Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/08/2024, 13:11

General

  • Target

    excord.js

  • Size

    93KB

  • MD5

    c8a7c9b07c549b8101507953d7dfbc97

  • SHA1

    25ad0cd00063771cd45c6131aa43997a6dec0f8d

  • SHA256

    90be33d3da80b38f15055b3881ebadaf8559cd91902b92fc3ed07bb2a466da5f

  • SHA512

    fb5b79cd208cf82b69e5fa0e7dee3632d6823a4474ce0b600eb6a85cf33815e7cfbc0bf01054a218c40c140dc61fe7a6b6f3e6f5b69fda61b3ec172c011049b6

  • SSDEEP

    1536:vJSMqH+1+7FzaLiphqSXImzf58ytH9fJFZJn9HnRJK:vJSMqe8Bii7tzFdJNRA

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\excord.js
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4204
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.0.1717616244\1866019780" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37de8c36-6929-4579-a9f1-fc37fac697f7} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 1764 247b4ad4e58 gpu
        3⤵
          PID:3396
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.1.1165317109\1856648767" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0861c40-e739-4059-b326-e0876b180aa0} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2120 247a9a72e58 socket
          3⤵
            PID:1188
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.2.1200476089\797444348" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2920 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b261c4-9ae2-447b-b847-871e9bcca8cd} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2936 247b8db1e58 tab
            3⤵
              PID:952
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.3.1714741484\282686105" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72fbfc19-4a76-468a-bcd9-308725b8952a} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3524 247a9a61358 tab
              3⤵
                PID:4924
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.4.334888171\333772213" -childID 3 -isForBrowser -prefsHandle 4220 -prefMapHandle 4196 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c3799e7-e045-45ba-89aa-fbdee31d4e2a} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4184 247ba36d258 tab
                3⤵
                  PID:1400
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.5.580776867\942222166" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 5004 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {065c2195-d310-462d-a90d-8a86e131b559} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4992 247b7372258 tab
                  3⤵
                    PID:2648
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.6.294070312\1101927301" -childID 5 -isForBrowser -prefsHandle 4908 -prefMapHandle 4900 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba813dc3-e92f-4a70-8af6-411795a42c3f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4928 247bb329458 tab
                    3⤵
                      PID:1544
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.7.1340093705\1877935334" -childID 6 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abaf9d80-918e-4dcf-8d2b-ff6993393c96} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5192 247bb32b558 tab
                      3⤵
                        PID:3332
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.8.1004590715\467198264" -childID 7 -isForBrowser -prefsHandle 5600 -prefMapHandle 5596 -prefsLen 26514 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e14f0e02-ff16-4575-8c18-c585c3656ed4} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5612 247bb3b2d58 tab
                        3⤵
                          PID:5108
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.9.122125769\1183636148" -childID 8 -isForBrowser -prefsHandle 5788 -prefMapHandle 5736 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {994f2850-03ef-4f66-8b92-e39b6d50d03e} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5920 247bca13158 tab
                          3⤵
                            PID:5000
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.10.145151645\477246046" -childID 9 -isForBrowser -prefsHandle 5264 -prefMapHandle 5452 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a420b5-8bd6-4656-92de-e901897dbb66} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5196 247bd3d3858 tab
                            3⤵
                              PID:648
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.11.1536294318\1317316393" -childID 10 -isForBrowser -prefsHandle 5316 -prefMapHandle 5300 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec75a155-d569-4421-b2df-4d0167327ece} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5328 247bd498258 tab
                              3⤵
                                PID:4860
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.12.1262531192\1055994456" -childID 11 -isForBrowser -prefsHandle 6448 -prefMapHandle 4384 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {437b1244-43ee-40be-99a5-bbc0e9eb374d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6156 247b8d73b58 tab
                                3⤵
                                  PID:5404
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.13.436020583\1702140156" -childID 12 -isForBrowser -prefsHandle 5932 -prefMapHandle 5944 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82fe915e-562a-408c-a5a1-219a2fa4df36} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6028 247bca0b258 tab
                                  3⤵
                                    PID:5596
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.14.532131108\1893062510" -childID 13 -isForBrowser -prefsHandle 6424 -prefMapHandle 6420 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f02520-f501-4bdd-a8a9-94e55cb13b4d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5412 247bc960358 tab
                                    3⤵
                                      PID:6016
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.15.1845422189\1913478673" -childID 14 -isForBrowser -prefsHandle 3772 -prefMapHandle 3776 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {803ba5c2-82fc-4e33-8f9e-c4beaeb14b8e} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2728 247bc961258 tab
                                      3⤵
                                        PID:6024

