Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

bf8c7c35cb...092.js

windows7-x64

7

bf8c7c35cb...092.js

windows10-2004-x64

1

Resubmissions

02/02/2023, 22:06

230202-1z831sbe8w 1

02/02/2023, 22:01

230202-1xfcxsbe6w 7

Analysis

  • max time kernel
    147s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2023, 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bf8c7c35cb5b8f47ad7fe7e89322960e105efa754360953ca854925a6b914092.js

  • Size

    639KB

  • MD5

    089299c68133a02272f7a05a66688c17

  • SHA1

    3f458042e06bb5c9422d5950478003d058d3facc

  • SHA256

    bf8c7c35cb5b8f47ad7fe7e89322960e105efa754360953ca854925a6b914092

  • SHA512

    e9f9c1b9b4f6e53f2a8d456180573f28740eee114846e943fd4d9958dd69f6a1db68f9db2878e3e4f823d24b33edf6b619cdffc9064c6ffc114190e654a2ca5c

  • SSDEEP

    6144:BN1HPGSx/IRbNPYCVa/68JDjUFQ5uB3c0U9lQcUgAyap70nGWOFX0YdXb9pYzjHc:4P

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\bf8c7c35cb5b8f47ad7fe7e89322960e105efa754360953ca854925a6b914092.js
    1⤵
      PID:1204
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:1520
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x520
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:584
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Options_RunDLL 0
        1⤵
          PID:1300
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:1996
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bf8c7c35cb5b8f47ad7fe7e89322960e105efa754360953ca854925a6b914092.js
            1⤵
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            PID:1676
          • C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
            "C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE"
            1⤵
            • Drops startup file
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2036
            • C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
              /tsr
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1672
          • C:\Windows\SysWOW64\DllHost.exe
            C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
            1⤵
              PID:1928

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1520-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1520-55-0x00000000722D1000-0x00000000722D3000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1996-56-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2036-58-0x000000006FC11000-0x000000006FC13000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2036-60-0x0000000070BFD000-0x0000000070C08000-memory.dmp

              Filesize

              44KB

              Download

            • memory/2036-63-0x0000000070BFD000-0x0000000070C08000-memory.dmp

              Filesize

              44KB

              Download