Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 04:12
Behavioral task
behavioral1
Sample
SCLauncherV2.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SCLauncherV2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
SCLauncherV2.exe
-
Size
78KB
-
MD5
1f0f51336f5f6004afd1aa2f64289d50
-
SHA1
d693686649a21ba77586d7236057576393096292
-
SHA256
ec17fe432772f5e53f45a1d0ad74a6d2d79635ec1fdbdb5b3bf6cda55e873081
-
SHA512
6c7bc5aaf5304c052aff714be73ef3a6ea2f959b37d0b608fdce33babb9a2b314da0d4012052e9d897967b33f36933dce481afa12696f2ac58326a9e31596729
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTA0ODMwNDkwODM0NjA2NTAyNg.G95Iws.imc9mlTqIPk_OwRNZOtlCbfm82UCxdZc1tKScU
-
server_id
1048304689382432859
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2404 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2404 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2064 2760 SCLauncherV2.exe 28 PID 2760 wrote to memory of 2064 2760 SCLauncherV2.exe 28 PID 2760 wrote to memory of 2064 2760 SCLauncherV2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCLauncherV2.exe"C:\Users\Admin\AppData\Local\Temp\SCLauncherV2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2760 -s 6002⤵PID:2064
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2676
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404