Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 10:47
Static task
static1
General
-
Target
16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe
-
Size
589KB
-
MD5
9bb7b32eda99793a5ffc3f214e351710
-
SHA1
5d0d258286b59b7e7e5afe7ddc4fb274c03d2aa2
-
SHA256
16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856e
-
SHA512
f666b2f11f522f112b192e16580319ca765234c270080b4b3f96c3c5b5e8c9ea7fb5834549e991e81417317d155f104c0c2e802fca1e0a48fa817c05513c9027
-
SSDEEP
12288:4y90gfL0KXuvdlPc0lx/lBh5j/gykuvD83fip8qZtuxzK:4yRu1lPcOFlHduuL8PsjbszK
Malware Config
Extracted
amadey
3.70
5d3738
http://212.113.119.255
-
install_dir
5cb6818d6c
-
install_file
oneetx.exe
-
strings_key
79059fc55781c343f4be3c9266db011b
-
url_paths
/joomla/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4612-15-0x00000000008B0000-0x00000000008CA000-memory.dmp healer behavioral1/memory/4612-18-0x00000000022F0000-0x0000000002308000-memory.dmp healer behavioral1/memory/4612-47-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-45-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-43-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-41-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-39-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-37-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-35-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-33-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-31-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-29-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-27-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-25-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-23-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-21-0x00000000022F0000-0x0000000002303000-memory.dmp healer behavioral1/memory/4612-20-0x00000000022F0000-0x0000000002303000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" u37219219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" u37219219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" u37219219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" u37219219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" u37219219.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 82667203.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation w70xH16.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 6 IoCs
pid Process 4144 za635360.exe 4612 82667203.exe 2420 u37219219.exe 1944 w70xH16.exe 4912 oneetx.exe 4700 oneetx.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 82667203.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" u37219219.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za635360.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4296 2420 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language za635360.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82667203.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u37219219.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w70xH16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1932 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4612 82667203.exe 4612 82667203.exe 2420 u37219219.exe 2420 u37219219.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4612 82667203.exe Token: SeDebugPrivilege 2420 u37219219.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1944 w70xH16.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2024 wrote to memory of 4144 2024 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe 83 PID 2024 wrote to memory of 4144 2024 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe 83 PID 2024 wrote to memory of 4144 2024 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe 83 PID 4144 wrote to memory of 4612 4144 za635360.exe 84 PID 4144 wrote to memory of 4612 4144 za635360.exe 84 PID 4144 wrote to memory of 4612 4144 za635360.exe 84 PID 4144 wrote to memory of 2420 4144 za635360.exe 93 PID 4144 wrote to memory of 2420 4144 za635360.exe 93 PID 4144 wrote to memory of 2420 4144 za635360.exe 93 PID 2024 wrote to memory of 1944 2024 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe 104 PID 2024 wrote to memory of 1944 2024 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe 104 PID 2024 wrote to memory of 1944 2024 16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe 104 PID 1944 wrote to memory of 4912 1944 w70xH16.exe 105 PID 1944 wrote to memory of 4912 1944 w70xH16.exe 105 PID 1944 wrote to memory of 4912 1944 w70xH16.exe 105 PID 4912 wrote to memory of 1932 4912 oneetx.exe 106 PID 4912 wrote to memory of 1932 4912 oneetx.exe 106 PID 4912 wrote to memory of 1932 4912 oneetx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe"C:\Users\Admin\AppData\Local\Temp\16c06a6f0b4243ee1ad79de09b4be35180a5aa32065085f36a72b14db2de856eN.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za635360.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za635360.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\82667203.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\82667203.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u37219219.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u37219219.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 10804⤵
- Program crash
PID:4296
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w70xH16.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w70xH16.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1932
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2420 -ip 24201⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:4700
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
406KB
MD584c9911d27cf15d75e3a041ab6bef176
SHA13bc533781e3a7f603aa9a938dba199e8349038cd
SHA2562b6edafb5a1ac605ee4e53391cfdee7f8ce7cee5009f81b461361e6656ced665
SHA512c168285e1b7ea6f14354eeeded838f62557499efec761799d3d780243a4cf1a57d79378492b82233192120f80588cbdc218499223839f629c1ef25356353836d
-
Filesize
175KB
MD53d10b67208452d7a91d7bd7066067676
SHA1e6c3ab7b6da65c8cc7dd95351f118caf3a50248d
SHA2565c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
SHA512b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df
-
Filesize
249KB
MD5991047306e48ba77711356f422cce953
SHA1b8db2718409377930b2e3167852073175aead392
SHA25652a29bb46f4c0d14848fb7f5b99471cfc4d6ead965f51d234b01c06b49b8b325
SHA512dfcd55887c05d28a04b06f5350dd216d9fa145b28e6018247b3df9cb87a9aaeca4cb7b67301d59af1d515c01fd845b7781f79b18a4af97af0795745139ee66f7