Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Julien_and..._C.rar
windows11-21h2-x64
7Julien and...hy.dll
windows11-21h2-x64
1Julien and...rs.dll
windows11-21h2-x64
1Julien and...ds.dll
windows11-21h2-x64
1Julien and...re.dll
windows11-21h2-x64
1Julien and...ns.dll
windows11-21h2-x64
1Julien and...st.dll
windows11-21h2-x64
1Julien and...et.dll
windows11-21h2-x64
1Julien and...ok.dll
windows11-21h2-x64
1Julien and...er.dll
windows11-21h2-x64
1Julien and...es.dll
windows11-21h2-x64
1Julien and...ns.dll
windows11-21h2-x64
1Julien and...on.dll
windows11-21h2-x64
1Julien and...er.exe
windows11-21h2-x64
1Julien and...rs.dll
windows11-21h2-x64
1Julien and...le.dll
windows11-21h2-x64
1Julien and...el.dll
windows11-21h2-x64
1Julien and...on.dll
windows11-21h2-x64
1Julien and...ng.dll
windows11-21h2-x64
1Julien and...me.dll
windows11-21h2-x64
1Julien and...ts.dll
windows11-21h2-x64
1Julien and...es.dll
windows11-21h2-x64
1Julien and...nc.dll
windows11-21h2-x64
1Julien and...nc.dll
windows11-21h2-x64
1Julien and...ry.dll
windows11-21h2-x64
1Julien and...rs.dll
windows11-21h2-x64
1Julien and...ve.dll
windows11-21h2-x64
1Julien and...ta.dll
windows11-21h2-x64
1Julien and...fe.dll
windows11-21h2-x64
1Julien and...es.dll
windows11-21h2-x64
1Julien and...ns.dll
windows11-21h2-x64
1Julien and...le.dll
windows11-21h2-x64
1Resubmissions
28/02/2024, 11:10
240228-m96traab8y 728/02/2024, 11:07
240228-m7zbwsab3z 728/02/2024, 11:06
240228-m7grvaaa72 7Analysis
-
max time kernel
130s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/02/2024, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
Julien_and_anarchi_selfsniper_C.rar
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
Julien and anarchi selfsniper C#/Discord.Net-Anarchy.dll
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
Julien and anarchi selfsniper C#/Discord.Net.Analyzers.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
Julien and anarchi selfsniper C#/Discord.Net.Commands.dll
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
Julien and anarchi selfsniper C#/Discord.Net.Core.dll
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
Julien and anarchi selfsniper C#/Discord.Net.Interactions.dll
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
Julien and anarchi selfsniper C#/Discord.Net.Rest.dll
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
Julien and anarchi selfsniper C#/Discord.Net.WebSocket.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Julien and anarchi selfsniper C#/Discord.Net.Webhook.dll
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Julien and anarchi selfsniper C#/Humanizer.dll
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Julien and anarchi selfsniper C#/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Julien and anarchi selfsniper C#/Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
Julien and anarchi selfsniper C#/Newtonsoft.Json.dll
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Julien and anarchi selfsniper C#/NitroSniper.exe
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Julien and anarchi selfsniper C#/System.Buffers.dll
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
Julien and anarchi selfsniper C#/System.Collections.Immutable.dll
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Julien and anarchi selfsniper C#/System.Composition.AttributedModel.dll
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
Julien and anarchi selfsniper C#/System.Composition.Convention.dll
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
Julien and anarchi selfsniper C#/System.Composition.Hosting.dll
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
Julien and anarchi selfsniper C#/System.Composition.Runtime.dll
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
Julien and anarchi selfsniper C#/System.Composition.TypedParts.dll
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
Julien and anarchi selfsniper C#/System.IO.Pipelines.dll
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
Julien and anarchi selfsniper C#/System.Interactive.Async.dll
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
Julien and anarchi selfsniper C#/System.Linq.Async.dll
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
Julien and anarchi selfsniper C#/System.Memory.dll
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
Julien and anarchi selfsniper C#/System.Numerics.Vectors.dll
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
Julien and anarchi selfsniper C#/System.Reactive.dll
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
Julien and anarchi selfsniper C#/System.Reflection.Metadata.dll
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
Julien and anarchi selfsniper C#/System.Runtime.CompilerServices.Unsafe.dll
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
Julien and anarchi selfsniper C#/System.Text.Encoding.CodePages.dll
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
Julien and anarchi selfsniper C#/System.Threading.Tasks.Extensions.dll
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
Julien and anarchi selfsniper C#/System.ValueTuple.dll
Resource
win11-20240221-en
General
-
Target
Julien_and_anarchi_selfsniper_C.rar
-
Size
2.9MB
-
MD5
cc5610e6313e3ae170f1c51397c51ed0
-
SHA1
8f90b6802b1b290e808920895ba74490d524416e
-
SHA256
53cd6d57499142348253949c4c6cee9b696a78fa99a5a68fcd6f78e55776cd63
-
SHA512
75828bb0e08d8dc2d3ac85974127a059277c084bd76d022eb6679a3231a28adff248e133a53bbd7b892a72ab79836ed69e8506281f67162c65ea2db3b1a44609
-
SSDEEP
49152:ipGqHPpVT+bzj++y6wDsAeWUyi0ELfl4pUxaiBMt9TOdKfH7ZnptvHi7NWVxAq/a:6GqHxVabz7PAUtLfl4p6QwdKzZpFk0Cf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5028 NitroSniper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1856 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1856 7zFM.exe Token: 35 1856 7zFM.exe Token: SeSecurityPrivilege 1856 7zFM.exe Token: SeDebugPrivilege 5028 NitroSniper.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1856 7zFM.exe 1856 7zFM.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1856 2248 cmd.exe 81 PID 2248 wrote to memory of 1856 2248 cmd.exe 81 PID 1856 wrote to memory of 5028 1856 7zFM.exe 86 PID 1856 wrote to memory of 5028 1856 7zFM.exe 86 PID 1856 wrote to memory of 5028 1856 7zFM.exe 86
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Julien_and_anarchi_selfsniper_C.rar1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Julien_and_anarchi_selfsniper_C.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7zO047AAFA7\NitroSniper.exe"C:\Users\Admin\AppData\Local\Temp\7zO047AAFA7\NitroSniper.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5d5e815c37b6ed6465820693673e35da8
SHA1335d5b7c1056b6d6010db628963051f1a244ddbe
SHA256934d2022814c6dfb0145608d9d270597d46feec5ce833d754576d6a73650a632
SHA512e9775eae34493d94bc96aa3adc25f95cba4c45d4b263565f23e834409cbd122ab731f052595382d7ab8857c133c8068644bb100ad03cdd3201e6fc5bdc4280a9