Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Specifikac...vky.js

windows7-x64

10

Specifikac...vky.js

windows10-2004-x64

10

Resubmissions

21/07/2023, 10:49

230721-mw6a3aec65 10

21/07/2023, 10:47

230721-mvvsyaec59 10

Analysis

  • max time kernel
    40s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2023, 10:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Specifikace objednvky.js

  • Size

    24KB

  • MD5

    4272d76e2efed7d323e14bccef987913

  • SHA1

    a8cde379b41cfafb036896484844620a7fcc11c6

  • SHA256

    39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55

  • SHA512

    717ca100e5f2463b8aa675185e2dbd743a015fffe7654dab2b227691ed66e9443a3e387d31c3eeed63a22d1b3f77b213feec3c3fe6c1438ddf5313066f2583a9

  • SSDEEP

    384:0B+UO8kwlbBtHS0ihYvG3bMZcCOQHp4aIX6xEzWZNxFlumanjjjIYNFLD5zvOJ:09ewl7tGr+Oy4aPOL13IoFLdzGJ

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Blocklisted process makes network request 4 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Specifikace objednvky.js"
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Specifikace objednvky.js
      2⤵
      • Creates scheduled task(s)
      PID:2728
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2904-56-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2904-57-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download