Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/09/2023, 02:09
Behavioral task
behavioral1
Sample
0x0006000000017551-80.exe
Resource
win7-20230831-en
General
-
Target
0x0006000000017551-80.exe
-
Size
332KB
-
MD5
63eef972609679f480b75a2e944c20fb
-
SHA1
70d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
-
SHA256
437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
-
SHA512
70214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
SSDEEP
6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2956 saves.exe 2472 saves.exe 2168 saves.exe -
Loads dropped DLL 5 IoCs
pid Process 2196 0x0006000000017551-80.exe 2756 rundll32.exe 2756 rundll32.exe 2756 rundll32.exe 2756 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1956 schtasks.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2956 2196 0x0006000000017551-80.exe 28 PID 2196 wrote to memory of 2956 2196 0x0006000000017551-80.exe 28 PID 2196 wrote to memory of 2956 2196 0x0006000000017551-80.exe 28 PID 2196 wrote to memory of 2956 2196 0x0006000000017551-80.exe 28 PID 2956 wrote to memory of 1956 2956 saves.exe 29 PID 2956 wrote to memory of 1956 2956 saves.exe 29 PID 2956 wrote to memory of 1956 2956 saves.exe 29 PID 2956 wrote to memory of 1956 2956 saves.exe 29 PID 2956 wrote to memory of 2688 2956 saves.exe 31 PID 2956 wrote to memory of 2688 2956 saves.exe 31 PID 2956 wrote to memory of 2688 2956 saves.exe 31 PID 2956 wrote to memory of 2688 2956 saves.exe 31 PID 2688 wrote to memory of 2732 2688 cmd.exe 33 PID 2688 wrote to memory of 2732 2688 cmd.exe 33 PID 2688 wrote to memory of 2732 2688 cmd.exe 33 PID 2688 wrote to memory of 2732 2688 cmd.exe 33 PID 2688 wrote to memory of 2984 2688 cmd.exe 34 PID 2688 wrote to memory of 2984 2688 cmd.exe 34 PID 2688 wrote to memory of 2984 2688 cmd.exe 34 PID 2688 wrote to memory of 2984 2688 cmd.exe 34 PID 2688 wrote to memory of 2640 2688 cmd.exe 35 PID 2688 wrote to memory of 2640 2688 cmd.exe 35 PID 2688 wrote to memory of 2640 2688 cmd.exe 35 PID 2688 wrote to memory of 2640 2688 cmd.exe 35 PID 2688 wrote to memory of 2624 2688 cmd.exe 36 PID 2688 wrote to memory of 2624 2688 cmd.exe 36 PID 2688 wrote to memory of 2624 2688 cmd.exe 36 PID 2688 wrote to memory of 2624 2688 cmd.exe 36 PID 2688 wrote to memory of 1972 2688 cmd.exe 37 PID 2688 wrote to memory of 1972 2688 cmd.exe 37 PID 2688 wrote to memory of 1972 2688 cmd.exe 37 PID 2688 wrote to memory of 1972 2688 cmd.exe 37 PID 2688 wrote to memory of 2676 2688 cmd.exe 38 PID 2688 wrote to memory of 2676 2688 cmd.exe 38 PID 2688 wrote to memory of 2676 2688 cmd.exe 38 PID 2688 wrote to memory of 2676 2688 cmd.exe 38 PID 2308 wrote to memory of 2472 2308 taskeng.exe 41 PID 2308 wrote to memory of 2472 2308 taskeng.exe 41 PID 2308 wrote to memory of 2472 2308 taskeng.exe 41 PID 2308 wrote to memory of 2472 2308 taskeng.exe 41 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2956 wrote to memory of 2756 2956 saves.exe 44 PID 2308 wrote to memory of 2168 2308 taskeng.exe 45 PID 2308 wrote to memory of 2168 2308 taskeng.exe 45 PID 2308 wrote to memory of 2168 2308 taskeng.exe 45 PID 2308 wrote to memory of 2168 2308 taskeng.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0006000000017551-80.exe"C:\Users\Admin\AppData\Local\Temp\0x0006000000017551-80.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F3⤵
- Creates scheduled task(s)
PID:1956
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2732
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"4⤵PID:2984
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E4⤵PID:2640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2624
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"4⤵PID:1972
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E4⤵PID:2676
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:2756
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {BAF36388-DDDC-42A1-9A41-ED59C966F223} S-1-5-21-3750544865-3773649541-1858556521-1000:XOCYHKRS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD563eef972609679f480b75a2e944c20fb
SHA170d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
SHA256437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
SHA51270214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
Filesize
332KB
MD563eef972609679f480b75a2e944c20fb
SHA170d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
SHA256437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
SHA51270214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
Filesize
332KB
MD563eef972609679f480b75a2e944c20fb
SHA170d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
SHA256437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
SHA51270214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
Filesize
332KB
MD563eef972609679f480b75a2e944c20fb
SHA170d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
SHA256437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
SHA51270214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
Filesize
332KB
MD563eef972609679f480b75a2e944c20fb
SHA170d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
SHA256437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
SHA51270214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
332KB
MD563eef972609679f480b75a2e944c20fb
SHA170d6dc0ecb9f6904ce7b23027de2ec1133cb6ed6
SHA256437d628947fb8f26d0f45d87e6e0810fb8f01031b95d0b9a7111bd96f8d8ea2a
SHA51270214c0725457fbc7e9b75151ef7864dc687f8564d411adc4ce8ab5340c243e0b885e1d4f0ba1b9fa1c9c4894d1a18b82668a4e087920d3b0df444e6fcae385c
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b