Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/03/2025, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
statement related to outstanding invoices.exe
Resource
win7-20241010-en
General
-
Target
statement related to outstanding invoices.exe
-
Size
893KB
-
MD5
f2cbbaddb0675bd99c305106ae05ca14
-
SHA1
a416708ffdca33fee302a7ec0503c000801a3bd8
-
SHA256
5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c
-
SHA512
7723894d81284072bd654fae6780dd0db419341c20202952b9e5cf5720a4b5b6e818b2ffff2976baa58ae939eda0612d35409656a8d6dc74cd27fcb7f512bad3
-
SSDEEP
24576:n4l0MSRqgEauL0L1V2FbhfV2kzTbXlAaJuEl4+vode8:n4l0MSRqgEdLS1UrI4lHJZjgI
Malware Config
Extracted
darkcloud
Protocol: ftp- Host:
@StrFtpServer - Port:
21 - Username:
@StrFtpUser - Password:
@StrFtpPass
Signatures
-
Darkcloud family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2804 set thread context of 2444 2804 statement related to outstanding invoices.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language statement related to outstanding invoices.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe 2804 statement related to outstanding invoices.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2444 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2804 statement related to outstanding invoices.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2444 RegSvcs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 816 2804 statement related to outstanding invoices.exe 30 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31 PID 2804 wrote to memory of 2444 2804 statement related to outstanding invoices.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\statement related to outstanding invoices.exe"C:\Users\Admin\AppData\Local\Temp\statement related to outstanding invoices.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2444
-