Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2025, 16:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bank details.exe
Resource
win7-20240729-en
9 signatures
150 seconds
General
-
Target
bank details.exe
-
Size
893KB
-
MD5
f2cbbaddb0675bd99c305106ae05ca14
-
SHA1
a416708ffdca33fee302a7ec0503c000801a3bd8
-
SHA256
5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c
-
SHA512
7723894d81284072bd654fae6780dd0db419341c20202952b9e5cf5720a4b5b6e818b2ffff2976baa58ae939eda0612d35409656a8d6dc74cd27fcb7f512bad3
-
SSDEEP
24576:n4l0MSRqgEauL0L1V2FbhfV2kzTbXlAaJuEl4+vode8:n4l0MSRqgEdLS1UrI4lHJZjgI
Malware Config
Extracted
Family
darkcloud
Credentials
Protocol: ftp- Host:
@StrFtpServer - Port:
21 - Username:
@StrFtpUser - Password:
@StrFtpPass
Signatures
-
Darkcloud family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5116 set thread context of 4912 5116 bank details.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bank details.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5116 bank details.exe 5116 bank details.exe 5116 bank details.exe 5116 bank details.exe 5116 bank details.exe 5116 bank details.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4912 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5116 bank details.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4912 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95 PID 5116 wrote to memory of 4912 5116 bank details.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\bank details.exe"C:\Users\Admin\AppData\Local\Temp\bank details.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4912
-