Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 15:15

General

  • Target

    44905c8aad3cd7360aa237ed7d2a024152b32fc5c39266bf2ce382d0bb3f7f27.vbs

  • Size

    337B

  • MD5

    1fe4615994b98e453f7ff6aeea17aa11

  • SHA1

    9ba1044f248176e14f6389eb19e8c59f241377de

  • SHA256

    44905c8aad3cd7360aa237ed7d2a024152b32fc5c39266bf2ce382d0bb3f7f27

  • SHA512

    0e9c59d283729db4d08ebfefc2bc8235ff84a53129fb22e0758f06c292931bc5753d4c1d2afda987f6d19e5e6e3e6208f74a00332afa8d578780b88143f440b1

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44905c8aad3cd7360aa237ed7d2a024152b32fc5c39266bf2ce382d0bb3f7f27.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C start /min iexplore http://447.cc/index2.html?7xdown
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://447.cc/index2.html?7xdown
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1876
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C .\to.cmd
      2⤵
        PID:1524
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C .\copy.cmd
        2⤵
          PID:540
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C .\run.cmd
          2⤵
            PID:1724

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NXBT8LHT.txt

          Filesize

          539B

          MD5

          44c26238a70abcfde2e413f5465ff894

          SHA1

          f7d7c3f1c849fbd64e52cb70c446b8cac4728273

          SHA256

          84009f0753e1e9304ff2afbbdf586086ebdf79aef31e45a07da292661619b784

          SHA512

          40d841bb6d50e71884394b7bda5695be58b32d965c8a07f90b4434f7b94226147f678df0ae1dfee10c5bfdc13aba2986a4cc6fa3835d80100f3246b8976b4b7d

        • memory/1780-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

          Filesize

          8KB