa2681aeb66c0f7421c92050fc1598dda04c0d
SHA512cc8213dfa65eda135bb57bff51bf2d1eb8c9a4f1c54753176da97db5e7c0aa562a8d5bd53b631addb8db51f89fd3fd679bac040e63653a5c4e18d3a4de39e0d0
-
Filesize
277KB
MD561113bfe989de194c978d7f2eafb1a9a
SHA1810e78b031b9e6d965676593c4ef819b37e53c52
SHA256c8a35258d9f9911ba757d134851e3568d3f1ac7e21e6f7c9cfac7d00fe47d82e
SHA5123e88366d516fc7bc9fcf1896c61bcaa34ff5732877905882906ac2bd5b9485b880ec04b4f2c6db12feeb2ec784fc6808468244e988440de81ab8fa7fbcad81e9
-
Filesize
277KB
MD561113bfe989de194c978d7f2eafb1a9a
SHA1810e78b031b9e6d965676593c4ef819b37e53c52
SHA256c8a35258d9f9911ba757d134851e3568d3f1ac7e21e6f7c9cfac7d00fe47d82e
SHA5123e88366d516fc7bc9fcf1896c61bcaa34ff5732877905882906ac2bd5b9485b880ec04b4f2c6db12feeb2ec784fc6808468244e988440de81ab8fa7fbcad81e9
-
Filesize
17KB
MD550777cef43088a7e46f996b8c8f803e6
SHA17b6332e6a39963b19b73c3db61e99bba15bfffb4
SHA256586122041194727e07015f4f6dffcc3dda95759fac98d45926dd87048acc4b6a
SHA51210c750a475a5857b23065d1f188f847443cf80096f68f823ff9e76dd605f59f0d442ba79058ddda8e8a52109d96d98aaa77034d0e2a80a3519c3708b9f8164a3
-
Filesize
17KB
MD550777cef43088a7e46f996b8c8f803e6
SHA17b6332e6a39963b19b73c3db61e99bba15bfffb4
SHA256586122041194727e07015f4f6dffcc3dda95759fac98d45926dd87048acc4b6a
SHA51210c750a475a5857b23065d1f188f847443cf80096f68f823ff9e76dd605f59f0d442ba79058ddda8e8a52109d96d98aaa77034d0e2a80a3519c3708b9f8164a3
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
326KB
MD5059a40d511fba3b193a99222f9a9939d
SHA14b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d
SHA25613aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea
SHA512cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b