Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/07/2023, 19:03

230705-xqpfgafc97 10

05/07/2023, 18:13

230705-wtsrmage2t 10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/07/2023, 18:13

General

  • Target

    6220_837_pdf.js

  • Size

    320KB

  • MD5

    8008857b28d94bb0df9b513906ed1508

  • SHA1

    d88e06d7ace9289d09a652e294c0654cfd0b573d

  • SHA256

    de98a33ed6bbd7f0d48346d4a55fb7519b9d6c5afa0e1b46e97c41d0a722fd47

  • SHA512

    720f41be8cbd3545d54d4a307559a460e4b2da0a75dc48914f1bd6645911cfb9a0a95f493afdb91f825d8296d2d1d578750f414a31580851a2be0d8c5a15bacc

  • SSDEEP

    1536:JAYMJMMPQXgBFhHZqOQYcEp24+zVevP5e+3kGra+TmarAYvJMMPQXgBFhHZrOQYW:RgBFhQOQY06TagBFhFOQY06T4

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://cryptersandtools.minhacasa.tv/e/js_startup

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\6220_837_pdf.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionPolicy Bypass -File "C:\Users\Public\WnKdUR.ps1"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1260

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50lwd0ib.pxi.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Public\WnKdUR.ps1

    Filesize

    471B

    MD5

    6e6269ed0b905042ee927c784c7a3942

    SHA1

    a86e24af3b84a17e2fef61b80887d2fee82c9098

    SHA256

    d0564475466126aca0b1ee5996fe2161becbe147406daeac12b6af3276a213ba

    SHA512

    7c1c4b71f4cb1de86dcdbc94f78760d29bbdeb671efeca16abf114ebfa015f32951d58da6deec355fac30ddb4b601a1ed5e5e866379a97478f59767d56cf1ffd

  • memory/1260-175-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-177-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-179-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-128-0x00000178D1AD0000-0x00000178D1B46000-memory.dmp

    Filesize

    472KB

  • memory/1260-146-0x00000178D19C0000-0x00000178D19D0000-memory.dmp

    Filesize

    64KB

  • memory/1260-147-0x00000178D2000000-0x00000178D2320000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-148-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-149-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-151-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-153-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-155-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-157-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-159-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-161-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-163-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-165-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-167-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-169-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-171-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-173-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-130-0x00000178D19C0000-0x00000178D19D0000-memory.dmp

    Filesize

    64KB

  • memory/1260-125-0x00000178B9400000-0x00000178B9422000-memory.dmp

    Filesize

    136KB

  • memory/1260-129-0x00000178D19C0000-0x00000178D19D0000-memory.dmp

    Filesize

    64KB

  • memory/1260-181-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-183-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-185-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-187-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-189-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-191-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-193-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-195-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-197-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-199-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-201-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-203-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-205-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-207-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-209-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-211-0x00000178D2000000-0x00000178D231A000-memory.dmp

    Filesize

    3.1MB

  • memory/1260-220-0x00000178D19C0000-0x00000178D19D0000-memory.dmp

    Filesize

    64KB

  • memory/1260-222-0x00000178D19C0000-0x00000178D19D0000-memory.dmp

    Filesize

    64KB

  • memory/1260-298-0x00000178D19C0000-0x00000178D19D0000-memory.dmp

    Filesize

    64KB