Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
11/08/2023, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
Ordine.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Ordine.js
Resource
win10v2004-20230703-en
General
-
Target
Ordine.js
-
Size
25KB
-
MD5
050f45c59845d7cd81e6a5453abdbecb
-
SHA1
338a94e4687d2af02d4976a32b6c621922a63eb4
-
SHA256
e826c9211b3aaedc5e047675a23f02a74c11b3bf761a696b4d4fe1871407bec4
-
SHA512
b4e7c60bac88a6215f3a7f83537e55c0edf4d36f9c5baa24ffb5555e9aa8dd699d7df28137165dc383e6f247b241f9ecb7c3d0da28a31b9d3080232cde5099b0
-
SSDEEP
384:7ZLKw/uOQ/cgcnUs7WonQI1Ly0LTXqS1KLfmZ2bwMbesdGJu6WHP3B8Lshd:XuTcgcnbWLI5NLzVcOZ2rbeHJ+mshd
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
flow pid Process 5 2616 wscript.exe 6 2616 wscript.exe 7 2616 wscript.exe 9 2616 wscript.exe 10 2616 wscript.exe 11 2616 wscript.exe 13 2616 wscript.exe 14 2616 wscript.exe 15 2616 wscript.exe 17 2616 wscript.exe 18 2616 wscript.exe 19 2616 wscript.exe 21 2616 wscript.exe 22 2616 wscript.exe 23 2616 wscript.exe 25 2616 wscript.exe 26 2616 wscript.exe 27 2616 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ordine.js wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ordine.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1100 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2616 wrote to memory of 1100 2616 wscript.exe 29 PID 2616 wrote to memory of 1100 2616 wscript.exe 29 PID 2616 wrote to memory of 1100 2616 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Ordine.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Ordine.js2⤵
- Creates scheduled task(s)
PID:1100
-