Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 09:33
Behavioral task
behavioral1
Sample
StupidMonkey.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
StupidMonkey.exe
Resource
win10v2004-20241007-en
General
-
Target
StupidMonkey.exe
-
Size
70KB
-
MD5
4c785ba0487bfec51faf4788d564ee9f
-
SHA1
786fdc994a71d7e02a556e3f720b41a096a789f5
-
SHA256
c81ae973db641e3c60912166be8979a60b95253ae290c145b9a2133ad7a2ebb8
-
SHA512
b6b7fbd58e1c3657a81d17a974fc609c1af29dab6489685d2eea5e1397e12853c17086a537f7607aef6833f358965788adc961b44eeff21530ff89f9776eee06
-
SSDEEP
1536:X7eLuJn1XH70d76kbDD0k2jF16K7HmTzOt5YP:X79hpb0YkbDLE57HmTzOts
Malware Config
Extracted
xworm
wood-matches.gl.at.ply.gg:23086
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Extracted
discordrat
-
discord_token
MTMzMDMyNzc3MjM3NTAyNzgxMg.GWNm0N.hjhDXtec3jd5n3sEjWHGfGyOO28kBaPWiS-HPA
-
server_id
1330267614202560512
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/4724-1-0x0000000000250000-0x0000000000268000-memory.dmp family_xworm behavioral2/files/0x000e000000023b74-71.dat family_xworm -
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 376 powershell.exe 324 powershell.exe 3100 powershell.exe 1940 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation StupidMonkey.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Server Runtime Process.lnk StupidMonkey.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Server Runtime Process.lnk StupidMonkey.exe -
Executes dropped EXE 3 IoCs
pid Process 736 rsjmdy.exe 2448 Client Server Runtime Process 3900 Client Server Runtime Process -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Process = "C:\\ProgramData\\Client Server Runtime Process" StupidMonkey.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 30 discord.com 31 discord.com 35 discord.com 38 discord.com 39 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 376 powershell.exe 376 powershell.exe 324 powershell.exe 324 powershell.exe 3100 powershell.exe 3100 powershell.exe 1940 powershell.exe 1940 powershell.exe 4724 StupidMonkey.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4724 StupidMonkey.exe Token: SeDebugPrivilege 376 powershell.exe Token: SeDebugPrivilege 324 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 736 rsjmdy.exe Token: SeDebugPrivilege 2448 Client Server Runtime Process Token: SeDebugPrivilege 3900 Client Server Runtime Process -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4724 StupidMonkey.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4724 wrote to memory of 376 4724 StupidMonkey.exe 87 PID 4724 wrote to memory of 376 4724 StupidMonkey.exe 87 PID 4724 wrote to memory of 324 4724 StupidMonkey.exe 89 PID 4724 wrote to memory of 324 4724 StupidMonkey.exe 89 PID 4724 wrote to memory of 3100 4724 StupidMonkey.exe 91 PID 4724 wrote to memory of 3100 4724 StupidMonkey.exe 91 PID 4724 wrote to memory of 1940 4724 StupidMonkey.exe 93 PID 4724 wrote to memory of 1940 4724 StupidMonkey.exe 93 PID 4724 wrote to memory of 2076 4724 StupidMonkey.exe 95 PID 4724 wrote to memory of 2076 4724 StupidMonkey.exe 95 PID 4724 wrote to memory of 736 4724 StupidMonkey.exe 108 PID 4724 wrote to memory of 736 4724 StupidMonkey.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\StupidMonkey.exe"C:\Users\Admin\AppData\Local\Temp\StupidMonkey.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\StupidMonkey.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'StupidMonkey.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Client Server Runtime Process'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Client Server Runtime Process'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Client Server Runtime Process" /tr "C:\ProgramData\Client Server Runtime Process"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\rsjmdy.exe"C:\Users\Admin\AppData\Local\Temp\rsjmdy.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\ProgramData\Client Server Runtime Process"C:\ProgramData\Client Server Runtime Process"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
C:\ProgramData\Client Server Runtime Process"C:\ProgramData\Client Server Runtime Process"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3900
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD54c785ba0487bfec51faf4788d564ee9f
SHA1786fdc994a71d7e02a556e3f720b41a096a789f5
SHA256c81ae973db641e3c60912166be8979a60b95253ae290c145b9a2133ad7a2ebb8
SHA512b6b7fbd58e1c3657a81d17a974fc609c1af29dab6489685d2eea5e1397e12853c17086a537f7607aef6833f358965788adc961b44eeff21530ff89f9776eee06
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e95adb52d58e281a1b2588fb63f649a8
SHA129d9e100bf4f8cf07ba367e0b2ba7f19651b98a1
SHA256d83b509fca61f585536172fdbc05a0a3afd367af2feb9d9fe1532d03077a5328
SHA512e100b19e044af84a520f783f5e5e917655800386f17f6d9c584ab6da55d99a97db35c138b9db914997ed0d34ea6bce36526f74c1af75b62fb24d580e03a27ccd
-
Filesize
944B
MD583685d101174171875b4a603a6c2a35c
SHA137be24f7c4525e17fa18dbd004186be3a9209017
SHA2560c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870
SHA512005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5
-
Filesize
944B
MD5b7189719e6df2c3dfc76197ec3f31f7a
SHA1effd91412deadc87cc10ef76cdecc1e0b54b6d41
SHA2561c72fa37d078b92c7e900b2e3d17c43c34d936a696a8ddf6c519f4a80308b892
SHA5122df1f1d45844da7ffb17cdfb411f223e9c614c00f5cf7eb5ba92bf7ba174875af2a515371208286c95c0479c934ae2c6a83dfc0b54380be89db1eddd19faf978
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
78KB
MD524b361200a5fc61a62657c8ef7886d1f
SHA1a6e4602b47f50e943603c5164bd6750e3b58a5ef
SHA2567f4b62dd5a02a17056e390f59bca7a314d40bc3e8928307a56b558033dd58bb7
SHA512a1081da6c801dbe649b25c7bc7fce26a20d22b574df0b9b0050ec8089acc29f86f28f77bdbd3610210452255162939832c7a7e35344a9335981e0fef4cd4542a