Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3.hackus/Settings.cfg
windows7-x64
3.hackus/Settings.cfg
windows10-2004-x64
3DotNetZip.dll
windows7-x64
1DotNetZip.dll
windows10-2004-x64
1Entropy.dll
windows7-x64
1Entropy.dll
windows10-2004-x64
1HMC.exe
windows7-x64
6HMC.exe
windows10-2004-x64
6HandyControl.dll
windows7-x64
1HandyControl.dll
windows10-2004-x64
1IpMatcher.dll
windows7-x64
1IpMatcher.dll
windows10-2004-x64
1MailBee.NET.dll
windows7-x64
1MailBee.NET.dll
windows10-2004-x64
1Microsoft....es.dll
windows7-x64
1Microsoft....es.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Presentati...ta.dll
windows7-x64
3Presentati...ta.dll
windows10-2004-x64
3Presentati...ml.dll
windows7-x64
3Presentati...ml.dll
windows10-2004-x64
3RegexMatcher.dll
windows7-x64
1RegexMatcher.dll
windows10-2004-x64
1SharpCompress.dll
windows7-x64
1SharpCompress.dll
windows10-2004-x64
1System.Buffers.dll
windows7-x64
1System.Buffers.dll
windows10-2004-x64
1System.Dat...te.dll
windows7-x64
1System.Dat...te.dll
windows10-2004-x64
1System.Memory.dll
windows7-x64
1System.Memory.dll
windows10-2004-x64
1Analysis
-
max time kernel
130s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
.hackus/Settings.cfg
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
.hackus/Settings.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
DotNetZip.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
DotNetZip.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Entropy.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Entropy.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
HMC.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
HMC.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
HandyControl.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
HandyControl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
IpMatcher.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
IpMatcher.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
MailBee.NET.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
MailBee.NET.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Newtonsoft.Json.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PresentationFramework-SystemData.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
PresentationFramework-SystemData.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PresentationFramework-SystemXml.dll
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
PresentationFramework-SystemXml.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
RegexMatcher.dll
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
RegexMatcher.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
SharpCompress.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
SharpCompress.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
System.Buffers.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
System.Buffers.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
System.Data.SQLite.dll
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
System.Data.SQLite.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
System.Memory.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
System.Memory.dll
Resource
win10v2004-20240802-en
General
-
Target
HMC.exe
-
Size
2.6MB
-
MD5
0bd541037d1794d63bb58654f1e897c5
-
SHA1
a901fc2bc1fcc672b6dfee0d3e93b4ca8f11c710
-
SHA256
2e8931e43c5674bc641651868ef311e2d3407e0132325c0795bdf4f5404fb30f
-
SHA512
85412b5357e65ceebdd1f460e4764e3b5b11c242250500f9f55fdbaa0d2c6aa15cf0f68f7e1d88369a013a2d16c95e235db68dd48590e306de59cf01fb7128c9
-
SSDEEP
24576:rVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5Xt:rVeBB2kMOnYUvPb
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 29 discord.com 30 discord.com 31 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{ECB07E99-DE42-4CF0-99B9-82E5C328D988} msedge.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1480 1220 HMC.exe 91 PID 1220 wrote to memory of 1480 1220 HMC.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\HMC.exe"C:\Users\Admin\AppData\Local\Temp\HMC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/z5vMmkQ8pj2⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=4576,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:11⤵PID:3964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4672,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:11⤵PID:1800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5580,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:81⤵PID:2528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=5848,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:11⤵PID:3216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5348,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:81⤵PID:2908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=5376,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:81⤵
- Modifies registry class
PID:3828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6352,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:81⤵PID:3772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5628,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:81⤵PID:1180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4968,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:81⤵PID:3496