Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/07/2023, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
Specifikace objednávky.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Specifikace objednávky.js
Resource
win10v2004-20230703-en
General
-
Target
Specifikace objednávky.js
-
Size
24KB
-
MD5
4272d76e2efed7d323e14bccef987913
-
SHA1
a8cde379b41cfafb036896484844620a7fcc11c6
-
SHA256
39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55
-
SHA512
717ca100e5f2463b8aa675185e2dbd743a015fffe7654dab2b227691ed66e9443a3e387d31c3eeed63a22d1b3f77b213feec3c3fe6c1438ddf5313066f2583a9
-
SSDEEP
384:0B+UO8kwlbBtHS0ihYvG3bMZcCOQHp4aIX6xEzWZNxFlumanjjjIYNFLD5zvOJ:09ewl7tGr+Oy4aPOL13IoFLdzGJ
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
flow pid Process 5 2204 wscript.exe 6 2204 wscript.exe 7 2204 wscript.exe 9 2204 wscript.exe 10 2204 wscript.exe 11 2204 wscript.exe 13 2204 wscript.exe 14 2204 wscript.exe 15 2204 wscript.exe 17 2204 wscript.exe 18 2204 wscript.exe 19 2204 wscript.exe 21 2204 wscript.exe 22 2204 wscript.exe 23 2204 wscript.exe 25 2204 wscript.exe 26 2204 wscript.exe 27 2204 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Specifikace objednávky.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\Specifikace objednávky.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1100 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1100 2204 wscript.exe 29 PID 2204 wrote to memory of 1100 2204 wscript.exe 29 PID 2204 wrote to memory of 1100 2204 wscript.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Specifikace objednávky.js"1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Specifikace objednávky.js2⤵
- Creates scheduled task(s)
PID:1100
-