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\68BC2ADA259BF925235C7E6BF89FCA3B60EECD19

                                    Filesize

                                    60KB

                                    MD5

                                    54c40c9cd190a0118fb02e0c3fba701e

                                    SHA1

                                    624076d806b12f8c72c6a21a7403da8881debacd

                                    SHA256

                                    0d4eaaa4a827fdb0b9e5bee9764512f23f4da1b614b4f45f0b3f6e7546161d36

                                    SHA512

                                    e03f70157dd9954d18ec75779918b5e801dd76fd36080743f122a7b436f87bd5016ea696bf1fe0cd0617fc1903590e6c5232566e315b87ab5afcefb95622eb59

                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9357B92D7A82DC731CBB46EBC4F197AB314C7C11

                                    Filesize

                                    218KB

                                    MD5

                                    e2ed23d94778f5f3044caf19f810c14f

                                    SHA1

                                    a097a130ef5c9eb886c1387418ef82507ffee5f2

                                    SHA256

                                    b4762244ce232c2d1477db827d2e97d5245bdc0119f8a31766259fac7cbf0f7f

                                    SHA512

                                    3213c865d5091cfc5700632bfdc67f4ab779a3bb8a84717fd5f46e34935070deb026fc1e1315eadd31483e8b9d16db8905bfec856c117b41945b4df6e40befb9

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

                                    Filesize

                                    2KB

                                    MD5

                                    1f87e88e2c832c5f8c47227572e90743

                                    SHA1

                                    829ad1294759246e81a3ad816f46f16fd70eb7f0

                                    SHA256

                                    c83d9f2c588521721563052d019fe347ee7b22763e3d32b33fd21dd934bd3394

                                    SHA512

                                    1f037f79dce5468b15a3f529df74346ef9deb24f7b9a2ebea8c4f781d66fb4dd172e14d7208e418ef0d47aab9d0365c8cc148968a970a6634fde2e423518ac79

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\931c4bbd-19d0-4100-81a2-820c8d037b8f

                                    Filesize

                                    10KB

                                    MD5

                                    89be44b0c429f77702504b0363404a07

                                    SHA1

                                    d5b3d9e30e761d2cbde752095d8add8f1c1bf401

                                    SHA256

                                    ee9688343dda7ef07412389da846b2ed1103e12f96b54e48955f19607bca0a6e

                                    SHA512

                                    51935ffc8cf8409ecb91691e22a9ead20d5683e43261e3c71551ba6eb4541757ed73328c22ee57a6926465a02242fc3304d6f5eaed55dafc872dfe13bcb3afbc

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\b588b78a-0082-41bb-b726-985216335edd

                                    Filesize

                                    746B

                                    MD5

                                    dba365c75cc02d5190fe7b029c1a0c8d

                                    SHA1

                                    c188bbe866d51e6fb6b39d89fa8700dcac325b4c

                                    SHA256

                                    2bd7a25058660e467aea6db641aebc419dcc7bbcd03119de5f86305cfaba1f1f

                                    SHA512

                                    4cda3b55be8a26dd3b305c410580146a59598e957b854bd276e424e6e930bd10742aa247515fce4328140fcd5a86a125bd2351bc81f49e1e7560bc2589c29915

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

                                    Filesize

                                    6KB

                                    MD5

                                    ac49a7f883c6fc15366ed5ab49bedb26

                                    SHA1

                                    d4377d0c10ee2de944d07d8151db1b817a4e3b67

                                    SHA256

                                    6914726563410dace4994e43fa520894e1d7ae144a8069027486a73a1f534434

                                    SHA512

                                    a17db6e0311587624bf2a0f82f9c9432e331b9a3f007e807229a55a05752b83b5f5e80753a7ee30413a024ef531051e47c46dbf859cccb4ee2700239640f3111

