Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
Purchaseorder.js
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Purchaseorder.js
Resource
win10v2004-20230915-en
General
-
Target
Purchaseorder.js
-
Size
3.1MB
-
MD5
cd12101e3da7cfc1e15be51324d97f26
-
SHA1
3ef05de60568b30104e18a72b783c8e21fb83c01
-
SHA256
7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
-
SHA512
fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
-
SSDEEP
768:qQKDwkB5j+Dd3MLyi/vdvK8cuUzwJBO0enr8uYUlN8b6iLBJbr59RlwDh:x8wkDaDd3gyiVAz10+ouFkPr52d
Malware Config
Signatures
-
Blocklisted process makes network request 59 IoCs
flow pid Process 4 2936 wscript.exe 7 2332 wscript.exe 10 2956 wscript.exe 11 2956 wscript.exe 13 2936 wscript.exe 14 2332 wscript.exe 16 2956 wscript.exe 19 2936 wscript.exe 20 2332 wscript.exe 24 2956 wscript.exe 26 2936 wscript.exe 27 2332 wscript.exe 29 2956 wscript.exe 31 2936 wscript.exe 32 2332 wscript.exe 34 2956 wscript.exe 37 2936 wscript.exe 38 2332 wscript.exe 40 2956 wscript.exe 44 2956 wscript.exe 46 2936 wscript.exe 47 2332 wscript.exe 50 2956 wscript.exe 52 2936 wscript.exe 53 2332 wscript.exe 54 2956 wscript.exe 56 2936 wscript.exe 57 2332 wscript.exe 60 2956 wscript.exe 63 2936 wscript.exe 65 2956 wscript.exe 67 2332 wscript.exe 69 2956 wscript.exe 71 2936 wscript.exe 73 2332 wscript.exe 75 2956 wscript.exe 76 2936 wscript.exe 78 2332 wscript.exe 81 2956 wscript.exe 84 2936 wscript.exe 85 2332 wscript.exe 87 2956 wscript.exe 89 2936 wscript.exe 90 2956 wscript.exe 93 2332 wscript.exe 95 2956 wscript.exe 97 2936 wscript.exe 98 2332 wscript.exe 102 2956 wscript.exe 104 2936 wscript.exe 105 2332 wscript.exe 107 2956 wscript.exe 109 2936 wscript.exe 111 2956 wscript.exe 113 2332 wscript.exe 115 2956 wscript.exe 117 2936 wscript.exe 119 2332 wscript.exe 123 2956 wscript.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchaseorder.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchaseorder.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Purchaseorder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Purchaseorder.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\Purchaseorder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Purchaseorder.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Purchaseorder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Purchaseorder.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\Purchaseorder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Purchaseorder.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2936 2172 wscript.exe 28 PID 2172 wrote to memory of 2936 2172 wscript.exe 28 PID 2172 wrote to memory of 2936 2172 wscript.exe 28 PID 2172 wrote to memory of 2956 2172 wscript.exe 29 PID 2172 wrote to memory of 2956 2172 wscript.exe 29 PID 2172 wrote to memory of 2956 2172 wscript.exe 29 PID 2956 wrote to memory of 2332 2956 wscript.exe 31 PID 2956 wrote to memory of 2332 2956 wscript.exe 31 PID 2956 wrote to memory of 2332 2956 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Purchaseorder.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\AkrDdIbORR.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:2936
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Purchaseorder.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\AkrDdIbORR.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:2332
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5397495356e508277e1aa6e2f24cf43b4
SHA1eac5ebb135efcf24988cfdf0c42e031630b701a4
SHA25651e48daa54231a3f5b056882c66fad891cb81d2603a0845e0b44668d4533a3c3
SHA512953f63373cc8d0c7122def46fa9a97124123b6cac95bcfdf2d783b2be91139a43c51f1936d1197de26b461768bc94fa69911851ff012a8d0f7a5d637b6461fa4
-
Filesize
1.1MB
MD5397495356e508277e1aa6e2f24cf43b4
SHA1eac5ebb135efcf24988cfdf0c42e031630b701a4
SHA25651e48daa54231a3f5b056882c66fad891cb81d2603a0845e0b44668d4533a3c3
SHA512953f63373cc8d0c7122def46fa9a97124123b6cac95bcfdf2d783b2be91139a43c51f1936d1197de26b461768bc94fa69911851ff012a8d0f7a5d637b6461fa4
-
Filesize
1.1MB
MD5397495356e508277e1aa6e2f24cf43b4
SHA1eac5ebb135efcf24988cfdf0c42e031630b701a4
SHA25651e48daa54231a3f5b056882c66fad891cb81d2603a0845e0b44668d4533a3c3
SHA512953f63373cc8d0c7122def46fa9a97124123b6cac95bcfdf2d783b2be91139a43c51f1936d1197de26b461768bc94fa69911851ff012a8d0f7a5d637b6461fa4
-
Filesize
3.1MB
MD5cd12101e3da7cfc1e15be51324d97f26
SHA13ef05de60568b30104e18a72b783c8e21fb83c01
SHA2567ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
SHA512fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
-
Filesize
3.1MB
MD5cd12101e3da7cfc1e15be51324d97f26
SHA13ef05de60568b30104e18a72b783c8e21fb83c01
SHA2567ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
SHA512fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
-
Filesize
3.1MB
MD5cd12101e3da7cfc1e15be51324d97f26
SHA13ef05de60568b30104e18a72b783c8e21fb83c01
SHA2567ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
SHA512fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1