Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
e1fe4fbc351e87183a531bc2263a4d24.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1fe4fbc351e87183a531bc2263a4d24.js
Resource
win10v2004-20240226-en
General
-
Target
e1fe4fbc351e87183a531bc2263a4d24.js
-
Size
16KB
-
MD5
e1fe4fbc351e87183a531bc2263a4d24
-
SHA1
cca28f37cd27838f83848bd719c5881da1063af7
-
SHA256
dca9742380d4dfe4f501f1f24e3b856113be1be99a1548e27117cc67bd997fb9
-
SHA512
5ec3eb28207223cca9c18f667a4ed90b077f21ba1e07c7adf54c69549e178a3131c28dce5ff6a54cdf25952fccfe5466cb9fb87bab4e97dd6246441d7a70dc6e
-
SSDEEP
384:xZTsZHapjsJXe2pTn1ZmF1qJtOSK6qEt5nYmrk56YjlBeqj3ieKzYF:ENapY9nDmF18tOp6J/EljVj3lRF
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
flow pid Process 3 1340 wscript.exe 7 1340 wscript.exe 11 1340 wscript.exe 12 1340 wscript.exe 15 1340 wscript.exe 16 1340 wscript.exe 19 1340 wscript.exe 20 1340 wscript.exe 23 1340 wscript.exe 24 1340 wscript.exe 25 1340 wscript.exe 27 1340 wscript.exe 31 1340 wscript.exe 32 1340 wscript.exe 36 1340 wscript.exe 38 1340 wscript.exe 41 1340 wscript.exe 43 1340 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nopMjEzIbA.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nopMjEzIbA.js wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\B02N3ZE1UL = "\"C:\\Users\\Admin\\AppData\\Roaming\\nopMjEzIbA.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1340 wrote to memory of 3004 1340 wscript.exe 28 PID 1340 wrote to memory of 3004 1340 wscript.exe 28 PID 1340 wrote to memory of 3004 1340 wscript.exe 28
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e1fe4fbc351e87183a531bc2263a4d24.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\nopMjEzIbA.js"2⤵
- Drops startup file
- Adds Run key to start application
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5264923fdf0bb68453e75ec977797b941
SHA13d96a714f8221c5ea2ac915df442c1b22b0732ea
SHA256d53e232516a9e0b88c8e9f43f6850eb3010f1524c4eb92af501da252746f1d5d
SHA51273c7c582c22ba0afb4711978d558b685a1c4f4901b1cbbf9b80f88570edf0b537eeaa9354c41a2bc620395d6d254c03e043142ac2e3ca43c9d5104d18eee62f8