Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 15:47
Behavioral task
behavioral1
Sample
veydovokna.exe
Resource
win7-20240508-en
General
-
Target
veydovokna.exe
-
Size
78KB
-
MD5
7ee32f2553fa474e79b2f1a444172735
-
SHA1
fc17876384c197f73a7471850d13748aa6f659b0
-
SHA256
d99a4d776f04dfd3e8004c466ab81788da8f0ba08b83430df4dd984fa1ef4e39
-
SHA512
2789dc16e615f28c29f5e81ade9e4b03a47d9855cc9092bbcdf90ce7419fe38cabd729a87f038f4aa3d8e2f5317ac69a0637737f468dd8d05532dbd3dda738b9
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC
Malware Config
Extracted
discordrat
-
discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GmmRJ5.-nbYbt2H8apuatUJNXT2gF-Pq4ZpLJRKwy0hls
-
server_id
1257063713945419826
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sidebar = "C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun" sidebar.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main sidebar.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 sidebar.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2156 firefox.exe Token: SeDebugPrivilege 2156 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2156 firefox.exe 2156 firefox.exe 2156 firefox.exe 2156 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2156 firefox.exe 2156 firefox.exe 2156 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1936 2424 veydovokna.exe 28 PID 2424 wrote to memory of 1936 2424 veydovokna.exe 28 PID 2424 wrote to memory of 1936 2424 veydovokna.exe 28 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 1548 wrote to memory of 2156 1548 firefox.exe 34 PID 2156 wrote to memory of 2724 2156 firefox.exe 35 PID 2156 wrote to memory of 2724 2156 firefox.exe 35 PID 2156 wrote to memory of 2724 2156 firefox.exe 35 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 580 2156 firefox.exe 36 PID 2156 wrote to memory of 2360 2156 firefox.exe 37 PID 2156 wrote to memory of 2360 2156 firefox.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\veydovokna.exe"C:\Users\Admin\AppData\Local\Temp\veydovokna.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2424 -s 5962⤵PID:1936
-
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /showGadgets1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:2144
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.0.1006267430\1644205380" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c14813c-710a-43a2-aec8-aa0f479a4af9} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1280 103d8b58 gpu3⤵PID:2724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.1.2001801535\1000580399" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e94f1f2-c689-4309-aeef-b766f1c26fb6} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1488 f72b58 socket3⤵
- Checks processor information in registry
PID:580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.2.1188954229\1255573746" -childID 1 -isForBrowser -prefsHandle 2116 -prefMapHandle 2112 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab7ffc7b-6e45-4cb0-9585-fe6c0785f3f0} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 2128 10363d58 tab3⤵PID:2360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.3.439944296\51327321" -childID 2 -isForBrowser -prefsHandle 2480 -prefMapHandle 2472 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cdba4a4-37ed-464d-98fa-630430df71fd} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 2500 11c88e58 tab3⤵PID:3028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.4.1776714114\1299909372" -childID 3 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {232ddd35-79be-4d61-a288-fc20f30edc34} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 2744 f62258 tab3⤵PID:2728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.5.865415971\81997227" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3804 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37229e7a-854b-4eb0-8bd9-b39879fa4f6d} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 3828 1e724758 tab3⤵PID:1360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.6.1926948359\557215743" -childID 5 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9be2991e-05b9-4592-955f-706837c4a521} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 4000 1e724a58 tab3⤵PID:1292
