Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
303cef1108b...25.exe
windows10-2004-x64
10062bf5eda9...2b.exe
windows10-2004-x64
101c0cc29edf...ac.exe
windows10-2004-x64
101c46e1db34...f7.exe
windows10-2004-x64
1020811d5e08...84.exe
windows10-2004-x64
1028627b3333...c8.exe
windows10-2004-x64
10437213eb4b...b5.exe
windows10-2004-x64
1054a19d5a7a...d8.exe
windows10-2004-x64
106407653fb9...7c.exe
windows10-2004-x64
106dd993cade...4e.exe
windows10-2004-x64
10764d92d88b...5f.exe
windows10-2004-x64
109c51d813e0...74.exe
windows7-x64
39c51d813e0...74.exe
windows10-2004-x64
10b813f799e9...17.exe
windows10-2004-x64
10bc2ed7f926...f9.exe
windows10-2004-x64
10c1a9af1ad6...d5.exe
windows10-2004-x64
10cf90d774fa...01.exe
windows10-2004-x64
10e65fa29126...d8.exe
windows10-2004-x64
10e81854abc9...1a.exe
windows10-2004-x64
10ed835b70d5...6c.exe
windows10-2004-x64
10f48c36cb91...ef.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
062bf5eda95fa04c7146882ac1efb5ae43eaee0cd4c121db8c1c2edf9412932b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1c0cc29edf3fda05ac6cd12ee7acdaf9ca6233c60ef212f53b42d088f670c7ac.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
1c46e1db345610fe8ef6a2fe37c7407b77ab614fd47b00a74971f892275e38f7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
20811d5e089d4e2f65301bba6dbb3776615b8a82ea39cd03d088665a7bf27384.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
28627b333375a37a072336a76d858a5b0758fe2abe01c16f17f6acfab4c573c8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
437213eb4b67386b44ee8203e45489fe45f788fa215cc4f60982184a2231a6b5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
54a19d5a7a4bbca3496b0edc5d80a240350e944513622d242341964e048d96d8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
6407653fb96eb144397cd5292be81f74ffb0eb8949a8d73e1a21ee3c9e85f97c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
6dd993cadea9e368a14c0ab840b0e2d0dd3ca3d699734998da4237aed7f2354e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
764d92d88ba9348555a1351396433cb6b93afd1bc3dcf27a5a06c2bb7aed5c5f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
b813f799e9c2f3b9ed25625bea968e14cbcad8bb1b3918ebcd79f631192ca017.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
bc2ed7f9261c39ac6c835adcdf9ff7f4b70696ce459a50a2645194f5597507f9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
cf90d774faa53f828a5c0c7fd9b7693ab9e6a5b59349863524aae5284b993f01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
e65fa291263fc43fdfd3ce7a071b11f1ea2a2f55c02321bfd476a1d4c33e7bd8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
f48c36cb917c3b50876b9e4240a3abaae73007be0713d0630ca8279bfae862ef.exe
Resource
win10v2004-20240426-en
General
-
Target
c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe
-
Size
390KB
-
MD5
27244e5f630cfab1b514ce4d15b1028b
-
SHA1
36c5eed78b2ce9e253c2e176e6d6ae6a8ab849b3
-
SHA256
c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5
-
SHA512
2cdcfee74150bcd5e656009d0b701b8b972a8844f3b4fe48708aea1d7883c92286ed0368a6b24efa0902ea2c99dbe97a48a06ddccd69543cd6835f4023b3a7c5
-
SSDEEP
6144:K6y+bnr+rp0yN90QEO8EikWGjZNJkp7w8ZWj9jJAVmAAhKAU4u:mMrjy90FEMvWj9jJrhKAu
Malware Config
Extracted
amadey
3.86
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
lande
77.91.124.84:19071
-
auth_value
9fa41701c47df37786234f3373f21208
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral16/files/0x0008000000023448-12.dat healer behavioral16/memory/228-14-0x0000000000C20000-0x0000000000C2A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k6943872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k6943872.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k6943872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k6943872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k6943872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k6943872.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral16/files/0x0007000000023446-31.dat family_redline behavioral16/memory/1908-33-0x0000000000600000-0x0000000000630000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation l6055315.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation pdates.exe -
Executes dropped EXE 7 IoCs