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

                                    Filesize

                                    6KB

                                    MD5

                                    af5dee26f139c714cb195f7426a79e05

                                    SHA1

                                    5ce0ee1ce91abd015fa9249d449963ac416e721f

                                    SHA256

                                    c367b28e0c1195fb2c9094404aa1fe7f3dcf77e44325791f79c6ca080da28770

                                    SHA512

                                    31d91d03b0c674d92b7fccaf9df6d67d6015c8d53e5b215ce072e3c413ad6a6684e79fa692933d2b90b4554f37183cd2062c39a2ba069aadeb513b033ed0710a

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

                                    Filesize

                                    6KB

                                    MD5

                                    8272154d06438d863537716fa68423ea

                                    SHA1

                                    5354d7f4917cb8b2fbd27a812057049467da68ba

                                    SHA256

                                    e6c6b4596b9123ca4a1378ba633fa13d700876e220b4ef4f10ad591e945cca82

                                    SHA512

                                    dcc6a4fdde0aae8c197c3cf05521445575da2a666b8ac4ab68c3df3cacd5d5680288c26f286a8eb1c90276ccc58b6ea2d4e71815b2ab56132a7303b86fe4f3ec

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

                                    Filesize

                                    50KB

                                    MD5

                                    0cf5768cefb706f8227eb7f2f7745a79

                                    SHA1

                                    83989483274569232dc24f5695fa5e852f7b3ea7

                                    SHA256

                                    93f696072ea9b1eb02eca92551fc4552b3ce675e73b307f985b92909c60d769f

                                    SHA512

                                    e7d1ffe0924c8a2508f548be6a3d57c71aabeec330189a597f90354a588511096389d4b00ee7b0c2fa23c6a3d3c00d36b040190b128eb49b916c2f71a80b985e

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

                                    Filesize

                                    60KB

                                    MD5

                                    b821914747127adb28d79e14468511c3

                                    SHA1

                                    2b1f86cd6d288d29dc64227ffc279516e4802b91

                                    SHA256

                                    6eb5c317f5eb9d1f96a60d58e926e20d8abc48af15ff708cc4081b556d99df0c

                                    SHA512

                                    9e10932e949f35858dedbaf8857a1dc18c5bd83d44e9c82d086d58a6d6af446e6c8f2450be62648c4f026e8db60a2a2b940a0e84adc7293e40a7a41acb6f1bb8

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

                                    Filesize

                                    1KB

                                    MD5

                                    bb14f0dd1b5b40c94076c10b8df35aa3

                                    SHA1

                                    9d1d7263d7fb870b1c86397a4e73cd5cc7fd1eb0

                                    SHA256

                                    843d7401fc94080c20a2091c05d44cbcac71feb4c08289dc60387ae5029471e6

                                    SHA512

                                    6bcfc2c45b387d8d3b5551bf041560150ff2d99d91a485e27b3f6deee5a28a20af794fb58ba109b7b27f047cc8f7cf2bc9ad2789953c913d5e6654681fc6472e

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

                                    Filesize

                                    54KB

                                    MD5

                                    dd2da5455e426c4553cea206de7bae21

                                    SHA1

                                    24b472b78c29b31070758abf6a8e242279dd350d

                                    SHA256

                                    58e5ef5fd6ddb51129c4b5f8d5b7cf368a47c7f6cd0e4e80acea20d03b1a8ea1

                                    SHA512

                                    8d44f56fc7f79fb4ef1a870543d7d9b89713106fad48449c68b4c15836e9a1ed33e97541da17f18a5da2999010eb73e6a3751ee663a76d95d7d1cca8e3acdc1a

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

                                    Filesize

                                    60KB

                                    MD5

                                    478eb2201b3a0fbb2b078774b32514dd

                                    SHA1

                                    823fb5c82335283ae17b54352169e2b77ab2f7d0

                                    SHA256

                                    0d04252ccafbe6c0bdab6ca8960f4e2d3fb4cf6e4b9e21112961968e13ac7995

                                    SHA512

                                    d91233c25ce55529afbbd81d95a7fce73ae2e193de5851fed64e86bf597302321c3b05159a439367f94d0d01d2d0aa6567dc5b5cb21fe8ea898908b02107cb30

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                    Filesize

                                    184KB

                                    MD5

                                    7f868e557b098795d645df9ea302427f

                                    SHA1

                                    001f3306144559b4049a8ab139b4139f51e59c0e

                                    SHA256

                                    b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

                                    SHA512

                                    56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a