Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2023, 15:09
Behavioral task
behavioral1
Sample
0x000600000001680a-52.exe
Resource
win7-20230831-en
General
-
Target
0x000600000001680a-52.exe
-
Size
330KB
-
MD5
db14bfcc5900e14fdee411b445e82121
-
SHA1
8291e6a03ea20bf246b6f0527984a57abc598c0f
-
SHA256
6a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6
-
SHA512
518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc
-
SSDEEP
6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation 0x000600000001680a-52.exe Key value queried \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation saves.exe -
Executes dropped EXE 3 IoCs
pid Process 3764 saves.exe 4252 saves.exe 1136 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 964 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4556 schtasks.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4176 wrote to memory of 3764 4176 0x000600000001680a-52.exe 78 PID 4176 wrote to memory of 3764 4176 0x000600000001680a-52.exe 78 PID 4176 wrote to memory of 3764 4176 0x000600000001680a-52.exe 78 PID 3764 wrote to memory of 4556 3764 saves.exe 79 PID 3764 wrote to memory of 4556 3764 saves.exe 79 PID 3764 wrote to memory of 4556 3764 saves.exe 79 PID 3764 wrote to memory of 4104 3764 saves.exe 81 PID 3764 wrote to memory of 4104 3764 saves.exe 81 PID 3764 wrote to memory of 4104 3764 saves.exe 81 PID 4104 wrote to memory of 764 4104 cmd.exe 83 PID 4104 wrote to memory of 764 4104 cmd.exe 83 PID 4104 wrote to memory of 764 4104 cmd.exe 83 PID 4104 wrote to memory of 2488 4104 cmd.exe 84 PID 4104 wrote to memory of 2488 4104 cmd.exe 84 PID 4104 wrote to memory of 2488 4104 cmd.exe 84 PID 4104 wrote to memory of 1856 4104 cmd.exe 85 PID 4104 wrote to memory of 1856 4104 cmd.exe 85 PID 4104 wrote to memory of 1856 4104 cmd.exe 85 PID 4104 wrote to memory of 4952 4104 cmd.exe 86 PID 4104 wrote to memory of 4952 4104 cmd.exe 86 PID 4104 wrote to memory of 4952 4104 cmd.exe 86 PID 4104 wrote to memory of 856 4104 cmd.exe 87 PID 4104 wrote to memory of 856 4104 cmd.exe 87 PID 4104 wrote to memory of 856 4104 cmd.exe 87 PID 4104 wrote to memory of 2512 4104 cmd.exe 88 PID 4104 wrote to memory of 2512 4104 cmd.exe 88 PID 4104 wrote to memory of 2512 4104 cmd.exe 88 PID 3764 wrote to memory of 964 3764 saves.exe 90 PID 3764 wrote to memory of 964 3764 saves.exe 90 PID 3764 wrote to memory of 964 3764 saves.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000600000001680a-52.exe"C:\Users\Admin\AppData\Local\Temp\0x000600000001680a-52.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F3⤵
- Creates scheduled task(s)
PID:4556
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:764
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"4⤵PID:2488
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E4⤵PID:1856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4952
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"4⤵PID:856
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E4⤵PID:2512
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4252
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD5db14bfcc5900e14fdee411b445e82121
SHA18291e6a03ea20bf246b6f0527984a57abc598c0f
SHA2566a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6
SHA512518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc
-
Filesize
330KB
MD5db14bfcc5900e14fdee411b445e82121
SHA18291e6a03ea20bf246b6f0527984a57abc598c0f
SHA2566a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6
SHA512518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc
-
Filesize
330KB
MD5db14bfcc5900e14fdee411b445e82121
SHA18291e6a03ea20bf246b6f0527984a57abc598c0f
SHA2566a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6
SHA512518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc
-
Filesize
330KB
MD5db14bfcc5900e14fdee411b445e82121
SHA18291e6a03ea20bf246b6f0527984a57abc598c0f
SHA2566a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6
SHA512518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc
-
Filesize
330KB
MD5db14bfcc5900e14fdee411b445e82121
SHA18291e6a03ea20bf246b6f0527984a57abc598c0f
SHA2566a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6
SHA512518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7