Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/08/2023, 19:25

Errors

Reason
Machine shutdown

General

  • Target

    e970e0ea04a9999382c8cb97b9d6cfa57005967e520da832642255bea1d7c5e4.exe

  • Size

    704KB

  • MD5

    99bacda620b636f0c426ff01fb2e90c6

  • SHA1

    9ee5772e5d8b7cee25253eee74db01e933ba5b37

  • SHA256

    e970e0ea04a9999382c8cb97b9d6cfa57005967e520da832642255bea1d7c5e4

  • SHA512

    60b246f832a2362f62bcaac4c01af287e84fe15a8ca431092f0398c99fc69d2d1af573f042489c21b720504e058078167630bfe3c8c486ab7908d778f6a5993a

  • SSDEEP

    12288:+MrNy90Pf285npnOHMva/73T8xiVDXtmhX2rmwoZI90tWzPoSAWG:zyo+85npnuIa/73T8ADBmweICAtAWG

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

sruta

C2

77.91.124.82:19071

Attributes
  • auth_value

    c556edcd49703319eca74247de20c236

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 8 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e970e0ea04a9999382c8cb97b9d6cfa57005967e520da832642255bea1d7c5e4.exe
    "C:\Users\Admin\AppData\Local\Temp\e970e0ea04a9999382c8cb97b9d6cfa57005967e520da832642255bea1d7c5e4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1116272.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1116272.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4723498.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4723498.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x3472103.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x3472103.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4468
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0608754.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0608754.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2736
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h8339263.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h8339263.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4476
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1592
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:4432
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4968
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:3928
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:2032
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:2472
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:2152
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:3676
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:5056
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i7077733.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i7077733.exe
                      4⤵
                      • Executes dropped EXE
                      PID:4824
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4712
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1996
                  • C:\Windows\SysWOW64\shutdown.exe
                    shutdown -s -t 0
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3780
              • C:\Windows\system32\LogonUI.exe
                "LogonUI.exe" /flags:0x0 /state0:0xa3aea855 /state1:0x41c64e6d
                1⤵
                • Modifies data under HKEY_USERS
                • Suspicious use of SetWindowsHookEx
                PID:4776

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1116272.exe

                Filesize

                599KB

                MD5

                02ce4909c21ba2ad6860464634e5946c

                SHA1

                9c626c6635d1ff9735511003a87439debaf1e8ec

                SHA256

                c00cad1a1710758824295ae3998dba5e66186829356759f3a8c955d8187e9224

                SHA512

                7e97dcb6539bebc53dd287c7333ab0464784470341f8b161e93ed17150cf4ec85e94dbcbd305f154e81cfbe5aeb5cfaaefb22e2a365a4f390e60012f2101e8ee

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1116272.exe

                Filesize

                599KB

                MD5

                02ce4909c21ba2ad6860464634e5946c

                SHA1

                9c626c6635d1ff9735511003a87439debaf1e8ec

                SHA256

                c00cad1a1710758824295ae3998dba5e66186829356759f3a8c955d8187e9224

                SHA512

                7e97dcb6539bebc53dd287c7333ab0464784470341f8b161e93ed17150cf4ec85e94dbcbd305f154e81cfbe5aeb5cfaaefb22e2a365a4f390e60012f2101e8ee

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4723498.exe

                Filesize

                433KB

                MD5

                5f845f80e1609ad7e84ee456f3d29a70

                SHA1

                6124324cb2788efe77d8ffcfb60e5adae3174c42

                SHA256

                dfb0ce123b1798f407989d2997f3b8561e55e8e2b10b836121625a4b705c064e

                SHA512

                4bc6b26fe885efee0d2c7cd5410c118db32865adf622c327cfdefef1a0f67747839d8c137db842a1179cf3affe5648c716da6cb303cf39b466bae0100a219958

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4723498.exe

                Filesize

                433KB

                MD5

                5f845f80e1609ad7e84ee456f3d29a70

                SHA1

                6124324cb2788efe77d8ffcfb60e5adae3174c42

                SHA256

                dfb0ce123b1798f407989d2997f3b8561e55e8e2b10b836121625a4b705c064e

                SHA512

                4bc6b26fe885efee0d2c7cd5410c118db32865adf622c327cfdefef1a0f67747839d8c137db842a1179cf3affe5648c716da6cb303cf39b466bae0100a219958

