Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 10:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1238588297035644979/1238588390786465912/S3RVER_CL0NER.exe?ex=66407d94&is=663f2c14&hm=e3fd0a4afacb857595daba2e8a700ad305d290bc687d43f5348b5091d3e11e7a&
Resource
win10v2004-20240226-en
General
-
Target
https://cdn.discordapp.com/attachments/1238588297035644979/1238588390786465912/S3RVER_CL0NER.exe?ex=66407d94&is=663f2c14&hm=e3fd0a4afacb857595daba2e8a700ad305d290bc687d43f5348b5091d3e11e7a&
Malware Config
Signatures
-
Loads dropped DLL 34 IoCs
pid Process 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 1400 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe 2388 S3RVER_CL0NER.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4488 OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1400 S3RVER_CL0NER.exe Token: SeDebugPrivilege 2388 S3RVER_CL0NER.exe -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe 4488 OpenWith.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1400 2116 S3RVER_CL0NER.exe 118 PID 2116 wrote to memory of 1400 2116 S3RVER_CL0NER.exe 118 PID 1400 wrote to memory of 4504 1400 S3RVER_CL0NER.exe 119 PID 1400 wrote to memory of 4504 1400 S3RVER_CL0NER.exe 119 PID 1400 wrote to memory of 5116 1400 S3RVER_CL0NER.exe 120 PID 1400 wrote to memory of 5116 1400 S3RVER_CL0NER.exe 120 PID 4928 wrote to memory of 2388 4928 S3RVER_CL0NER.exe 123 PID 4928 wrote to memory of 2388 4928 S3RVER_CL0NER.exe 123 PID 2388 wrote to memory of 384 2388 S3RVER_CL0NER.exe 125 PID 2388 wrote to memory of 384 2388 S3RVER_CL0NER.exe 125 PID 2388 wrote to memory of 4908 2388 S3RVER_CL0NER.exe 126 PID 2388 wrote to memory of 4908 2388 S3RVER_CL0NER.exe 126
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1238588297035644979/1238588390786465912/S3RVER_CL0NER.exe?ex=66407d94&is=663f2c14&hm=e3fd0a4afacb857595daba2e8a700ad305d290bc687d43f5348b5091d3e11e7a&1⤵PID:940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4608 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵PID:3432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5100 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵PID:1236
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5828 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:32
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5128 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:4528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4688 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵PID:3964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6072 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵PID:4000
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3160
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4488
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6100 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵PID:1600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6096 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:3860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5700 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:5048
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x49c1⤵PID:4380
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6232 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:4792
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=3612 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:4496
-
C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:4504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Made by shulio#96833⤵PID:5116
-
-
-
C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"C:\Users\Admin\Downloads\S3RVER_CL0NER.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Made by shulio#96833⤵PID:4908
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4652 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:180
