Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 07:26
Static task
static1
Behavioral task
behavioral1
Sample
2d59355fbdada25c304edf911a63281d.js
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2d59355fbdada25c304edf911a63281d.js
Resource
win10v2004-20231222-en
General
-
Target
2d59355fbdada25c304edf911a63281d.js
-
Size
12KB
-
MD5
2d59355fbdada25c304edf911a63281d
-
SHA1
2200956e98b3b32e0693ed54af08b3372f541f37
-
SHA256
0fe50396b25c43452630b9cac1e2ddda31a9358cb7be5e8145cf382fc6e8d95c
-
SHA512
27b74c61783b8f97d55f89759bb6407eba558675ae2287f3df1572473b31578a3dd6eaa2222d45fb29b0518602b42a274b56f325447febcff6eac29bd7c498ff
-
SSDEEP
192:e7fID5S39Auo7+nPPl/zsgDkuRxl7VXbTJWQpPqWxFhXwaf5ybRqD+eLdOg:eTIs3Ro2lsgttrlFXRjhbjdB
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
flow pid Process 3 2380 wscript.exe 6 2380 wscript.exe 8 2380 wscript.exe 9 2380 wscript.exe 10 2380 wscript.exe 11 2380 wscript.exe 13 2380 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d59355fbdada25c304edf911a63281d.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d59355fbdada25c304edf911a63281d.js wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\O3FNWNFPWY = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2d59355fbdada25c304edf911a63281d.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2712 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2712 2380 wscript.exe 19 PID 2380 wrote to memory of 2712 2380 wscript.exe 19 PID 2380 wrote to memory of 2712 2380 wscript.exe 19 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2d59355fbdada25c304edf911a63281d.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\2d59355fbdada25c304edf911a63281d.js2⤵
- Creates scheduled task(s)
PID:2712
-