Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
238s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
04/09/2023, 01:33
Behavioral task
behavioral1
Sample
h4902123.exe
Resource
win7-20230831-en
General
-
Target
h4902123.exe
-
Size
334KB
-
MD5
fab1b966ec2065fa9223d61596bd721b
-
SHA1
e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
-
SHA256
fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
-
SHA512
df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
SSDEEP
6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2284 saves.exe 1368 saves.exe 2880 saves.exe 2176 saves.exe 2816 saves.exe 2836 saves.exe -
Loads dropped DLL 5 IoCs
pid Process 1728 h4902123.exe 528 rundll32.exe 528 rundll32.exe 528 rundll32.exe 528 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2940 schtasks.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2284 1728 h4902123.exe 28 PID 1728 wrote to memory of 2284 1728 h4902123.exe 28 PID 1728 wrote to memory of 2284 1728 h4902123.exe 28 PID 1728 wrote to memory of 2284 1728 h4902123.exe 28 PID 2284 wrote to memory of 2940 2284 saves.exe 29 PID 2284 wrote to memory of 2940 2284 saves.exe 29 PID 2284 wrote to memory of 2940 2284 saves.exe 29 PID 2284 wrote to memory of 2940 2284 saves.exe 29 PID 2284 wrote to memory of 2644 2284 saves.exe 31 PID 2284 wrote to memory of 2644 2284 saves.exe 31 PID 2284 wrote to memory of 2644 2284 saves.exe 31 PID 2284 wrote to memory of 2644 2284 saves.exe 31 PID 2644 wrote to memory of 2704 2644 cmd.exe 33 PID 2644 wrote to memory of 2704 2644 cmd.exe 33 PID 2644 wrote to memory of 2704 2644 cmd.exe 33 PID 2644 wrote to memory of 2704 2644 cmd.exe 33 PID 2644 wrote to memory of 2720 2644 cmd.exe 34 PID 2644 wrote to memory of 2720 2644 cmd.exe 34 PID 2644 wrote to memory of 2720 2644 cmd.exe 34 PID 2644 wrote to memory of 2720 2644 cmd.exe 34 PID 2644 wrote to memory of 2968 2644 cmd.exe 35 PID 2644 wrote to memory of 2968 2644 cmd.exe 35 PID 2644 wrote to memory of 2968 2644 cmd.exe 35 PID 2644 wrote to memory of 2968 2644 cmd.exe 35 PID 2644 wrote to memory of 2636 2644 cmd.exe 36 PID 2644 wrote to memory of 2636 2644 cmd.exe 36 PID 2644 wrote to memory of 2636 2644 cmd.exe 36 PID 2644 wrote to memory of 2636 2644 cmd.exe 36 PID 2644 wrote to memory of 2604 2644 cmd.exe 37 PID 2644 wrote to memory of 2604 2644 cmd.exe 37 PID 2644 wrote to memory of 2604 2644 cmd.exe 37 PID 2644 wrote to memory of 2604 2644 cmd.exe 37 PID 2644 wrote to memory of 2752 2644 cmd.exe 38 PID 2644 wrote to memory of 2752 2644 cmd.exe 38 PID 2644 wrote to memory of 2752 2644 cmd.exe 38 PID 2644 wrote to memory of 2752 2644 cmd.exe 38 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 2284 wrote to memory of 528 2284 saves.exe 42 PID 772 wrote to memory of 1368 772 taskeng.exe 44 PID 772 wrote to memory of 1368 772 taskeng.exe 44 PID 772 wrote to memory of 1368 772 taskeng.exe 44 PID 772 wrote to memory of 1368 772 taskeng.exe 44 PID 772 wrote to memory of 2880 772 taskeng.exe 45 PID 772 wrote to memory of 2880 772 taskeng.exe 45 PID 772 wrote to memory of 2880 772 taskeng.exe 45 PID 772 wrote to memory of 2880 772 taskeng.exe 45 PID 772 wrote to memory of 2176 772 taskeng.exe 46 PID 772 wrote to memory of 2176 772 taskeng.exe 46 PID 772 wrote to memory of 2176 772 taskeng.exe 46 PID 772 wrote to memory of 2176 772 taskeng.exe 46 PID 772 wrote to memory of 2816 772 taskeng.exe 47 PID 772 wrote to memory of 2816 772 taskeng.exe 47 PID 772 wrote to memory of 2816 772 taskeng.exe 47 PID 772 wrote to memory of 2816 772 taskeng.exe 47 PID 772 wrote to memory of 2836 772 taskeng.exe 48 PID 772 wrote to memory of 2836 772 taskeng.exe 48 PID 772 wrote to memory of 2836 772 taskeng.exe 48 PID 772 wrote to memory of 2836 772 taskeng.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\h4902123.exe"C:\Users\Admin\AppData\Local\Temp\h4902123.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F3⤵
- Creates scheduled task(s)
PID:2940
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2704
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"4⤵PID:2720
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E4⤵PID:2968
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2636
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"4⤵PID:2604
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E4⤵PID:2752
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:528
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {8B1D2821-6C40-4A17-9B44-965EE03CCAD7} S-1-5-21-86725733-3001458681-3405935542-1000:ZWKQHIWB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe2⤵
- Executes dropped EXE
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
334KB
MD5fab1b966ec2065fa9223d61596bd721b
SHA1e9b7ceb9e95e49b2ca230bb035fc574775b07f6a
SHA256fb81babc97f9aa854ea55265c91b858eeae3f4de6fb33cb383e739fb991cd0e7
SHA512df3884fdcaaf2665618100ce9f2a34ff6c13f08a1ca542a260c8c7453980ff8fc28a38338c3c76f8b72cc8c09d8dfd1ab9c765b3504eec25b11719e760607b23
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b