Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30e13a10fd6...cb.exe
windows10-2004-x64
100f3fc05fe2...99.exe
windows10-2004-x64
101437361c67...55.exe
windows10-2004-x64
1023bea5b85d...33.exe
windows10-2004-x64
1027054c4ef8...56.exe
windows10-2004-x64
102b700615cb...c1.exe
windows10-2004-x64
1030fb90dbd1...b4.exe
windows10-2004-x64
10312c299a84...a6.exe
windows7-x64
3312c299a84...a6.exe
windows10-2004-x64
1035d50aca92...42.exe
windows10-2004-x64
10627c0990f7...d9.exe
windows10-2004-x64
1065db5d7052...3e.exe
windows10-2004-x64
10677afbc183...fd.exe
windows7-x64
3677afbc183...fd.exe
windows10-2004-x64
10841ea03e18...82.exe
windows10-2004-x64
1085594a9dff...ab.exe
windows10-2004-x64
108c7a2623ea...7d.exe
windows10-2004-x64
109a0ecac5f6...8e.exe
windows10-2004-x64
10adaea581d9...c2.exe
windows10-2004-x64
10c64d3873d4...2e.exe
windows10-2004-x64
10ffa14d4c0b...02.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 15:04
Static task
static1
Behavioral task
behavioral1
Sample
0e13a10fd67a47892e598c6953856fd7786d3e7b1f70c519cae5cfe6b7ce37cb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
0f3fc05fe2db9d3b03c0b7d1c6af9353f3d7c1d340577a71dabad5617658cb99.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
1437361c67b59d113cebaa24a142650e8b8b3172ab6a6714c71515ad86d9fa55.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
23bea5b85d6bafc9a62fa8bb8337d9c39b8f4f7d139c32113e8eaa6099afc933.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
27054c4ef87730930ab8bbec2331b567a7518f766c3e7f55e066fb7014ae3556.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2b700615cbaa89c4d3e0272582a4db8e51bcfe6c3333a5be92e93784b2855ac1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
312c299a844cf7520e53edede1e26057b44acb35e70aba017a6e87804cd037a6.exe
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
312c299a844cf7520e53edede1e26057b44acb35e70aba017a6e87804cd037a6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
35d50aca923965e5a644e1735c8cd657d562282a8fddd8a654982c84f9258342.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
627c0990f7c6fa8cc9a276966f3e2b428f8323bdd73c68bdf8034799f948f0d9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
65db5d7052987e7e8d814719a1e9c77b7d0f755b7f100a0b3f0b0d1b83d9b43e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
841ea03e181082fcf7f5533397a6731021c045058047518f2795b78fd69dda82.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
85594a9dffbaaedca9ea95760b5683bb9ed199e29a54525ac755697a6e18aaab.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
8c7a2623ea0bfbad72a17add57243068958fa7289cd1319d5cbc3af84eeac07d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
adaea581d959a8c0e4a570708711cc0a4112daa9ef8d47d1f5dafe486a1b32c2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
ffa14d4c0be8bc789970a81ab0d1c4ceb689e261224f173a8dbd9609a9b45102.exe
Resource
win10v2004-20240508-en
General
-
Target
9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe
-
Size
514KB
-
MD5
4487e1cdd58ccb52a46645553b956baf
-
SHA1
cddeb1a3b04d8998c32b47fcee9e4c13d4e409a5
-
SHA256
9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e
-
SHA512
012887d77f077ae49a77ef250c4b3292d8207690be2ca30d8803a7949698941f2fb9c0f34ac6c4d2b99a9eaf49f0208903661ff97566cef19ac1cdeac00b93eb
-
SSDEEP
12288:kMrdy90Me2oz7msLFkKLvUdJ+g5xbPJDMA9u2puSgF5cQrwmmU0:xy7m7mmVvU1xbPJMt2pxC0
Malware Config
Extracted
amadey
3.86
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
lande
77.91.124.84:19071
-
auth_value
9fa41701c47df37786234f3373f21208
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral18/files/0x0008000000023405-19.dat healer behavioral18/memory/220-22-0x00000000001B0000-0x00000000001BA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a4970158.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a4970158.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a4970158.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a4970158.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a4970158.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a4970158.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral18/files/0x0007000000023400-43.dat family_redline behavioral18/memory/4692-45-0x0000000000DA0000-0x0000000000DD0000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation pdates.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation b1092387.exe -
Executes dropped EXE 9 IoCs
pid Process 2756 v4933227.exe 4152 v3623236.exe 220 a4970158.exe 756 b1092387.exe 5092 pdates.exe 3740 c4322296.exe 4692 d7564572.exe 3596 pdates.exe 4316 pdates.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a4970158.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v4933227.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v3623236.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4322296.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4322296.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4322296.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4016 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 220 a4970158.exe 220 a4970158.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 220 a4970158.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 756 b1092387.