Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
300b85ef681...3c.exe
windows7-x64
300b85ef681...3c.exe
windows10-2004-x64
1002fa9e870a...3b.exe
windows10-2004-x64
1021feb39957...32.exe
windows10-2004-x64
1022f65486ce...8c.exe
windows10-2004-x64
10230ec3f2c3...5e.exe
windows10-2004-x64
102ea5e26c15...e7.exe
windows10-2004-x64
103352e66593...91.exe
windows10-2004-x64
93a8a7d42c4...54.exe
windows10-2004-x64
1055872fee0d...a2.exe
windows7-x64
355872fee0d...a2.exe
windows10-2004-x64
105c4e8c59ce...96.exe
windows10-2004-x64
109eded57acf...94.exe
windows10-2004-x64
10ab1944db7d...fc.exe
windows10-2004-x64
10ac6f6a7901...6b.exe
windows10-2004-x64
10afa70bcf38...3a.exe
windows10-2004-x64
10c4490bf883...30.exe
windows10-2004-x64
10c648954590...a2.exe
windows10-2004-x64
10d5755dadc9...b2.exe
windows10-2004-x64
10f066a86310...dd.exe
windows7-x64
10f066a86310...dd.exe
windows10-2004-x64
10fa130ffbae...7e.exe
windows10-2004-x64
10ffca01eab5...09.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00b85ef681a2709f477253e1b189f4cbad5160e677d7c1640519def540c2fb3c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
230ec3f2c3ef81a9a14c2fc686c0aa21d93d3cca8dca04a8ecb90dd3c54c0f5e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
3352e66593f9d652c7f760070d266d43ca2ba74eca75114c78a92c09c1a1c391.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
3a8a7d42c4509a4814d5eb963c05afb11363688b72aa7535816ae86e20bcf654.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
55872fee0d31d2f9381e3b62d592835be2ee776ce2c69397061fc06d6efa5ea2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
5c4e8c59ce4b4f21acc7d26ba988d8f069d256569e9565b33d865a9859a5ba96.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
9eded57acff39eca8ffe9167fa52ac5a352e13a9ce3d0f0696a5a69bf589b794.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
ac6f6a79014cf8f7e7574684eefac7be8456184590031637c4329470e2c2d66b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
afa70bcf383e33af9cbc128ccd361170f3a0ea3cd99315128edb8e1a80aad23a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
d5755dadc9af9cde67934873a4cde67dc43f1cec089cfbeef71140b67d9912b2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
fa130ffbae77f393b8c3761880769505ffbb2fe708e7fc375f0bf42732542b7e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09.exe
Resource
win10v2004-20240508-en
General
-
Target
c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe
-
Size
515KB
-
MD5
9b8021b570f8537a35e6473425712c56
-
SHA1
7705fbc7332b2945c16d51929584bbdce269f6e6
-
SHA256
c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30
-
SHA512
d84bf9600a08d87179230da9fa4655fbe0dfcfd4667eb19ac5d26ac9850f8920a81ad2c93e1859ee1841e0353bd7b339c671608211dc145effb731bd1b994247
-
SSDEEP
12288:kMr8y90/KKxfRPj6YJEv/IxjywHcI5kbhvfLoG0Ql2fQfz:4y6G/sjAYih0K2Qz
Malware Config
Extracted
amadey
3.85
http://77.91.68.3
-
install_dir
3ec1f323b5
-
install_file
danke.exe
-
strings_key
827021be90f1e85ab27949ea7e9347e8
-
url_paths
/home/love/index.php
Extracted
redline
grom
77.91.68.68:19071
-
auth_value
9ec3129bff410b89097d656d7abc33dc
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral17/files/0x00080000000233ea-19.dat healer behavioral17/memory/1456-22-0x0000000000360000-0x000000000036A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6374392.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6374392.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6374392.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6374392.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6374392.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6374392.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral17/files/0x00070000000233e5-42.dat family_redline behavioral17/memory/1376-44-0x0000000000FB0000-0x0000000000FE0000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation b3417358.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 9 IoCs
pid Process 3192 v3919422.exe 3196 v6386104.exe 1456 a6374392.exe 2220 b3417358.exe 4656 danke.exe 2840 c7654671.exe 1376 d3796674.exe 1272 danke.exe 2900 danke.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6374392.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3919422.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v6386104.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7654671.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7654671.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7654671.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1456 a6374392.exe 1456 a6374392.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1456 a6374392.