pid Process 1176 y8099568.exe 228 k6943872.exe 5052 l6055315.exe 4684 pdates.exe 1908 n2434646.exe 4560 pdates.exe 1112 pdates.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k6943872.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8099568.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5072 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 228 k6943872.exe 228 k6943872.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 228 k6943872.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1176 1156 c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe 81 PID 1156 wrote to memory of 1176 1156 c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe 81 PID 1156 wrote to memory of 1176 1156 c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe 81 PID 1176 wrote to memory of 228 1176 y8099568.exe 83 PID 1176 wrote to memory of 228 1176 y8099568.exe 83 PID 1176 wrote to memory of 5052 1176 y8099568.exe 86 PID 1176 wrote to memory of 5052 1176 y8099568.exe 86 PID 1176 wrote to memory of 5052 1176 y8099568.exe 86 PID 5052 wrote to memory of 4684 5052 l6055315.exe 87 PID 5052 wrote to memory of 4684 5052 l6055315.exe 87 PID 5052 wrote to memory of 4684 5052 l6055315.exe 87 PID 1156 wrote to memory of 1908 1156 c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe 88 PID 1156 wrote to memory of 1908 1156 c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe 88 PID 1156 wrote to memory of 1908 1156 c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe 88 PID 4684 wrote to memory of 5072 4684 pdates.exe 89 PID 4684 wrote to memory of 5072 4684 pdates.exe 89 PID 4684 wrote to memory of 5072 4684 pdates.exe 89 PID 4684 wrote to memory of 4644 4684 pdates.exe 91 PID 4684 wrote to memory of 4644 4684 pdates.exe 91 PID 4684 wrote to memory of 4644 4684 pdates.exe 91 PID 4644 wrote to memory of 1972 4644 cmd.exe 93 PID 4644 wrote to memory of 1972 4644 cmd.exe 93 PID 4644 wrote to memory of 1972 4644 cmd.exe 93 PID 4644 wrote to memory of 4948 4644 cmd.exe 94 PID 4644 wrote to memory of 4948 4644 cmd.exe 94 PID 4644 wrote to memory of 4948 4644 cmd.exe 94 PID 4644 wrote to memory of 2900 4644 cmd.exe 95 PID 4644 wrote to memory of 2900 4644 cmd.exe 95 PID 4644 wrote to memory of 2900 4644 cmd.exe 95 PID 4644 wrote to memory of 376 4644 cmd.exe 96 PID 4644 wrote to memory of 376 4644 cmd.exe 96 PID 4644 wrote to memory of 376 4644 cmd.exe 96 PID 4644 wrote to memory of 3144 4644 cmd.exe 97 PID 4644 wrote to memory of 3144 4644 cmd.exe 97 PID 4644 wrote to memory of 3144 4644 cmd.exe 97 PID 4644 wrote to memory of 1240 4644 cmd.exe 98 PID 4644 wrote to memory of 1240 4644 cmd.exe 98 PID 4644 wrote to memory of 1240 4644 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe"C:\Users\Admin\AppData\Local\Temp\c1a9af1ad640c504ed95e8f26021a55d127de1e35d0794f2bdaddd1451de08d5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8099568.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8099568.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6943872.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6943872.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6055315.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6055315.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F5⤵
- Creates scheduled task(s)
PID:5072
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1972
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"6⤵PID:4948
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E6⤵PID:2900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:376
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"6⤵PID:3144
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E6⤵PID:1240
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2434646.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2434646.exe2⤵
- Executes dropped EXE
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4560
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:1112
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD5254d0d737e1189bfe99318f0bfd3870b
SHA1867220dd20be56b88925671b6e51abf2097c9451
SHA2561d8228300174b17eb7d69b88a525101bcc68599cc4bf5c53f7590904310e817c
SHA5122b046120b5f679806fd300dcbf27a6052245a625a3957d4ca6240d0d1b8f27b2c80ef68fca9a85754db1c12bcfdf33c2b4da9478fc7d238df2633888cfa4c0fe
-
Filesize
234KB
MD5b65b20e87258819244821a38b212bb29
SHA19f998dfb67c3a67b4bf54a2bd64e5daf6f6f42f7
SHA256ddd29a5d846aa5e018ca4f6d52d0017892ee59c689f3542901385dc176a32789
SHA512ad0c3fc9cc709be826057485c961143863b1d6ae741f6cf557f7f5efe86b36bab68acec275d04c0d603c9180cdffd4681b964922f317b06a8d4cdcf93ded5363
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434