Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

df6093cc83...ec.vbs

windows7-x64

8

df6093cc83...ec.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    170s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 17:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df6093cc8395612fbbd4363266ff5c78ce332367b4230866380f722296a9cdec.vbs

  • Size

    4KB

  • MD5

    21dea128e711313098d82c5c5be4f0e0

  • SHA1

    396275c129f66afa3f17a7b71a4ef6c20e9b2d7a

  • SHA256

    df6093cc8395612fbbd4363266ff5c78ce332367b4230866380f722296a9cdec

  • SHA512

    51773370565ca927e0416287bbac87774aa93781c2c0556b3b7ef128fa09365d6d62a24c2da276c1693ce0ab0679850a9b46488b23fea24a29532d45b34a7bfe

  • SSDEEP

    96:ffJwI7iv7wAbiPtb5UQG4OmDp/otZRvxDEAfExD9TQuDGm59QyPv+J/PEmZeAeiB:fBx7ivcAbAwJcV/otZMAcxDXDjT/P2Jr

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 62 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df6093cc8395612fbbd4363266ff5c78ce332367b4230866380f722296a9cdec.vbs"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stoP SHAredAccESS
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stoP SHAredAccESS
        3⤵
          PID:1468
      • C:\Windows\regedit.exe
        "C:\Windows\regedit.exe" /S sYSINFO.Reg
        2⤵
        • Runs .reg file with regedit
        PID:564
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" .\
        2⤵
          PID:524
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C dAtE 7/14/2009
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1452
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c dAte 11/21/2022
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1724
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Windows\System32\PRNcfg.VBs"
          2⤵
          • Blocklisted process makes network request
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:980
          • C:\Windows\System32\net.exe
            "C:\Windows\System32\net.exe" STOp SHArEdAcCEsS
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:648
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 STOp SHArEdAcCEsS
              4⤵
                PID:1680
            • C:\Windows\regedit.exe
              "C:\Windows\regedit.exe" /s sySinFo.REG
              3⤵
              • Runs .reg file with regedit
              PID:1800
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c daTe 11/11/2022
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1700
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c DAte 11/21/2022
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:780
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:1296

        Network

          No results found
        • 202.119.104.100:80
          WScript.exe
          152 B
           3
        • 202.119.104.100:80
          WScript.exe
          152 B
           3
        • 202.119.104.100:80
          WScript.exe
          152 B
           3
        • 202.119.104.100:80
          WScript.exe
          152 B
           3
        • 202.119.104.100:80
          WScript.exe
          152 B
           3
        • 202.119.104.100:80
          WScript.exe
          152 B
           3
        No results found

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\System32\PRNcfg.VBs
          Filesize

          4KB

          MD5

          fb7624667540dfa7277a4aba6df8e121

          SHA1

          b128c529d35fa22181f60998f299391969db40fa

          SHA256

          57fe15a48c10354f2aba5f30ace709ba25a9ea39496d865af97328d69123dee4

          SHA512

          d89cf11a31423e067b8b71cf66145b4ff14454cb5c5d7a5d1713f6d555cc903248f7a38b49fe8245edafb484ab2bbbca087e4f0da800f4607340b43a690fe99b

          Download Submit

        • C:\Windows\system32\sYSINFO.Reg
          Filesize

          497B

          MD5

          1fca1f6483e39feb3f2769ec9680b151

          SHA1

          1294b13e913928624aa8b341fae933eb73a771b8

          SHA256

          6fac50eeb6342a2071d3fd8cca4b44a1db170063d157e7e54e8c995e70a7a31f

          SHA512

          4eb0ff47b918dac8af538f5beca9e4f574f10685f96d41a0a5ac4c818ec5bbd5168139e140f8a50e3bd82ea5ca5410863d0d06ea4d4ce44e6e8c71e34114d817

          Download Submit

        • C:\Windows\system32\sySinFo.REG
          Filesize

          497B

          MD5

          66b824b2500c1c09c29565874cf06f74

          SHA1

          c33fb5fb0c6c6e199f0cd60b3650e72f9e79318b

          SHA256

          96a4e5301dee4708d27440a01ff2efd37a4198df5d6fd4e20fe04be34cc67096

          SHA512

          83d75f751099a51fddd1f65a57264b6731b6487135658f777edbb142237b1d4c39a55e00081ddc474ceb076195fcc45f95beb09aeab318cafef8d6d8c6f7e585

          Download Submit

        • memory/1296-63-0x00000000039C0000-0x00000000039D0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1984-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

          Filesize

          8KB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.