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2400 wrote to memory of 3192 2400 c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe 82 PID 2400 wrote to memory of 3192 2400 c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe 82 PID 2400 wrote to memory of 3192 2400 c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe 82 PID 3192 wrote to memory of 3196 3192 v3919422.exe 84 PID 3192 wrote to memory of 3196 3192 v3919422.exe 84 PID 3192 wrote to memory of 3196 3192 v3919422.exe 84 PID 3196 wrote to memory of 1456 3196 v6386104.exe 85 PID 3196 wrote to memory of 1456 3196 v6386104.exe 85 PID 3196 wrote to memory of 2220 3196 v6386104.exe 87 PID 3196 wrote to memory of 2220 3196 v6386104.exe 87 PID 3196 wrote to memory of 2220 3196 v6386104.exe 87 PID 2220 wrote to memory of 4656 2220 b3417358.exe 88 PID 2220 wrote to memory of 4656 2220 b3417358.exe 88 PID 2220 wrote to memory of 4656 2220 b3417358.exe 88 PID 3192 wrote to memory of 2840 3192 v3919422.exe 89 PID 3192 wrote to memory of 2840 3192 v3919422.exe 89 PID 3192 wrote to memory of 2840 3192 v3919422.exe 89 PID 4656 wrote to memory of 816 4656 danke.exe 90 PID 4656 wrote to memory of 816 4656 danke.exe 90 PID 4656 wrote to memory of 816 4656 danke.exe 90 PID 4656 wrote to memory of 3616 4656 danke.exe 92 PID 4656 wrote to memory of 3616 4656 danke.exe 92 PID 4656 wrote to memory of 3616 4656 danke.exe 92 PID 3616 wrote to memory of 3596 3616 cmd.exe 94 PID 3616 wrote to memory of 3596 3616 cmd.exe 94 PID 3616 wrote to memory of 3596 3616 cmd.exe 94 PID 3616 wrote to memory of 4016 3616 cmd.exe 95 PID 3616 wrote to memory of 4016 3616 cmd.exe 95 PID 3616 wrote to memory of 4016 3616 cmd.exe 95 PID 3616 wrote to memory of 3944 3616 cmd.exe 96 PID 3616 wrote to memory of 3944 3616 cmd.exe 96 PID 3616 wrote to memory of 3944 3616 cmd.exe 96 PID 3616 wrote to memory of 4596 3616 cmd.exe 97 PID 3616 wrote to memory of 4596 3616 cmd.exe 97 PID 3616 wrote to memory of 4596 3616 cmd.exe 97 PID 3616 wrote to memory of 4188 3616 cmd.exe 98 PID 3616 wrote to memory of 4188 3616 cmd.exe 98 PID 3616 wrote to memory of 4188 3616 cmd.exe 98 PID 3616 wrote to memory of 3464 3616 cmd.exe 99 PID 3616 wrote to memory of 3464 3616 cmd.exe 99 PID 3616 wrote to memory of 3464 3616 cmd.exe 99 PID 2400 wrote to memory of 1376 2400 c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe 102 PID 2400 wrote to memory of 1376 2400 c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe 102 PID 2400 wrote to memory of 1376 2400 c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe"C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F6⤵
- Creates scheduled task(s)
PID:816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3596
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"7⤵PID:4016
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E7⤵PID:3944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4596
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"7⤵PID:4188
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E7⤵PID:3464
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2840
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2900
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD58358cb2d3f34962fc91719d288c15e8b
SHA19c16e75f8f7ed88411166d0b2b8bb3449c29194f
SHA256eeb937d59976fbd8e84eb2467d322cc7f7a023792d64d5efd9fd73f6f86d5579
SHA512fcb8a872a7ec7deddcfd527736089a2b1d38199394eaa107d34ed95e8576d83f3baf000c355542e7f6433e903709fc7d70188ac96feac7bdfce348820efe45e8
-
Filesize
359KB
MD51acae507d505295617d1d9e35e7ff325
SHA15a51d767e542eb063cad3c1a1941eacd79c5615f
SHA2569650beff753142aee81cebf4cea8713c3082ebadbc85da42918cbbef073a6100
SHA51264d960be85e8cdee0f34a077fab0b1f30df25834a2bf95d746de407caa193fcaa1ad27582d64b9056c718da2f040b5ee4472d6be025db729b265eab9ca0153d3
-
Filesize
33KB
MD5de08a9da7e87ccd216528a8af6a17ae7
SHA1acd05b906646ae038db6a14d161ea5944f0a7d74
SHA25611fb638def845950f74c9ef33f6efc5c21e23523253641015cc9fb9fd9d51c01
SHA512296f79f1a902fba21955d625e47a7d422a916b5511105c0e68e04f3917dc2d9939aceb0679b97ca0f89cd02154b441c240cca9f23927dc9f4e5b7bc9aa606892
-
Filesize
235KB
MD5bbb9f75f658955c74b106491947e7515
SHA1eb2095b2e7fe352c81bebf76163f338e729c4e7c
SHA2561a64590efa05eaf5cdbf115ea5865adc8b36d3d7b190276dbf82f92fdb8c525d
SHA512f2cd98b8e757b0f66ccbc09f6823f9b36ac03eb8539d78bbfb026d7f353eda55f8b8df6f64932b0a3b070705a1d9dec722b31caddaa942c107d810682b430053
-
Filesize
16KB
MD5548c2b9bf640901f69dbebe16314c8e3
SHA1117bb6831e7b0ccf87eb362839cc01edec17b0f9
SHA256657b1e6fc8c9a038b6cfeea43a3fb4750850733150359938e410812b33d07bd1
SHA5124e8198b8e48c589e81dd1d0f63639cf1b9a0e83ee52c707c4ed0ce068393f2e5386d82509cb306894c34ae5e4413e66886d09ca06c5e86ad5443f3e90fa523c9
-
Filesize
228KB
MD5c57d8839d9005c5ee82c1c9423470c60
SHA15f5db7ad592e1e58af4a7cac6da93bcea6b782e6
SHA256304e1585904538f133c315e7f96e2b47b018e8b3dc968d489a6abf1ff61de0ab
SHA51284a7427b6ab249ec1a0075fb4c6251c4c37b408d528836b570c9199a32c0bf3769e3aab12833aef1e80af52e83ab06f2367ec7b44ad9f3f6bdf8d6d9c2ace0d5