Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
511f6a9de220c99adf7e2e03a4e48886.js
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
511f6a9de220c99adf7e2e03a4e48886.js
Resource
win10v2004-20231215-en
General
-
Target
511f6a9de220c99adf7e2e03a4e48886.js
-
Size
27KB
-
MD5
511f6a9de220c99adf7e2e03a4e48886
-
SHA1
7e3c217e99f7bdd44c2e760feaf413cb3a7736fb
-
SHA256
2a830c7923253031907c1dd34c4a9532c1f53e8fe7f6a3c8359a0e93ef4b216e
-
SHA512
8fe6e672872a208e9cac950856c1afa4cdb7fc496cc67531a98322fed1f1b83b1b7b5ce7f5a702b56197c853f0bf09deb5e1958b4369ca01cb42c401fdb4c090
-
SSDEEP
768:BIa7X/aqtEJfke022Fb+wGcrLQfpds+TbGKRRcpX:qabledke0HFbpGoLQfs+TbGORcpX
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3768 schtasks.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2004 wrote to memory of 3132 2004 wscript.exe 30 PID 2004 wrote to memory of 3132 2004 wscript.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\511f6a9de220c99adf7e2e03a4e48886.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PhOPzJgSgd.js"2⤵PID:3132
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\511f6a9de220c99adf7e2e03a4e48886.js2⤵
- Creates scheduled task(s)
PID:3768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5398ea7fcde0fe6de66a488b8d0df37b3
SHA1847de03f765f337624423386aa124e0910c22883
SHA2569bfbb43d7401e73169d525c90feb26e4d968a301cb7f6045535c8025f780d731
SHA512bc9a0491ea5c9f5aadb63e7a8811acebca4afeb9c1d76db985d2c7732c36ffe7e1fbb0cff970cabf51bc20db752cef847712b4147e8d0480014d1f7d3bb08111