Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30e13a10fd6...cb.exe
windows10-2004-x64
100f3fc05fe2...99.exe
windows10-2004-x64
101437361c67...55.exe
windows10-2004-x64
1023bea5b85d...33.exe
windows10-2004-x64
1027054c4ef8...56.exe
windows10-2004-x64
102b700615cb...c1.exe
windows10-2004-x64
1030fb90dbd1...b4.exe
windows10-2004-x64
10312c299a84...a6.exe
windows7-x64
3312c299a84...a6.exe
windows10-2004-x64
1035d50aca92...42.exe
windows10-2004-x64
10627c0990f7...d9.exe
windows10-2004-x64
1065db5d7052...3e.exe
windows10-2004-x64
10677afbc183...fd.exe
windows7-x64
3677afbc183...fd.exe
windows10-2004-x64
10841ea03e18...82.exe
windows10-2004-x64
1085594a9dff...ab.exe
windows10-2004-x64
108c7a2623ea...7d.exe
windows10-2004-x64
109a0ecac5f6...8e.exe
windows10-2004-x64
10adaea581d9...c2.exe
windows10-2004-x64
10c64d3873d4...2e.exe
windows10-2004-x64
10ffa14d4c0b...02.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 15:04
Static task
static1
Behavioral task
behavioral1
Sample
0e13a10fd67a47892e598c6953856fd7786d3e7b1f70c519cae5cfe6b7ce37cb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
0f3fc05fe2db9d3b03c0b7d1c6af9353f3d7c1d340577a71dabad5617658cb99.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
1437361c67b59d113cebaa24a142650e8b8b3172ab6a6714c71515ad86d9fa55.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
23bea5b85d6bafc9a62fa8bb8337d9c39b8f4f7d139c32113e8eaa6099afc933.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
27054c4ef87730930ab8bbec2331b567a7518f766c3e7f55e066fb7014ae3556.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2b700615cbaa89c4d3e0272582a4db8e51bcfe6c3333a5be92e93784b2855ac1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
312c299a844cf7520e53edede1e26057b44acb35e70aba017a6e87804cd037a6.exe
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
312c299a844cf7520e53edede1e26057b44acb35e70aba017a6e87804cd037a6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
35d50aca923965e5a644e1735c8cd657d562282a8fddd8a654982c84f9258342.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
627c0990f7c6fa8cc9a276966f3e2b428f8323bdd73c68bdf8034799f948f0d9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
65db5d7052987e7e8d814719a1e9c77b7d0f755b7f100a0b3f0b0d1b83d9b43e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
677afbc18346258efc780d794cf589d9e949ec77c0f68fc663b38c6f663cf7fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
841ea03e181082fcf7f5533397a6731021c045058047518f2795b78fd69dda82.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
85594a9dffbaaedca9ea95760b5683bb9ed199e29a54525ac755697a6e18aaab.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
8c7a2623ea0bfbad72a17add57243068958fa7289cd1319d5cbc3af84eeac07d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
9a0ecac5f61531b0c28426e6e97edeaa0c930397169075cb98b077174beb638e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
adaea581d959a8c0e4a570708711cc0a4112daa9ef8d47d1f5dafe486a1b32c2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
ffa14d4c0be8bc789970a81ab0d1c4ceb689e261224f173a8dbd9609a9b45102.exe
Resource
win10v2004-20240508-en
General
-
Target
c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe
-
Size
390KB
-
MD5
3e0e0e6d1b148a974f44ed81e76b4daa
-
SHA1
6e500bf32412d5f02b5994e016a1c3ee577a1f9b
-
SHA256
c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e
-
SHA512
2cd132b1d0adabf219069588447a1ba17492b0b362b47e6668fd09543f71a9d18a974497dcc077af549d243984ace87b4cafa74c9feb55cae31a8dac7964533d
-
SSDEEP
6144:KNy+bnr+Yp0yN90QEtdzHtFJ+5AnfcYNRAdFnD8AVDQ1NWXy//Sm7kk5nrKA/t:zMrAy90ZHLmGEFI3+y//sk5nrKAl
Malware Config
Extracted
amadey
3.86
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
lande
77.91.124.84:19071
-
auth_value
9fa41701c47df37786234f3373f21208
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral20/files/0x00080000000233d4-12.dat healer behavioral20/memory/2604-15-0x0000000000CB0000-0x0000000000CBA000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k2697586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k2697586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k2697586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k2697586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k2697586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k2697586.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral20/files/0x00070000000233d2-31.dat family_redline behavioral20/memory/2508-33-0x0000000000F40000-0x0000000000F70000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation l6731967.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation pdates.exe -
