Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 04:12
Behavioral task
behavioral1
Sample
SCLauncherV2.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SCLauncherV2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
SCLauncherV2.exe
-
Size
78KB
-
MD5
1f0f51336f5f6004afd1aa2f64289d50
-
SHA1
d693686649a21ba77586d7236057576393096292
-
SHA256
ec17fe432772f5e53f45a1d0ad74a6d2d79635ec1fdbdb5b3bf6cda55e873081
-
SHA512
6c7bc5aaf5304c052aff714be73ef3a6ea2f959b37d0b608fdce33babb9a2b314da0d4012052e9d897967b33f36933dce481afa12696f2ac58326a9e31596729
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTA0ODMwNDkwODM0NjA2NTAyNg.G95Iws.imc9mlTqIPk_OwRNZOtlCbfm82UCxdZc1tKScU
-
server_id
1048304689382432859
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 49 discord.com 50 discord.com 54 discord.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 864 SCLauncherV2.exe Token: SeDebugPrivilege 216 taskmgr.exe Token: SeSystemProfilePrivilege 216 taskmgr.exe Token: SeCreateGlobalPrivilege 216 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCLauncherV2.exe"C:\Users\Admin\AppData\Local\Temp\SCLauncherV2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:4292
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:216
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4112