Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/12/2023, 05:40
231212-gc66cshah9 312/12/2023, 03:54
231212-egdy9sedhp 712/12/2023, 03:29
231212-d17j9aebcq 712/12/2023, 03:21
231212-dwfwqseaep 712/12/2023, 02:23
231212-cvagwsddal 712/12/2023, 01:55
231212-ccfaesecc8 3Analysis
-
max time kernel
191s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
how to evict a tenant without rental agreement qld 75227.js
Resource
win10v2004-20231130-en
windows10-2004-x64
11 signatures
600 seconds
General
-
Target
how to evict a tenant without rental agreement qld 75227.js
-
Size
843KB
-
MD5
c1ec1d082324850bebd8e7826098a516
-
SHA1
cafd1bdff3c8501c9d14c5fcc1fd87cb468c40b3
-
SHA256
7abd6a84f2ac6899901d0ebf5795a5626533018f5eaa3cbf97023d2c67380be6
-
SHA512
9b6f039c4be149f974a83cf9d4fc5af9cdccbaf17ebf36198e67362d5c91d425e16e558432f972f4587328e491e8087f3466eb3afeea8150e2389e9d26f7e323
-
SSDEEP
24576:SUCgo+ogQc5WfNnZmD/nAdzFrJCeT+hH4WkyQTaEFNE3NEr:SUCgo+ogQc5WfNnZmD/n4zFrJ1WkyQTZ
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation wscript.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 940 powershell.exe 940 powershell.exe 940 powershell.exe 940 powershell.exe 940 powershell.exe 940 powershell.exe 940 powershell.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 940 powershell.exe 940 powershell.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 940 powershell.exe 940 powershell.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 940 powershell.exe Token: SeIncreaseQuotaPrivilege 940 powershell.exe Token: SeSecurityPrivilege 940 powershell.exe Token: SeTakeOwnershipPrivilege 940 powershell.exe Token: SeLoadDriverPrivilege 940 powershell.exe Token: SeSystemProfilePrivilege 940 powershell.exe Token: SeSystemtimePrivilege 940 powershell.exe Token: SeProfSingleProcessPrivilege 940 powershell.exe Token: SeIncBasePriorityPrivilege 940 powershell.exe Token: SeCreatePagefilePrivilege 940 powershell.exe Token: SeBackupPrivilege 940 powershell.exe Token: SeRestorePrivilege 940 powershell.exe Token: SeShutdownPrivilege 940 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeSystemEnvironmentPrivilege 940 powershell.exe Token: SeRemoteShutdownPrivilege 940 powershell.exe Token: SeUndockPrivilege 940 powershell.exe Token: SeManageVolumePrivilege 940 powershell.exe Token: 33 940 powershell.exe Token: 34 940 powershell.exe Token: 35 940 powershell.exe Token: 36 940 powershell.exe Token: SeIncreaseQuotaPrivilege 940 powershell.exe Token: SeSecurityPrivilege 940 powershell.exe Token: SeTakeOwnershipPrivilege 940 powershell.exe Token: SeLoadDriverPrivilege 940 powershell.exe Token: SeSystemProfilePrivilege 940 powershell.exe Token: SeSystemtimePrivilege 940 powershell.exe Token: SeProfSingleProcessPrivilege 940 powershell.exe Token: SeIncBasePriorityPrivilege 940 powershell.exe Token: SeCreatePagefilePrivilege 940 powershell.exe Token: SeBackupPrivilege 940 powershell.exe Token: SeRestorePrivilege 940 powershell.exe Token: SeShutdownPrivilege 940 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeSystemEnvironmentPrivilege 940 powershell.exe Token: SeRemoteShutdownPrivilege 940 powershell.exe Token: SeUndockPrivilege 940 powershell.exe Token: SeManageVolumePrivilege 940 powershell.exe Token: 33 940 powershell.exe Token: 34 940 powershell.exe Token: 35 940 powershell.exe Token: 36 940 powershell.exe Token: SeIncreaseQuotaPrivilege 940 powershell.exe Token: SeSecurityPrivilege 940 powershell.exe Token: SeTakeOwnershipPrivilege 940 powershell.exe Token: SeLoadDriverPrivilege 940 powershell.exe Token: SeSystemProfilePrivilege 940 powershell.exe Token: SeSystemtimePrivilege 940 powershell.exe Token: SeProfSingleProcessPrivilege 940 powershell.exe Token: SeIncBasePriorityPrivilege 940 powershell.exe Token: SeCreatePagefilePrivilege 940 powershell.exe Token: SeBackupPrivilege 940 powershell.exe Token: SeRestorePrivilege 940 powershell.exe Token: SeShutdownPrivilege 940 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeSystemEnvironmentPrivilege 940 powershell.exe Token: SeRemoteShutdownPrivilege 940 powershell.exe Token: SeUndockPrivilege 940 powershell.exe Token: SeManageVolumePrivilege 940 powershell.exe Token: 33 940 powershell.exe Token: 34 940 powershell.exe Token: 35 940 powershell.exe Token: 36 940 powershell.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2608 wrote to memory of 548 2608 cmd.exe 108 PID 2608 wrote to memory of 548 2608 cmd.exe 108 PID 3152 wrote to memory of 4480 3152 wscript.EXE 110 PID 3152 wrote to memory of 4480 3152 wscript.EXE 110 PID 4480 wrote to memory of 940 4480 cscript.exe 115 PID 4480 wrote to memory of 940 4480 cscript.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\how to evict a tenant without rental agreement qld 75227.js"1⤵PID:1184
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3688
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\cscript.execscript.exe "C:\Users\Admin\AppData\Local\Temp\how to evict a tenant without rental agreement qld 75227.js"2⤵PID:548
-
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE HIGHOR~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "HIGHOR~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\how to evict a tenant without rental agreement qld 75227.js"1⤵PID:4308
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:856
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\how to evict a tenant without rental agreement qld 75227.js"1⤵PID:5100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
28.8MB
MD596c9b76474ba1a4c9e8901c73b3e094d
SHA1bc7a8cfd1ce44b7550cfbab79611a905aa143073
SHA256cbc014cdb3518fe96dc8027b80ff79308d455c265b174f6675cacb38c782bb6d
SHA51246731ffd640f0deabe5acef5da3dd573cc302a306f4b3a1e14529a769492a41d025f3778a8a2eda112e9c6e064cddc301152fdcf54c89c463e194190b5e4ee1b