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5a87575e7cf8967e481241f13940ee4f7
SHA1879098b8a353a39e16c79e6479195d43ce98629e
SHA256ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
-
Filesize
59KB
MD5483bfc095eb82f33f46aefbb21d97012
SHA1def348a201c9d1434514ca9f5fc7385ca0bd2184
SHA2565e25e2823ed0571cfdbae0b1d1347ae035293f2b0ac454fb8b0388f3600fd4b6
SHA512fe38b3585fbfaf7465b31fbc124420cfbd1b719ea72a9ae9f24103d056c8fa9ae21c2a7dd3073810222405457beff89bbb688daeced3219351a30992a6721705
-
Filesize
77KB
MD5a1fbcfbd82de566a6c99d1a7ab2d8a69
SHA13e8ba4c925c07f17c7dffab8fbb7b8b8863cad76
SHA2560897e209676f5835f62e5985d7793c884fd91b0cfdfaff893fc05176f2f82095
SHA51255679427c041b2311cff4e97672102962f9d831e84f06f05600ecdc3826f6be5046aa541955f57f06e82ee72a4ee36f086da1f664f493fbe4cc0806e925afa04
-
Filesize
116KB
MD592276f41ff9c856f4dbfa6508614e96c
SHA15bc8c3555e3407a3c78385ff2657de3dec55988e
SHA2569ab1f8cbb50db3d9a00f74447a2275a89ec52d1139fc0a93010e59c412c2c850
SHA5129df63ef04ea890dd0d38a26ac64a92392cf0a8d0ad77929727238e9e456450518404c1b6bb40844522fca27761c4e864550aacb96e825c4e4b367a59892a09e7
-
Filesize
150KB
MD5a6bee109071bbcf24e4d82498d376f82
SHA11babacdfaa60e39e21602908047219d111ed8657
SHA256ce72d59a0e96077c9ea3f1fd7b011287248dc8d80fd3c16916a1d9040a9a941f
SHA5128cb2dafd19f212e71fa32cb74dad303af68eaa77a63ccf6d3a6ae82e09ac988f71fe82f8f2858a9c616b06dc42023203fa9f7511fac32023be0bc8392272c336
-
Filesize
44KB
MD5bf3e86152b52d3f0e73d0767cde63f9f
SHA13863c480a2d9a24288d63f83fa2586664ec813a2
SHA25620c94846417ee3ca43daa5fae61595ad7e52645657fda5effe64800fe335ff0d
SHA5128643f94ece38246769ff9ba87a249b8afde137cf193ff4d452937197ce576816c1ce044c4ad2951bc5535cc3acf1b27e9f2be043b8175c5a2ca2190b05dc0235
-
Filesize
73KB
MD5c5378bac8c03d7ef46305ee8394560f5
SHA12aa7bc90c0ec4d21113b8aa6709569d59fadd329
SHA256130de3506471878031aecc4c9d38355a4719edd3786f27262a724efc287a47b9
SHA5121ecb88c62a9daad93ec85f137440e782dcc40d7f1598b5809ab41bf86a5c97224e2361c0e738c1387c6376f2f24d284583fd001c4e1324d72d6989d0b84bf856
-
Filesize
152KB
MD59d810454bc451ff440ec95de36088909
SHA18c890b934a2d84c548a09461ca1e783810f075be
SHA2565a4c78adedf0bcb5fc422faac619b4c7b57e3d7ba4f2d47a98c1fb81a503b6b7
SHA5120800666f848faec976366dbfd2c65e7b7e1d8375d5d9e7d019bf364a1f480216c271c3bcf994dbab19290d336cf691cd8235e636f3dbc4d2a77f4760871c19ed
-
Filesize
812KB
MD5c1763c2c61ee50a2e7f98f7e595cd9ec
SHA1fa4e5afa2a4b97ffef9a4d45715e8bcf4cb8e58e
SHA2561a9591e171b8e371894dadb3420ee8491cb607c151b84cd5455efe32fab18438
SHA512fe9ab67a98a0f6e2f92bf6306472ba557978ceacf5538c71e6923fb29336378ea26ec5cf8fdf97a989e20305c9b0e5d2cc56be711cace848bd13e8a4af69c746
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
64KB
MD57c46d46a2ffdf05793e83c9fabf472ff
SHA127d38da2cfd0b8fb35671d7fa3739d7446d0ac09
SHA256a47da972f8440f6713328c5d9e5d805a0fb5d6325e45ed921f0f86c1ca662b59
SHA5122ff79a51991cf5a6efbaf6135096c53b3614d1d772852892745c3e44f871caf52c374e4fd8d794c3f04c0a54dd77d1a0acf10cb9c43875409d9598980e79aff7
-
Filesize
60KB
MD50812ee5d8abc0072957e9415ba6e62f2
SHA1ea05c427e46c5d9470ba81d6b7cbca6838ee0dd5
SHA25684a29c369560c5175d22ee764fe8ada882ab6b37b6b10c005404153518a344ec
SHA51218ca5631f2ae957b9ec8eaa7aa87094d3a296548790ced970752625a0f271511e0ce0042a0ea5469a9c362a0d811c530ef6fe41b84c61b25c838466acc37f22b
-
Filesize
4.2MB
MD5a1185bef38fdba5e3fe6a71f93a9d142
SHA1e2b40f5e518ad000002b239a84c153fdc35df4eb
SHA2568d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e
SHA512cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4
-
Filesize
25KB
MD563ede3c60ee921074647ec0278e6aa45
SHA1a02c42d3849ad8c03ce60f2fd1797b1901441f26
SHA256cb643556c2dcdb957137b25c8a33855067e0d07547e547587c9886238253bfe5
SHA512d0babc48b0e470abdafad6205cc0824eec66dbb5bff771cee6d99a0577373a2de2ffab93e86c42c7642e49999a03546f94e7630d3c58db2cff8f26debc67fcad