Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
5bf1a543796637bd57aed27f8fcf67e7.js
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5bf1a543796637bd57aed27f8fcf67e7.js
Resource
win10v2004-20231222-en
General
-
Target
5bf1a543796637bd57aed27f8fcf67e7.js
-
Size
52KB
-
MD5
5bf1a543796637bd57aed27f8fcf67e7
-
SHA1
ba263f1a5157a912e7a0984602ce910d97366b8b
-
SHA256
1e60267536edbee8cc12a8757fe147727bf4513b6e4ae7fb1329ccf95344933e
-
SHA512
6f0306906716f46a9fa82d3ee1876f36abbe999ba7fcfdc2cb27653cf902c59d2e83d7f010c261b836cff394770df4ac208d43ef709287f7701384c8874b245b
-
SSDEEP
768:M13RwPVMMh26+la3RnMf73Ibq5ajmsdPwieARXXRi1ClK6RJ+3l3lrIOwkxb:Q3RwpY6+la3BS7TypwZARnqcbOweb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BcZlevrPxo.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\take90.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\take90.vbs wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BcZlevrPxo.js wscript.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\take90 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\take90.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\take90 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\take90.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\BcZlevrPxo.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 4732 1500 wscript.exe 88 PID 1500 wrote to memory of 4732 1500 wscript.exe 88 PID 1500 wrote to memory of 4984 1500 wscript.exe 89 PID 1500 wrote to memory of 4984 1500 wscript.exe 89
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\5bf1a543796637bd57aed27f8fcf67e7.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BcZlevrPxo.js"2⤵
- Drops startup file
- Adds Run key to start application
PID:4732
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\take90.vbs"2⤵
- Drops startup file
- Adds Run key to start application
PID:4984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5c144aabf6a599097eafe80ea421708d6
SHA16cafcd68e7cb5dee5ce8ca7a4b5be7762038cbcc
SHA256760ea4debdf2ab6968f0db5caa873f77375ed5614ff0107cd96f10de343240a2
SHA51282ee26896380705f419fc25fc65bc8b1124e433a869597340f6de20020ae8e2a54d98ad372a782f777dfab37cba33afb95be7db7e7e7cb32f690eff1cc591008
-
Filesize
10KB
MD5554108711a6d03fb0e8d99913f690006
SHA1c95410a0eb00465103036857bd09db3412e77ceb
SHA256d522485de782fb71950a600c1167dd0951514f62168d36434040f291ee072bb1
SHA512773ebda305c28e83127456d620a481f292898979c4792156f2f42b5fa033643e6a43de52f51b59414d7a807b1813998fff1e7beeb59f37cba6ec95c3956c425b