Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2024, 02:51

General

  • Target

    5bf1a543796637bd57aed27f8fcf67e7.js

  • Size

    52KB

  • MD5

    5bf1a543796637bd57aed27f8fcf67e7

  • SHA1

    ba263f1a5157a912e7a0984602ce910d97366b8b

  • SHA256

    1e60267536edbee8cc12a8757fe147727bf4513b6e4ae7fb1329ccf95344933e

  • SHA512

    6f0306906716f46a9fa82d3ee1876f36abbe999ba7fcfdc2cb27653cf902c59d2e83d7f010c261b836cff394770df4ac208d43ef709287f7701384c8874b245b

  • SSDEEP

    768:M13RwPVMMh26+la3RnMf73Ibq5ajmsdPwieARXXRi1ClK6RJ+3l3lrIOwkxb:Q3RwpY6+la3BS7TypwZARnqcbOweb

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Drops startup file 4 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\5bf1a543796637bd57aed27f8fcf67e7.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BcZlevrPxo.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:3052
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\take90.vbs"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\take90.vbs

    Filesize

    13KB

    MD5

    c144aabf6a599097eafe80ea421708d6

    SHA1

    6cafcd68e7cb5dee5ce8ca7a4b5be7762038cbcc

    SHA256

    760ea4debdf2ab6968f0db5caa873f77375ed5614ff0107cd96f10de343240a2

    SHA512

    82ee26896380705f419fc25fc65bc8b1124e433a869597340f6de20020ae8e2a54d98ad372a782f777dfab37cba33afb95be7db7e7e7cb32f690eff1cc591008

  • C:\Users\Admin\AppData\Roaming\BcZlevrPxo.js

    Filesize

    10KB

    MD5

    554108711a6d03fb0e8d99913f690006

    SHA1

    c95410a0eb00465103036857bd09db3412e77ceb

    SHA256

    d522485de782fb71950a600c1167dd0951514f62168d36434040f291ee072bb1

    SHA512

    773ebda305c28e83127456d620a481f292898979c4792156f2f42b5fa033643e6a43de52f51b59414d7a807b1813998fff1e7beeb59f37cba6ec95c3956c425b