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i7077733.exe

                Filesize

                174KB

                MD5

                9f111b55325f4f86f3362d0bd61a7bfc

                SHA1

                c6bce50a0647dd97e7f2c6d9a867c64e0e9eba0f

                SHA256

                c5402adbd5fd83ef77ab678be5b47dbf3350e8a4902b642a13e836fad4e72b70

                SHA512

                68ed7d29debf9ed2d59887849b2dbe068025ac62ba66e829ba8c6e0afad37436f9bd75ca5b8a02a507da7a007c7cf4f31fba77153b6b524d738f8a2413bd2e5f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i7077733.exe

                Filesize

                174KB

                MD5

                9f111b55325f4f86f3362d0bd61a7bfc

                SHA1

                c6bce50a0647dd97e7f2c6d9a867c64e0e9eba0f

                SHA256

                c5402adbd5fd83ef77ab678be5b47dbf3350e8a4902b642a13e836fad4e72b70

                SHA512

                68ed7d29debf9ed2d59887849b2dbe068025ac62ba66e829ba8c6e0afad37436f9bd75ca5b8a02a507da7a007c7cf4f31fba77153b6b524d738f8a2413bd2e5f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x3472103.exe

                Filesize

                277KB

                MD5

                766341533723a6856cb1e0d0e420c4eb

                SHA1

                92d8759ccdd79daa9dd84dae880ba314c9e5e77a

                SHA256

                e7ba9dd0c226b6fd4548c25e8debfce190fc6ae4513a74e493133319aec5b131

                SHA512

                808822a26272853e45d7d580334e28239a777588504704f27c3543640a6616d04d6d3c45fbce9287b04244fdb8f064434ec84400531befcef37bbdf48f13a45c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x3472103.exe

                Filesize

                277KB

                MD5

                766341533723a6856cb1e0d0e420c4eb

                SHA1

                92d8759ccdd79daa9dd84dae880ba314c9e5e77a

                SHA256

                e7ba9dd0c226b6fd4548c25e8debfce190fc6ae4513a74e493133319aec5b131

                SHA512

                808822a26272853e45d7d580334e28239a777588504704f27c3543640a6616d04d6d3c45fbce9287b04244fdb8f064434ec84400531befcef37bbdf48f13a45c

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0608754.exe

                Filesize

                17KB

                MD5

                59d78c92d78f220e904a00101aaedc6c

                SHA1

                b13cf6555512ae3eeeea47665ca5dd7a1ed09226

                SHA256

                3b5a45481d2e11f401837d0c53557f47fef4939cdcfeab8392f3f1fdd260a69e

                SHA512

                f6665d15ec813b15e9a6f48ecc23951ea0d6fe667e889915ef666c76e34bd69c18451ccbecff66dad18ec70e26927d6d9f23259f6ddba2e2d4475889b42c27f0

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0608754.exe

                Filesize

                17KB

                MD5

                59d78c92d78f220e904a00101aaedc6c

                SHA1

                b13cf6555512ae3eeeea47665ca5dd7a1ed09226

                SHA256

                3b5a45481d2e11f401837d0c53557f47fef4939cdcfeab8392f3f1fdd260a69e

                SHA512

                f6665d15ec813b15e9a6f48ecc23951ea0d6fe667e889915ef666c76e34bd69c18451ccbecff66dad18ec70e26927d6d9f23259f6ddba2e2d4475889b42c27f0

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h8339263.exe

                Filesize

                325KB

                MD5

                41c1552adc391a47e62a1be19281a003

                SHA1

                533b08aee3313530c96ccf1ca9e16e26e216585f

                SHA256

                0689cece670edb4a86f6f7c04f3337bc385bec553c987782f57db254a1de7d0f

                SHA512

                8c4fe9d68cc4319c650e4ff245ff043d40646d1b01b5e27b0dc23c1037b192a566a7ecd84c68da0fc5c1ff503eb77eb05f098bc00f97f777fca8d2707c96659f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h8339263.exe

