Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
05/07/2023, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
a174433a80690c315a52012c68ca86c3b03683ff6fd8420a261146d747ba93fb.zip
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
a174433a80690c315a52012c68ca86c3b03683ff6fd8420a261146d747ba93fb.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Jsreceipt0193617_pdf.js
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
Jsreceipt0193617_pdf.js
Resource
win10v2004-20230703-en
General
-
Target
Jsreceipt0193617_pdf.js
-
Size
300.0MB
-
MD5
7108c34a9356846f77c1e827b412ff1a
-
SHA1
6d2fffdb1f4bb4d4d6c718591b5a23f5991dfcec
-
SHA256
ef0bad7386e17039dc9a15a4dc29f46c8c6db9ccdfd8ca75b6970969dbce7402
-
SHA512
e24cada2a7016f22203f70fbcf3a3062d661902a80ccad10d3be54c534df29102f18ec5b3485881f98f8f52abf92a9292c59d56497ab6e97f1572042510f6adf
-
SSDEEP
192:mZVhrK1X92Z2ZW3oGDZDE8k324K/5gJx/I8Dg:wV81cSEWzZM
Malware Config
Extracted
vjw0rm
http://jsnew9400.duckdns.org:9400
Signatures
-
Blocklisted process makes network request 16 IoCs
flow pid Process 4 2936 wscript.exe 5 2936 wscript.exe 7 2936 wscript.exe 9 2936 wscript.exe 10 2936 wscript.exe 11 2936 wscript.exe 13 2936 wscript.exe 14 2936 wscript.exe 15 2936 wscript.exe 17 2936 wscript.exe 18 2936 wscript.exe 19 2936 wscript.exe 21 2936 wscript.exe 22 2936 wscript.exe 23 2936 wscript.exe 25 2936 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jsreceipt0193617_pdf.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS8ABDCUZM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Jsreceipt0193617_pdf.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).