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4772 wrote to memory of 2756 4772 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe 81 PID 4772 wrote to memory of 2756 4772 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe 81 PID 4772 wrote to memory of 2756 4772 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe 81 PID 2756 wrote to memory of 4152 2756 v4933227.exe 83 PID 2756 wrote to memory of 4152 2756 v4933227.exe 83 PID 2756 wrote to memory of 4152 2756 v4933227.exe 83 PID 4152 wrote to memory of 220 4152 v3623236.exe 84 PID 4152 wrote to memory of 220 4152 v3623236.exe 84 PID 4152 wrote to memory of 756 4152 v3623236.exe 90 PID 4152 wrote to memory of 756 4152 v3623236.exe 90 PID 4152 wrote to memory of 756 4152 v3623236.exe 90 PID 756 wrote to memory of 5092 756 b1092387.exe 91 PID 756 wrote to memory of 5092 756 b1092387.exe 91 PID 756 wrote to memory of 5092 756 b1092387.exe 91 PID 2756 wrote to memory of 3740 2756 v4933227.exe 92 PID 2756 wrote to memory of 3740 2756 v4933227.exe 92 PID 2756 wrote to memory of 3740 2756 v4933227.exe 92 PID 4772 wrote to memory of 4692 4772 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe 94 PID 4772 wrote to memory of 4692 4772 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe 94 PID 4772 wrote to memory of 4692 4772 9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe 94 PID 5092 wrote to memory of 4016 5092 pdates.exe 93 PID 5092 wrote to memory of 4016 5092 pdates.exe 93 PID 5092 wrote to memory of 4016 5092 pdates.exe 93 PID 5092 wrote to memory of 5016 5092 pdates.exe 96 PID 5092 wrote to memory of 5016 5092 pdates.exe 96 PID 5092 wrote to memory of 5016 5092 pdates.exe 96 PID 5016 wrote to memory of 1696 5016 cmd.exe 98 PID 5016 wrote to memory of 1696 5016 cmd.exe 98 PID 5016 wrote to memory of 1696 5016 cmd.exe 98 PID 5016 wrote to memory of 4556 5016 cmd.exe 99 PID 5016 wrote to memory of 4556 5016 cmd.exe 99 PID 5016 wrote to memory of 4556 5016 cmd.exe 99 PID 5016 wrote to memory of 1948 5016 cmd.exe 100 PID 5016 wrote to memory of 1948 5016 cmd.exe 100 PID 5016 wrote to memory of 1948 5016 cmd.exe 100 PID 5016 wrote to memory of 4796 5016 cmd.exe 101 PID 5016 wrote to memory of 4796 5016 cmd.exe 101 PID 5016 wrote to memory of 4796 5016 cmd.exe 101 PID 5016 wrote to memory of 1676 5016 cmd.exe 102 PID 5016 wrote to memory of 1676 5016 cmd.exe 102 PID 5016 wrote to memory of 1676 5016 cmd.exe 102 PID 5016 wrote to memory of 2768 5016 cmd.exe 103 PID 5016 wrote to memory of 2768 5016 cmd.exe 103 PID 5016 wrote to memory of 2768 5016 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe"C:\Users\Admin\AppData\Local\Temp\9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4933227.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4933227.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3623236.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3623236.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4970158.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4970158.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1092387.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1092387.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F6⤵
- Creates scheduled task(s)
PID:4016
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"7⤵PID:4556
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E7⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4796
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"7⤵PID:1676
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E7⤵PID:2768
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4322296.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4322296.exe3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3740
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7564572.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7564572.exe2⤵
- Executes dropped EXE
PID:4692
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:3596
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4316
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD5199269ce88604882efe788faab582aa9
SHA12f1f18318b7f895a99af1e2bc156156cda96e495
SHA256836375a91b2c9d90834283b30a84b968d3056ade7f0964f83b98e48a005509e4
SHA5128a6dcbe7e46ee1db540c2e24f0e48f173670076e21ebe906f09944bdb23623bc608f78b43671ed2a80a65572a330fcb72820da2fa5b718a844bce2f498b8ed6d
-
Filesize
359KB
MD5d33c8dd5dda29e2ea9759873a2e3b3a1
SHA1509427faf68a39997bcef4397894e8ac9a89715b
SHA256c78049d14da228c4659d831031cc94fa3d1e253480dea1114b8ea9652835dc1c
SHA51295daea4171fae18b782e5e9716e3fc8f46302dd6883a86e4f03bc80c5c2c7a4ab87c8f356df998c6cdcef735af0cf7dda6bfb82c2478d9ed0186c466c1fd13b3
-
Filesize
36KB
MD5b201bc33c41cebb6d9b86d7224eac438
SHA13549a2e2b561dd6bf68a9b7aa21d240c3d87a8db
SHA256fcc6ea0459be99bc3a272443ee71b1d520c1c88860222ce13fcadf7234ccd4a6
SHA512ea5f1379a02f07161dbbbfd0a0c8b96f26dbcbd24fc9867d14c762cb9782beb8bcfed412ca69e1ad1f8a7b7669847c205b18bde309f9f7ec23f117d64a5368ab
-
Filesize
234KB
MD5c3ad2c9316385e72f6fdc34de05fefcb
SHA1cb78a11ba6eb5c458b9f19877dac42dccacf1d33
SHA2569080ecd6ed268534fadb6a6dbfa327fc64ec426ce249199e5059e154b1bc8b78
SHA5120943b21c02037aea583f799ef2e6fa271b48925c5d22af687b3ff217a7a968e2b5a456678678284b6a288c50a3c104dc728884f4390295ef0c79319f73b55724
-
Filesize
13KB
MD5b9f7307f3344963173587f481cf79702
SHA1d1771c11330d7f05b465837268f1993d16a50ef9
SHA2563f1deb49ae3b7e8074b543490e6a24045c16a73102668c09729a4decb3260068
SHA512ef449c472223eddfd606b5035962564da2b3b47e46dd7bb796e8565f14349bc1edd9e716d4b288d65dda044d47f1ee527554d130f0de6b6cf4d78a1b2e0741f5
-
Filesize
225KB
MD54ee04c7a61cb61464ec80dee700e8040
SHA1e55aee97f689833c7800aac29bcec07933aa8c9e
SHA256302755f30c53cbf31bb07d154f236ea3e8ee3c90b7770e95dfaf953fb8e01826
SHA51275f920345b8f2832606bf636f1586badcdab49b42c8b7053c214bb36e5c4996b37c08c015dcdb674bd2c568e8add18085510255001747e7442537064ea4df36b