Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
04/08/2023, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
Scanned.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Scanned.js
Resource
win10v2004-20230703-en
General
-
Target
Scanned.js
-
Size
3KB
-
MD5
d65a553af676282e15cb3ab7cf998998
-
SHA1
dd76b76df265973b7aea2f3ffaba45123024f05c
-
SHA256
e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae
-
SHA512
d7ca6988dfda70a9e390ebe2a65c2a01bd0fe2407df8be83276a1f31781b1bc143daad40ff90310d0fe78c3beffc3b817b8c32637de732c049689d12b62ab4a7
Malware Config
Extracted
vjw0rm
http://jsgrouplimited.duckdns.org:9614
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 5 1576 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scanned.js wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\5RQEBVICNC = "\"C:\\Users\\Admin\\AppData\\Roaming\\Scanned.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1212 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1576 wrote to memory of 1212 1576 wscript.exe 29 PID 1576 wrote to memory of 1212 1576 wscript.exe 29 PID 1576 wrote to memory of 1212 1576 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Scanned.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Scanned.js2⤵
- Creates scheduled task(s)
PID:1212
-