Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe
Resource
win10v2004-20241007-en
General
-
Target
a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe
-
Size
658KB
-
MD5
bf107f2e08d75cbe68174be761293de2
-
SHA1
bce994e4ae6bebf331d3198bd6d5a9bc7d775a57
-
SHA256
a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4
-
SHA512
8366478f5bd37b62ec6a5658bcf22a4953eafcae99a062bf9fefc0723b465ec1e8fa00be0fcb54aa596a6122d95c0518e4edfc5c649fba14681805237b5f3558
-
SSDEEP
12288:ly90dYIyzyuyzcNkxispYLjpYK2Bpky3dKGeIhjuHZp7wZUBO:lyoYIyzy1cmZpYvWK2BBkKjCUUBO
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x0008000000023c8c-19.dat healer behavioral1/memory/1568-22-0x0000000000870000-0x000000000087A000-memory.dmp healer behavioral1/memory/460-42-0x00000000070C0000-0x00000000070DA000-memory.dmp healer behavioral1/memory/460-44-0x0000000007150000-0x0000000007168000-memory.dmp healer behavioral1/memory/460-70-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-72-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-68-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-66-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-64-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-62-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-60-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-58-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-56-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-55-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-52-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-50-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-48-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-46-0x0000000007150000-0x0000000007162000-memory.dmp healer behavioral1/memory/460-45-0x0000000007150000-0x0000000007162000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cf750485.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az948817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az948817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az948817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az948817.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cf750485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cf750485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cf750485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cf750485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az948817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az948817.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cf750485.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023c86-78.dat family_redline behavioral1/memory/3716-79-0x00000000007B0000-0x00000000007D8000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation bu960989.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1156 ki332032.exe 4476 ki614095.exe 1568 az948817.exe 708 bu960989.exe 5040 oneetx.exe 460 cf750485.exe 3716 ft194021.exe 1828 oneetx.exe 3692 oneetx.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cf750485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cf750485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az948817.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ki332032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ki614095.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1412 460 WerFault.exe 101 -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ft194021.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki332032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf750485.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ki614095.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bu960989.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3100 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1568 az948817.exe 1568 az948817.exe 460 cf750485.exe 460 cf750485.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1568 az948817.exe Token: SeDebugPrivilege 460 cf750485.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4412 wrote to memory of 1156 4412 a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe 83 PID 4412 wrote to memory of 1156 4412 a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe 83 PID 4412 wrote to memory of 1156 4412 a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe 83 PID 1156 wrote to memory of 4476 1156 ki332032.exe 84 PID 1156 wrote to memory of 4476 1156 ki332032.exe 84 PID 1156 wrote to memory of 4476 1156 ki332032.exe 84 PID 4476 wrote to memory of 1568 4476 ki614095.exe 85 PID 4476 wrote to memory of 1568 4476 ki614095.exe 85 PID 4476 wrote to memory of 708 4476 ki614095.exe 96 PID 4476 wrote to memory of 708 4476 ki614095.exe 96 PID 4476 wrote to memory of 708 4476 ki614095.exe 96 PID 708 wrote to memory of 5040 708 bu960989.exe 100 PID 708 wrote to memory of 5040 708 bu960989.exe 100 PID 708 wrote to memory of 5040 708 bu960989.exe 100 PID 1156 wrote to memory of 460 1156 ki332032.exe 101 PID 1156 wrote to memory of 460 1156 