Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
file.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
file.js
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
file.js
-
Size
313KB
-
MD5
2ecfb5962169fd0cd5481a5bdfa56bba
-
SHA1
9e97ed9944bc0442554b423009f1b4950811a4fc
-
SHA256
b50491831cb3674fcdb34933ad61d233ac2cc275ac396d00f7257f9bc0328a97
-
SHA512
4ff559da10ff93d72f0207178f2da7804aff4a8470652630c43c106283280140329fcd14a567ec11482aa248e3f7ceb775de762fbff1b2c1fe368bd5bab7fddf
-
SSDEEP
6144:4MJG53b6/eR6+9RtBBg6G/MsfYrxdmQuPrPU+7:4M053bvRDDBBg6NCPF
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2464 WMIC.exe Token: SeSecurityPrivilege 2464 WMIC.exe Token: SeTakeOwnershipPrivilege 2464 WMIC.exe Token: SeLoadDriverPrivilege 2464 WMIC.exe Token: SeSystemProfilePrivilege 2464 WMIC.exe Token: SeSystemtimePrivilege 2464 WMIC.exe Token: SeProfSingleProcessPrivilege 2464 WMIC.exe Token: SeIncBasePriorityPrivilege 2464 WMIC.exe Token: SeCreatePagefilePrivilege 2464 WMIC.exe Token: SeBackupPrivilege 2464 WMIC.exe Token: SeRestorePrivilege 2464 WMIC.exe Token: SeShutdownPrivilege 2464 WMIC.exe Token: SeDebugPrivilege 2464 WMIC.exe Token: SeSystemEnvironmentPrivilege 2464 WMIC.exe Token: SeRemoteShutdownPrivilege 2464 WMIC.exe Token: SeUndockPrivilege 2464 WMIC.exe Token: SeManageVolumePrivilege 2464 WMIC.exe Token: 33 2464 WMIC.exe Token: 34 2464 WMIC.exe Token: 35 2464 WMIC.exe Token: SeIncreaseQuotaPrivilege 2464 WMIC.exe Token: SeSecurityPrivilege 2464 WMIC.exe Token: SeTakeOwnershipPrivilege 2464 WMIC.exe Token: SeLoadDriverPrivilege 2464 WMIC.exe Token: SeSystemProfilePrivilege 2464 WMIC.exe Token: SeSystemtimePrivilege 2464 WMIC.exe Token: SeProfSingleProcessPrivilege 2464 WMIC.exe Token: SeIncBasePriorityPrivilege 2464 WMIC.exe Token: SeCreatePagefilePrivilege 2464 WMIC.exe Token: SeBackupPrivilege 2464 WMIC.exe Token: SeRestorePrivilege 2464 WMIC.exe Token: SeShutdownPrivilege 2464 WMIC.exe Token: SeDebugPrivilege 2464 WMIC.exe Token: SeSystemEnvironmentPrivilege 2464 WMIC.exe Token: SeRemoteShutdownPrivilege 2464 WMIC.exe Token: SeUndockPrivilege 2464 WMIC.exe Token: SeManageVolumePrivilege 2464 WMIC.exe Token: 33 2464 WMIC.exe Token: 34 2464 WMIC.exe Token: 35 2464 WMIC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2248 1368 wscript.exe 28 PID 1368 wrote to memory of 2248 1368 wscript.exe 28 PID 1368 wrote to memory of 2248 1368 wscript.exe 28 PID 2248 wrote to memory of 2464 2248 cmd.exe 30 PID 2248 wrote to memory of 2464 2248 cmd.exe 30 PID 2248 wrote to memory of 2464 2248 cmd.exe 30 PID 2248 wrote to memory of 2636 2248 cmd.exe 31 PID 2248 wrote to memory of 2636 2248 cmd.exe 31 PID 2248 wrote to memory of 2636 2248 cmd.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\file.js1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\file.js" "C:\Users\Admin\\stiffrelievedawesome.bat" && "C:\Users\Admin\\stiffrelievedawesome.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_operatingsystem get oslanguage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\system32\find.exefind /i "1033"3⤵PID:2636
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD52ecfb5962169fd0cd5481a5bdfa56bba
SHA19e97ed9944bc0442554b423009f1b4950811a4fc
SHA256b50491831cb3674fcdb34933ad61d233ac2cc275ac396d00f7257f9bc0328a97
SHA5124ff559da10ff93d72f0207178f2da7804aff4a8470652630c43c106283280140329fcd14a567ec11482aa248e3f7ceb775de762fbff1b2c1fe368bd5bab7fddf