Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/12/2024, 05:17
Behavioral task
behavioral1
Sample
Discord3.exe
Resource
win7-20240903-en
General
-
Target
Discord3.exe
-
Size
47KB
-
MD5
dcec31da98141bb5ebb57d474de65edc
-
SHA1
56b0db53fb20b171291d2ad1066b2aea09bad38d
-
SHA256
cf1597d08ba3eddf6839c3b54c723ccc1db8d1c6edc1f416d05de29cec36aa49
-
SHA512
5b9332fdb1e21a0559e1c8052f7fef46465e4d7ea2d49d6894ca2ce575ba8158f2166bb40ce26ad5f7ad4e9a93728e565959d49583981ac7dfb20c659dbaee99
-
SSDEEP
768:AuyJNTAoZjRWUJd9bmo2qL0i120YsvdPI5SqK20bbld2UVuVSUnJ5ScNBDZwx:AuyJNTAGL2MvaEqKZbbldX0l3Sudwx
Malware Config
Extracted
asyncrat
0.5.8
Default
18.ip.gl.ply.gg:6606
18.ip.gl.ply.gg:7707
18.ip.gl.ply.gg:8808
18.ip.gl.ply.gg:9028
7U2HW8ZYjc9H
-
delay
3
-
install
true
-
install_file
Discord.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012029-13.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2888 Discord.exe -
Loads dropped DLL 1 IoCs
pid Process 2708 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Discord3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2736 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2972 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1968 Discord3.exe 1968 Discord3.exe 1968 Discord3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1968 Discord3.exe Token: SeDebugPrivilege 2888 Discord.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2452 1968 Discord3.exe 31 PID 1968 wrote to memory of 2452 1968 Discord3.exe 31 PID 1968 wrote to memory of 2452 1968 Discord3.exe 31 PID 1968 wrote to memory of 2452 1968 Discord3.exe 31 PID 1968 wrote to memory of 2708 1968 Discord3.exe 33 PID 1968 wrote to memory of 2708 1968 Discord3.exe 33 PID 1968 wrote to memory of 2708 1968 Discord3.exe 33 PID 1968 wrote to memory of 2708 1968 Discord3.exe 33 PID 2452 wrote to memory of 2972 2452 cmd.exe 35 PID 2452 wrote to memory of 2972 2452 cmd.exe 35 PID 2452 wrote to memory of 2972 2452 cmd.exe 35 PID 2452 wrote to memory of 2972 2452 cmd.exe 35 PID 2708 wrote to memory of 2736 2708 cmd.exe 36 PID 2708 wrote to memory of 2736 2708 cmd.exe 36 PID 2708 wrote to memory of 2736 2708 cmd.exe 36 PID 2708 wrote to memory of 2736 2708 cmd.exe 36 PID 2708 wrote to memory of 2888 2708 cmd.exe 37 PID 2708 wrote to memory of 2888 2708 cmd.exe 37 PID 2708 wrote to memory of 2888 2708 cmd.exe 37 PID 2708 wrote to memory of 2888 2708 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord3.exe"C:\Users\Admin\AppData\Local\Temp\Discord3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB5C8.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2736
-
-
C:\Users\Admin\AppData\Roaming\Discord.exe"C:\Users\Admin\AppData\Roaming\Discord.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD52b3a5c21b3c232f5043763c3abe8fc0c
SHA1904a7489a85dab38117fc10da78871cdea8a498d
SHA256d1aa5f048eaf56c571467688135fa1a879a0210b64f25a3235c9561484bdece8
SHA512140558c349005f0958cf7d2c0638f9cf5237d64108e3d9f6b999090e8b6456682e84afdc874fe4acd961af16de043a79b9c78eac72061f1b4f849f07153f0cc7
-
Filesize
47KB
MD5dcec31da98141bb5ebb57d474de65edc
SHA156b0db53fb20b171291d2ad1066b2aea09bad38d
SHA256cf1597d08ba3eddf6839c3b54c723ccc1db8d1c6edc1f416d05de29cec36aa49
SHA5125b9332fdb1e21a0559e1c8052f7fef46465e4d7ea2d49d6894ca2ce575ba8158f2166bb40ce26ad5f7ad4e9a93728e565959d49583981ac7dfb20c659dbaee99