ki332032.exe 101 PID 1156 wrote to memory of 460 1156 ki332032.exe 101 PID 5040 wrote to memory of 3100 5040 oneetx.exe 102 PID 5040 wrote to memory of 3100 5040 oneetx.exe 102 PID 5040 wrote to memory of 3100 5040 oneetx.exe 102 PID 5040 wrote to memory of 3472 5040 oneetx.exe 104 PID 5040 wrote to memory of 3472 5040 oneetx.exe 104 PID 5040 wrote to memory of 3472 5040 oneetx.exe 104 PID 3472 wrote to memory of 112 3472 cmd.exe 106 PID 3472 wrote to memory of 112 3472 cmd.exe 106 PID 3472 wrote to memory of 112 3472 cmd.exe 106 PID 3472 wrote to memory of 3732 3472 cmd.exe 107 PID 3472 wrote to memory of 3732 3472 cmd.exe 107 PID 3472 wrote to memory of 3732 3472 cmd.exe 107 PID 3472 wrote to memory of 3580 3472 cmd.exe 108 PID 3472 wrote to memory of 3580 3472 cmd.exe 108 PID 3472 wrote to memory of 3580 3472 cmd.exe 108 PID 3472 wrote to memory of 4136 3472 cmd.exe 109 PID 3472 wrote to memory of 4136 3472 cmd.exe 109 PID 3472 wrote to memory of 4136 3472 cmd.exe 109 PID 3472 wrote to memory of 4520 3472 cmd.exe 110 PID 3472 wrote to memory of 4520 3472 cmd.exe 110 PID 3472 wrote to memory of 4520 3472 cmd.exe 110 PID 3472 wrote to memory of 3680 3472 cmd.exe 111 PID 3472 wrote to memory of 3680 3472 cmd.exe 111 PID 3472 wrote to memory of 3680 3472 cmd.exe 111 PID 4412 wrote to memory of 3716 4412 a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe 118 PID 4412 wrote to memory of 3716 4412 a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe 118 PID 4412 wrote to memory of 3716 4412 a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe"C:\Users\Admin\AppData\Local\Temp\a696bf203b2560b2b4174a870b99ae765550dd2aca290997b6a689ebc61df2d4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki332032.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki332032.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki614095.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki614095.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az948817.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az948817.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu960989.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu960989.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3100
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
- System Location Discovery: System Language Discovery
PID:112
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"7⤵
- System Location Discovery: System Language Discovery
PID:3732
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E7⤵
- System Location Discovery: System Language Discovery
PID:3580
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
- System Location Discovery: System Language Discovery
PID:4136
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"7⤵
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E7⤵
- System Location Discovery: System Language Discovery
PID:3680
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cf750485.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cf750485.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 10924⤵
- Program crash
PID:1412
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ft194021.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ft194021.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 460 -ip 4601⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1828
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3692
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5fe0bc4d1c8ecc23179c4bd4acd72942c
SHA1b31181d30dee3416b562daed2bc558e2cbad7139
SHA256fe7719c0d2688d99f6791f933c4ba149ad1edfe11e8b331e4cd2464f9a35f717
SHA512e2b11c71e9958b3bfa923e67ec8e4518d98c0004a89e4aff344c7fbe0fbd47f8d870aa64d1e13b2994ef3f43d3709099892162ad3ad825ca49a46ce48b4b182b
-
Filesize
504KB
MD5d17098be0ff685cc74a688da2c6d888e
SHA1fa9ad58e3f58086320703e9965e573705b77030e
SHA2567f3ffcf262623934493da39572dd0b577c0cbc9c9f373655b8e552ee16aca2ce
SHA5126e5c1da286a03be8eb545f6d80c445979bdebf91e638f2fd59e1f7c4ca59d8a7c56e7c6efbf81083cba642e530deff3abcf20ea9d0c9d2ddce2ef4d2a1ba2ede
-
Filesize
299KB
MD5b11476f1cf4c589ce984d4b01ec44143
SHA13a25cdf7d3fadd9227de61429067aed28cce00dc
SHA2563ea53f1a73697ea0d7bad0805428e5b85cea22686b4aeda10810b0c58c41d1e4
SHA512acc8557732a3383ed58477587e1437ae77e7422ccb8b5b0cd56163893afb14f8eec48b832f614d0b2b8fbfab7976d08f4a85114b25ebbf81574e60625c586a5e
-
Filesize
223KB
MD53cc189e06443311995671c4209d9d45b
SHA13eaec05c07cf1c8eb2f4a5080b3f65654cd964ba
SHA256ca776f783afaa9e8c3321edc3e1e357f28379b4da0d08e8a72eeeccbd7e4c9e4
SHA512e4c4fadad03c706941d32311432ed8737ba656c4e95baa6c1251966be6a5982ab9ac5ba73fe9247177abafbfe87448b923074bdcde4937af478dcf30ff3161a5
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
204KB
MD51304f384653e08ae497008ff13498608
SHA1d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA2562a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA5124138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1