Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2023, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
591cc603d2dd93e8b55647474da7600e.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
591cc603d2dd93e8b55647474da7600e.js
Resource
win10v2004-20230703-en
General
-
Target
591cc603d2dd93e8b55647474da7600e.js
-
Size
26KB
-
MD5
591cc603d2dd93e8b55647474da7600e
-
SHA1
497c298b8dee8a9497819cdd22a76683af338c09
-
SHA256
dabba99a6651e2785e3b9910d32e8ea0e37bd75e9fd20731f308f0a65c6652c6
-
SHA512
c6436438e70bee2ef07eab5f990ac67a9b6ec091a88d214d72ddf9dca4149f2f7d1d0cadf9e58e11914e6a83559ac0c7d54a1e07d6ac9e674ca724c657e97b29
-
SSDEEP
768:tkMyzTR34YJjyS/cgVNzmop+Ghx+HXwrI:tpyzTyYUhaNzmWy37
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
flow pid Process 26 1656 wscript.exe 36 1656 wscript.exe 37 1656 wscript.exe 43 1656 wscript.exe 61 1656 wscript.exe 62 1656 wscript.exe 63 1656 wscript.exe 67 1656 wscript.exe 68 1656 wscript.exe 72 1656 wscript.exe 73 1656 wscript.exe 74 1656 wscript.exe 75 1656 wscript.exe 76 1656 wscript.exe 77 1656 wscript.exe 81 1656 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\591cc603d2dd93e8b55647474da7600e.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\591cc603d2dd93e8b55647474da7600e.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3336 schtasks.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1656 wrote to memory of 3336 1656 wscript.exe 88 PID 1656 wrote to memory of 3336 1656 wscript.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\591cc603d2dd93e8b55647474da7600e.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\591cc603d2dd93e8b55647474da7600e.js2⤵
- Creates scheduled task(s)
PID:3336
-