                Filesize

                325KB

                MD5

                41c1552adc391a47e62a1be19281a003

                SHA1

                533b08aee3313530c96ccf1ca9e16e26e216585f

                SHA256

                0689cece670edb4a86f6f7c04f3337bc385bec553c987782f57db254a1de7d0f

                SHA512

                8c4fe9d68cc4319c650e4ff245ff043d40646d1b01b5e27b0dc23c1037b192a566a7ecd84c68da0fc5c1ff503eb77eb05f098bc00f97f777fca8d2707c96659f

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                325KB

                MD5

                41c1552adc391a47e62a1be19281a003

                SHA1

                533b08aee3313530c96ccf1ca9e16e26e216585f

                SHA256

                0689cece670edb4a86f6f7c04f3337bc385bec553c987782f57db254a1de7d0f

                SHA512

                8c4fe9d68cc4319c650e4ff245ff043d40646d1b01b5e27b0dc23c1037b192a566a7ecd84c68da0fc5c1ff503eb77eb05f098bc00f97f777fca8d2707c96659f

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                325KB

                MD5

                41c1552adc391a47e62a1be19281a003

                SHA1

                533b08aee3313530c96ccf1ca9e16e26e216585f

                SHA256

                0689cece670edb4a86f6f7c04f3337bc385bec553c987782f57db254a1de7d0f

                SHA512

                8c4fe9d68cc4319c650e4ff245ff043d40646d1b01b5e27b0dc23c1037b192a566a7ecd84c68da0fc5c1ff503eb77eb05f098bc00f97f777fca8d2707c96659f

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                325KB

                MD5

                41c1552adc391a47e62a1be19281a003

                SHA1

                533b08aee3313530c96ccf1ca9e16e26e216585f

                SHA256

                0689cece670edb4a86f6f7c04f3337bc385bec553c987782f57db254a1de7d0f

                SHA512

                8c4fe9d68cc4319c650e4ff245ff043d40646d1b01b5e27b0dc23c1037b192a566a7ecd84c68da0fc5c1ff503eb77eb05f098bc00f97f777fca8d2707c96659f

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                325KB

                MD5

                41c1552adc391a47e62a1be19281a003

                SHA1

                533b08aee3313530c96ccf1ca9e16e26e216585f

                SHA256

                0689cece670edb4a86f6f7c04f3337bc385bec553c987782f57db254a1de7d0f

                SHA512

                8c4fe9d68cc4319c650e4ff245ff043d40646d1b01b5e27b0dc23c1037b192a566a7ecd84c68da0fc5c1ff503eb77eb05f098bc00f97f777fca8d2707c96659f

              • memory/2736-31-0x00007FFC50F80000-0x00007FFC5196C000-memory.dmp

                Filesize

                9.9MB

              • memory/2736-29-0x00007FFC50F80000-0x00007FFC5196C000-memory.dmp

                Filesize

                9.9MB

              • memory/2736-28-0x0000000000E00000-0x0000000000E0A000-memory.dmp

                Filesize

                40KB

              • memory/4824-46-0x0000000000DF0000-0x0000000000DF6000-memory.dmp

                Filesize

                24KB

              • memory/4824-45-0x0000000072760000-0x0000000072E4E000-memory.dmp

                Filesize

                6.9MB

              • memory/4824-47-0x000000000AAB0000-0x000000000B0B6000-memory.dmp

                Filesize

                6.0MB

              • memory/4824-48-0x000000000A5B0000-0x000000000A6BA000-memory.dmp

                Filesize

                1.0MB

              • memory/4824-49-0x000000000A4D0000-0x000000000A4E2000-memory.dmp

                Filesize

                72KB

              • memory/4824-50-0x000000000A530000-0x000000000A56E000-memory.dmp

                Filesize

                248KB

              • memory/4824-51-0x000000000A6C0000-0x000000000A70B000-memory.dmp

                Filesize

                300KB

              • memory/4824-52-0x0000000072760000-0x0000000072E4E000-memory.dmp

                Filesize

                6.9MB

              • memory/4824-44-0x0000000000790000-0x00000000007C0000-memory.dmp

                Filesize

                192KB

              • memory/4824-54-0x0000000072760000-0x0000000072E4E000-memory.dmp

                Filesize

                6.9MB