Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1Discord Ni...or.zip
windows7-x64
1Discord Ni...or.zip
windows10-2004-x64
1Discord Ni...gen.py
windows7-x64
3Discord Ni...gen.py
windows10-2004-x64
3Discord Ni...os.txt
windows7-x64
1Discord Ni...os.txt
windows10-2004-x64
1Discord Ni...es.txt
windows7-x64
1Discord Ni...es.txt
windows10-2004-x64
1Discord Ni...ts.txt
windows7-x64
1Discord Ni...ts.txt
windows10-2004-x64
1Discord Ni...rt.bat
windows7-x64
1Discord Ni...rt.bat
windows10-2004-x64
1Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
Discord Nitro Generator.zip
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
Discord Nitro Generator.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Discord Nitro Generator/gen.py
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
Discord Nitro Generator/gen.py
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Discord Nitro Generator/promos.txt
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Discord Nitro Generator/promos.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Discord Nitro Generator/proxies.txt
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
Discord Nitro Generator/proxies.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Discord Nitro Generator/requirements.txt
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
Discord Nitro Generator/requirements.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Discord Nitro Generator/start.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
Discord Nitro Generator/start.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
Discord Nitro Generator/start.bat
-
Size
55B
-
MD5
b81d7791fc1ff12b1ebabae9a1d2bfdc
-
SHA1
9b4d3e660ea56671ce100db01c02eaa11bf97347
-
SHA256
2718a599b6149f9bd4313815fa2e69c2d4c07b9642b3195fdf9fd84acb1d7f97
-
SHA512
1306699d9a5acf1da21e5ab4bdd223d74451d3513571291cce2e5f446f6596c6d1afd3db7acca3360bfaaf719041a202a562e89ee954a6469134894e0c71ccf2
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2808 taskmgr.exe Token: SeSystemProfilePrivilege 2808 taskmgr.exe Token: SeCreateGlobalPrivilege 2808 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator\start.bat"1⤵PID:1716
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3964 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:1552
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2808