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.7.1663401696\1804161524" -childID 6 -isForBrowser -prefsHandle 4112 -prefMapHandle 4116 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb409bec-998d-4642-a457-4cad1004b541} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 3980 1e726858 tab3⤵PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59f27f4d487bcdd35d96e49a2768b4552
SHA1abddfd32d7e7ed9568d2635038dede54c7793d63
SHA256701363c8e8ebb328d0f9c6def1799ad6c47b247451eac3bd2098171b775456bf
SHA512e8e40e46593dfbf03c5e85b9af59418f211c44c3ee25ed621b3c89d59f25a78935febd65b5043cc0279c0f2d52e6fa49e57d562fcfe9c24bbaab7cf24bac9555
-
Filesize
1KB
MD5242c549bf92365aa90ad3888882234be
SHA1dc66fdf95c6015882dc7c9142e33b00b48a430a9
SHA2563b5f480ca38ba928cee8dfee735a7ad82534292ada22369ba5e40b10f9f6ba65
SHA512422b7f2f409b8b554e05d3692926b23b8b6ae11cfd2f0ed3a37f85336dc757be31711a7d9a5ed8eeb9bb25e253d553f0d94b4d0dc00f9efbad7123a95a8c4f67
-
Filesize
2KB
MD57bca544f0fbf100763551dffffd8fd3b
SHA1771e32475d22059931110a09503e54afe1080603
SHA2563b7e883ef5680659d08e90636732dca013496f6b697123d4c6a7f38c494e4072
SHA51281e68a4fb9ad7602f186a4309d2fb42f4be142434c3a444c878a7b0c78dd2ce0a7b6c1b8462b284e8b046311a225527254fb8ceca224bf60fc425a7283f83010
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD5346d5bf7e7a4bbf14da7f78700261ba7
SHA197e804def0372915ec768a3e52bfd752bc65d2b9
SHA2562101c0c22b13dc73a36efc6d06a61813ae9b25978301b29df08f93d9d8a02cf5
SHA512ba911bff5fb8f13ec290d0f488adf3aaa3954aa180856e7df1e97776081ca56aa769ae4b9612d67abf066fdccacf3d1dff1b16fc3a0badab0dec7a779f6ea006
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5ff99d79d47b42ef026a83c9dd5b1a770
SHA14f59d7269d4480523b9fd52fedfcc9b7eb961569
SHA2563c971f87a5f73efb02a498c003913b1cc19458318ba9e968c42fff730ac14580
SHA51207663170506cdc7f3f05df9d68df101a3c9fa836065e73903b0e04ad172c0e1a707056c28a9ba8d25ece77fbab7421ce1771c6c3bf1c2ffdb4c8c47a33a76530
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\datareporting\glean\pending_pings\4335b286-9a65-4541-9930-aa67dd36057c
Filesize11KB
MD5e12cdd02c603b0dccf56aea71486698a
SHA138e334aedda357912b78865462bc8386ee8007c3
SHA2566e55f21669cf04afedd0b99d46bb9b6d4eed1f661b705ce18eda9be23e811708
SHA512a3b78c58f106ebba63f11f9776a97b27d8cec261d595860f55f6c2869d3ffe9edfafd91d4944a6ece877f11146b7aac58a588d5715cc56abc45f27750196789c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\datareporting\glean\pending_pings\d940cf43-a416-4f91-b72c-64508dcfa38c
Filesize745B
MD52d04b0c3a1a6b26a8cd35ce976931639
SHA1157778cfa9ec3318071467a34605a19eea5f6735
SHA256fbf3aa04bcaa3f3474e97ce5b4a12aef9ca7af9c53aaf0576462cafff04f7523
SHA512d7507b2c8615081b9cb15ad6dee3d94242a36ee2f6d6704c490f351c13e84f30dc7053f66f07cb0b2ad76bbd15af9fb3a31f08f0cfa1a7ab6af558a00cc1a8d2
-
Filesize
6KB
MD55264c5313aba30362074d4aeb13b634a
SHA17c491deb0f99e44fcb163ce384c042aee02c4e0d
SHA2564c62852debaf2e6a54ae2d461d6f78347ce090f47c90f15002bb6151ab9a3fd6
SHA5126eefc4dff26a46996b84637ea0ed71615dfb3b0fc792bfde0af5627a1798d8f89e98c113a167beee92f564cbb1ad8f86d54ca8ea910655e748624a80d04cb726
-
Filesize
6KB
MD5ede0b3f1bf02921f172d57e4789d54e3
SHA1a5b6d9dc4f8304602046c441f3b335b43f243882
SHA256638e90c8f24084216f28936758ea6297c5f1c6a4b22681847d7f565f7a1b53ef
SHA512398b54b56d699761495cae9efda1eff75214f1d3393a67afcb8a3f1430529d42d859d0169c5546b2761253a2679f0b70ff71462bca3f355069b06771ce3acfcf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\sessionstore.jsonlz4
Filesize831B
MD5026e191ed4be53e3b9bbf1235004fb45
SHA1c5e845d9af1c5048280e4e8283435d9eb9dd5c12
SHA2569a8b6082633074471abb74b723e136f78ea29543cdcca31ba095244ea2eb9d8f
SHA512a514a22658d9536a1ab58e02b53c1f1b8be147d94015dac2b2993000ae3744e2a14c5e6737d2bfa41ff1744cdd132c5c3f84f18a7f4be947c04c49bdc645e833
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5e64c81a753d3e7d5a6266720b4d2c385
SHA18923cd728a9fd4236d9292e61edaa59985cd21fb
SHA256cbe3d57b556ca1f6f051f0b9d83fc0d11b92cce568d8b6b8c80070e29736b551
SHA512a4d70771ddac1c24561973e3885ae86e9e8aa5c04d551b7c046920fae921ee720f23b9bfef858a72b2640cc5ae21a19197c5ac401fdfd9bd7e1675f1bdd6d1bf