Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 18:37
Static task
static1
General
-
Target
a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe
-
Size
591KB
-
MD5
ce9a1ea89f0fd715beb64fa605a146b0
-
SHA1
75cafbe2603ea3d2758cacb87efdb8d41e2e2a4f
-
SHA256
a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6
-
SHA512
d9615057d6b1d9fef1064731423f3bb7a4ac6768140bfeca94c2fdf9fb96b29cef88ccfc00b1231ceaeb8af5536d8af1d449a2e7db50d86370c9430c66464fe2
-
SSDEEP
6144:aJp0yN90QESZ4LIcHnWWrt8fSeLTV8XmRP7Gx00zC/jdY+wN63uJ+0ywRlUjxrZj:ty90sZ4M2WWtOdPiudYxyuyvRB1ft
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4132-15-0x0000000002510000-0x000000000252A000-memory.dmp healer behavioral1/memory/4132-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp healer behavioral1/memory/4132-39-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-47-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-45-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-43-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-41-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-37-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-35-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-33-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-29-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-27-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-25-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-23-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-21-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/4132-20-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 215329916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 215329916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 215329916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 215329916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 215329916.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 368473895.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 6 IoCs
pid Process 2828 bZ547483.exe 4132 125385832.exe 2132 215329916.exe 3844 368473895.exe 3412 oneetx.exe 2092 oneetx.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 125385832.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 215329916.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" bZ547483.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3420 2132 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bZ547483.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 215329916.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 368473895.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 125385832.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4240 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4132 125385832.exe 4132 125385832.exe 2132 215329916.exe 2132 215329916.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4132 125385832.exe Token: SeDebugPrivilege 2132 215329916.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3844 368473895.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3556 wrote to memory of 2828 3556 a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe 83 PID 3556 wrote to memory of 2828 3556 a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe 83 PID 3556 wrote to memory of 2828 3556 a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe 83 PID 2828 wrote to memory of 4132 2828 bZ547483.exe 84 PID 2828 wrote to memory of 4132 2828 bZ547483.exe 84 PID 2828 wrote to memory of 4132 2828 bZ547483.exe 84 PID 2828 wrote to memory of 2132 2828 bZ547483.exe 96 PID 2828 wrote to memory of 2132 2828 bZ547483.exe 96 PID 2828 wrote to memory of 2132 2828 bZ547483.exe 96 PID 3556 wrote to memory of 3844 3556 a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe 101 PID 3556 wrote to memory of 3844 3556 a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe 101 PID 3556 wrote to memory of 3844 3556 a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe 101 PID 3844 wrote to memory of 3412 3844 368473895.exe 102 PID 3844 wrote to memory of 3412 3844 368473895.exe 102 PID 3844 wrote to memory of 3412 3844 368473895.exe 102 PID 3412 wrote to memory of 4240 3412 oneetx.exe 103 PID 3412 wrote to memory of 4240 3412 oneetx.exe 103 PID 3412 wrote to memory of 4240 3412 oneetx.exe 103 PID 3412 wrote to memory of 1880 3412 oneetx.exe 105 PID 3412 wrote to memory of 1880 3412 oneetx.exe 105 PID 3412 wrote to memory of 1880 3412 oneetx.exe 105 PID 1880 wrote to memory of 5100 1880 cmd.exe 107 PID 1880 wrote to memory of 5100 1880 cmd.exe 107 PID 1880 wrote to memory of 5100 1880 cmd.exe 107 PID 1880 wrote to memory of 4360 1880 cmd.exe 108 PID 1880 wrote to memory of 4360 1880 cmd.exe 108 PID 1880 wrote to memory of 4360 1880 cmd.exe 108 PID 1880 wrote to memory of 668 1880 cmd.exe 109 PID 1880 wrote to memory of 668 1880 cmd.exe 109 PID 1880 wrote to memory of 668 1880 cmd.exe 109 PID 1880 wrote to memory of 3900 1880 cmd.exe 110 PID 1880 wrote to memory of 3900 1880 cmd.exe 110 PID 1880 wrote to memory of 3900 1880 cmd.exe 110 PID 1880 wrote to memory of 2748 1880 cmd.exe 111 PID 1880 wrote to memory of 2748 1880 cmd.exe 111 PID 1880 wrote to memory of 2748 1880 cmd.exe 111 PID 1880 wrote to memory of 1068 1880 cmd.exe 112 PID 1880 wrote to memory of 1068 1880 cmd.exe 112 PID 1880 wrote to memory of 1068 1880 cmd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe"C:\Users\Admin\AppData\Local\Temp\a78636fd493f5b0fd88b46c1ae76111c668e01dcd762a44e9197b3347dc861a6N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bZ547483.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bZ547483.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\125385832.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\125385832.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\215329916.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\215329916.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 10804⤵
- Program crash
PID:3420
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\368473895.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\368473895.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4240
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵
- System Location Discovery: System Language Discovery
PID:4360
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵
- System Location Discovery: System Language Discovery
PID:668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
- System Location Discovery: System Language Discovery
PID:3900
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵
- System Location Discovery: System Language Discovery
PID:1068
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2132 -ip 21321⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2092
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD51304f384653e08ae497008ff13498608
SHA1d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA2562a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA5124138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1
-
Filesize
419KB
MD5b6ac63be12c5766f88ccf073a09d6865
SHA120603e4ddf7fb6ede79552dc053574c54d4d76e1
SHA2567e91bb5679fb36a355975092e93563bc0d89bbf8dcfc683f54816637b6b48ee8
SHA5124dea7e777face1a6b5e88779a72321ff9e365beb80ebab754d1411c23d3ed6f1b0b880113410ed5e388ebf04ff5696ee00cb112da2ea1d0ad386e46294f01a94
-
Filesize
175KB
MD5a165b5f6b0a4bdf808b71de57bf9347d
SHA139a7b301e819e386c162a47e046fa384bb5ab437
SHA25668349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a
SHA5123dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1
-
Filesize
280KB
MD5231da8f89f48019132cf9d57c1fa7301
SHA1e8f0a07b34215da1645be5977d7d8aaa79f820eb
SHA256788adaad1d9ee589a5f52d7be256e703399fbfb668b2cb3c0af29204dda70332
SHA512abd1f4a56103f7184b52be69cb71b210356e2fa01a7434f41fdbc8b08db9de5c970c74416c12c4eaafcef44a1d3e33b7f05885f4f162857ea552e3340fb43fae