Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/09/2024, 12:08

240926-pazx9swekm 10

26/09/2024, 11:45

240926-nw4ynsvgmp 10

Analysis

  • max time kernel
    109s
  • max time network
    110s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26/09/2024, 12:08

Errors

Reason
Machine shutdown

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    dd2514691bbf93f80928b16353ef36c9

  • SHA1

    4d6fad3d6df164eb9ef90e708147837961008f3e

  • SHA256

    acfb664587eeb517d6c3abe919d52d728f54d94bf54b9ca5a7f30314d0a22f97

  • SHA512

    cc5daa9fd97b88e411a38c9937d87e2c201058c2100df51f746f88e0a04ffa9d6b7cbfd2e22049ae7242f84e8be6c427ed36e6645c563e00cace753322293e6d

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+GPIC:5Zv5PDwbjNrmAE+iIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2ODk2NDIwNTMzMjAwOTA4MQ.G2VQO3.rLYaZ6YXS_2cD32yjU_EpC30Zspp6IkmC0MMuU

  • server_id

    1288828673423839275

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /s /t 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3076
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4312
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3945855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4696-0-0x00007FFF7D753000-0x00007FFF7D755000-memory.dmp

    Filesize

    8KB

  • memory/4696-1-0x000001358F670000-0x000001358F688000-memory.dmp

    Filesize

    96KB

  • memory/4696-2-0x00000135A9D70000-0x00000135A9F32000-memory.dmp

    Filesize

    1.8MB

  • memory/4696-3-0x00007FFF7D750000-0x00007FFF7E212000-memory.dmp

    Filesize

    10.8MB

  • memory/4696-4-0x00000135AAFF0000-0x00000135AB518000-memory.dmp

    Filesize

    5.2MB

  • memory/4696-5-0x00007FFF7D753000-0x00007FFF7D755000-memory.dmp

    Filesize

    8KB

  • memory/4696-6-0x00007FFF7D750000-0x00007FFF7E212000-memory.dmp

    Filesize

    10.8MB

  • memory/4696-7-0x00000135AAB70000-0x00000135AAC1A000-memory.dmp

    Filesize

    680KB

  • memory/4696-11-0x00007FFF7D750000-0x00007FFF7E212000-memory.dmp

    Filesize

    10.8MB

  • memory/4696-12-0x00007FFF7D750000-0x00007FFF7E212000-memory.dmp

    Filesize

    10.8MB

  • memory/4696-13-0x00007FFF7D750000-0x00007FFF7E212000-memory.dmp

    Filesize

    10.8MB