Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27/07/2023, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
591cc603d2dd93e8b55647474da7600e.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
591cc603d2dd93e8b55647474da7600e.js
Resource
win10v2004-20230703-en
General
-
Target
591cc603d2dd93e8b55647474da7600e.js
-
Size
26KB
-
MD5
591cc603d2dd93e8b55647474da7600e
-
SHA1
497c298b8dee8a9497819cdd22a76683af338c09
-
SHA256
dabba99a6651e2785e3b9910d32e8ea0e37bd75e9fd20731f308f0a65c6652c6
-
SHA512
c6436438e70bee2ef07eab5f990ac67a9b6ec091a88d214d72ddf9dca4149f2f7d1d0cadf9e58e11914e6a83559ac0c7d54a1e07d6ac9e674ca724c657e97b29
-
SSDEEP
768:tkMyzTR34YJjyS/cgVNzmop+Ghx+HXwrI:tpyzTyYUhaNzmWy37
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
flow pid Process 5 1088 wscript.exe 6 1088 wscript.exe 7 1088 wscript.exe 9 1088 wscript.exe 10 1088 wscript.exe 11 1088 wscript.exe 13 1088 wscript.exe 14 1088 wscript.exe 15 1088 wscript.exe 17 1088 wscript.exe 18 1088 wscript.exe 19 1088 wscript.exe 21 1088 wscript.exe 22 1088 wscript.exe 23 1088 wscript.exe 25 1088 wscript.exe 26 1088 wscript.exe 27 1088 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\591cc603d2dd93e8b55647474da7600e.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\591cc603d2dd93e8b55647474da7600e.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2308 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2308 1088 wscript.exe 29 PID 1088 wrote to memory of 2308 1088 wscript.exe 29 PID 1088 wrote to memory of 2308 1088 wscript.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\591cc603d2dd93e8b55647474da7600e.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\591cc603d2dd93e8b55647474da7600e.js2⤵
- Creates scheduled task(s)
PID:2308
-