Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14/06/2023, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
docu_DF631_Jun_14_1.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
docu_DF631_Jun_14_1.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
docu_DF631_Jun_14_2.js
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
docu_DF631_Jun_14_2.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
docu_DF631_Jun_14_3.js
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
docu_DF631_Jun_14_3.js
Resource
win10v2004-20230221-en
General
-
Target
docu_DF631_Jun_14_1.js
-
Size
22KB
-
MD5
c6c69d731f0d8972ad9c949054fe3a61
-
SHA1
c5d8530883a26074eea3bcaee046930710b70c53
-
SHA256
b0deea498617139a91f4fa0c43645268d0cdb0e5e7c19f31957c4708b7675875
-
SHA512
57f4220019e12d21a95fa4d1fc35cba6cf2f034c4663959c6b6dccbab93c9f5fd75f634aa6ef9e72e5ac1b11d11e28c4789bcfc9b6ccc1c8eacdc5529217ad49
-
SSDEEP
384:IlxwNHnWmEwxhJyyzgZT7yOjOt4kmtd70Sft:IlxwtWpwM9yV2d
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 4 944 wscript.exe 6 944 wscript.exe 8 944 wscript.exe 10 944 wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 944 wrote to memory of 1016 944 wscript.exe 29 PID 944 wrote to memory of 1016 944 wscript.exe 29 PID 944 wrote to memory of 1016 944 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\docu_DF631_Jun_14_1.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" rundll32.exe prism.tmp,must2⤵PID:1016
-