Executes dropped EXE 7 IoCs
pid Process 3796 y2130083.exe 2604 k2697586.exe 4032 l6731967.exe 692 pdates.exe 2508 n0091138.exe 1772 pdates.exe 5084 pdates.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k2697586.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y2130083.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2604 k2697586.exe 2604 k2697586.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2604 k2697586.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2140 wrote to memory of 3796 2140 c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe 81 PID 2140 wrote to memory of 3796 2140 c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe 81 PID 2140 wrote to memory of 3796 2140 c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe 81 PID 3796 wrote to memory of 2604 3796 y2130083.exe 82 PID 3796 wrote to memory of 2604 3796 y2130083.exe 82 PID 3796 wrote to memory of 4032 3796 y2130083.exe 83 PID 3796 wrote to memory of 4032 3796 y2130083.exe 83 PID 3796 wrote to memory of 4032 3796 y2130083.exe 83 PID 4032 wrote to memory of 692 4032 l6731967.exe 84 PID 4032 wrote to memory of 692 4032 l6731967.exe 84 PID 4032 wrote to memory of 692 4032 l6731967.exe 84 PID 2140 wrote to memory of 2508 2140 c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe 85 PID 2140 wrote to memory of 2508 2140 c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe 85 PID 2140 wrote to memory of 2508 2140 c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe 85 PID 692 wrote to memory of 2688 692 pdates.exe 86 PID 692 wrote to memory of 2688 692 pdates.exe 86 PID 692 wrote to memory of 2688 692 pdates.exe 86 PID 692 wrote to memory of 1596 692 pdates.exe 87 PID 692 wrote to memory of 1596 692 pdates.exe 87 PID 692 wrote to memory of 1596 692 pdates.exe 87 PID 1596 wrote to memory of 628 1596 cmd.exe 90 PID 1596 wrote to memory of 628 1596 cmd.exe 90 PID 1596 wrote to memory of 628 1596 cmd.exe 90 PID 1596 wrote to memory of 1764 1596 cmd.exe 91 PID 1596 wrote to memory of 1764 1596 cmd.exe 91 PID 1596 wrote to memory of 1764 1596 cmd.exe 91 PID 1596 wrote to memory of 1940 1596 cmd.exe 92 PID 1596 wrote to memory of 1940 1596 cmd.exe 92 PID 1596 wrote to memory of 1940 1596 cmd.exe 92 PID 1596 wrote to memory of 1580 1596 cmd.exe 93 PID 1596 wrote to memory of 1580 1596 cmd.exe 93 PID 1596 wrote to memory of 1580 1596 cmd.exe 93 PID 1596 wrote to memory of 1896 1596 cmd.exe 94 PID 1596 wrote to memory of 1896 1596 cmd.exe 94 PID 1596 wrote to memory of 1896 1596 cmd.exe 94 PID 1596 wrote to memory of 1564 1596 cmd.exe 95 PID 1596 wrote to memory of 1564 1596 cmd.exe 95 PID 1596 wrote to memory of 1564 1596 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe"C:\Users\Admin\AppData\Local\Temp\c64d3873d4dbf74d0c6e28f27a09adb2a8c897e218d1a4a4f5822391bf80c92e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2130083.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2130083.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2697586.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2697586.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6731967.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6731967.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F5⤵
- Creates scheduled task(s)
PID:2688
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:628
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"6⤵PID:1764
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E6⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1580
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"6⤵PID:1896
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E6⤵PID:1564
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0091138.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0091138.exe2⤵
- Executes dropped EXE
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:1772
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:5084
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD545f44d5c51aafc516cf8361354996963
SHA11cac62d935987acdd12eefccba925e00429c8451
SHA256e161c60286bae32f64473bc006d9b32759678e9a130be1491f95eb6f4308c48f
SHA5123dbd14766f59278abd2bb286daff70001cd505d8cb5ac9b056cd1b98b31feb2caadddda7a54d84ad5ed0ef21ed67b2dccdd83fc187d2e7b0eff604982684ec52
-
Filesize
234KB
MD5442435d72bf87c742d136fd0ee857aa7
SHA1d5a5c1e0fec4bdb78ea9c78566f1d6ac2db289dc
SHA2561d681c45e7362d1a2079e17c36d42a60307e7ab444cb7781129ed2e23567ef62
SHA5126cc423388674813d33117894f91550dbab27a8b09996e2c506e1fe179ebe51dce0dbd1308860364a8a12ef8a827153c4dfe832470968a2f60efa0cf8fb7eaab7
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434