Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2025, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
statement related to outstanding invoices.exe
Resource
win7-20241010-en
General
-
Target
statement related to outstanding invoices.exe
-
Size
893KB
-
MD5
f2cbbaddb0675bd99c305106ae05ca14
-
SHA1
a416708ffdca33fee302a7ec0503c000801a3bd8
-
SHA256
5b47ff1c8bb1efc83e426e6c33c217838e822424e0df06564f1ca0670170885c
-
SHA512
7723894d81284072bd654fae6780dd0db419341c20202952b9e5cf5720a4b5b6e818b2ffff2976baa58ae939eda0612d35409656a8d6dc74cd27fcb7f512bad3
-
SSDEEP
24576:n4l0MSRqgEauL0L1V2FbhfV2kzTbXlAaJuEl4+vode8:n4l0MSRqgEdLS1UrI4lHJZjgI
Malware Config
Extracted
darkcloud
Protocol: ftp- Host:
@StrFtpServer - Port:
21 - Username:
@StrFtpUser - Password:
@StrFtpPass
Signatures
-
Darkcloud family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4140 set thread context of 1296 4140 statement related to outstanding invoices.exe 102 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language statement related to outstanding invoices.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4140 statement related to outstanding invoices.exe 4140 statement related to outstanding invoices.exe 4140 statement related to outstanding invoices.exe 4140 statement related to outstanding invoices.exe 4140 statement related to outstanding invoices.exe 4140 statement related to outstanding invoices.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1296 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4140 statement related to outstanding invoices.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1296 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102 PID 4140 wrote to memory of 1296 4140 statement related to outstanding invoices.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\statement related to outstanding invoices.exe"C:\Users\Admin\AppData\Local\Temp\statement related to outstanding invoices.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1296
-