Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
code.vbs
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
code.vbs
Resource
win10v2004-20240419-en
5 signatures
150 seconds
General
-
Target
code.vbs
-
Size
190B
-
MD5
3328b723936164875d2b87956c3bc0ed
-
SHA1
de856b5fc8fa8f2dc4df03b59029c76b4b3a3222
-
SHA256
c4ded1df8209bf46e95a12590163769a2a26780cd322064ed1ed37eeae425288
-
SHA512
fb72494eb0c5cb4bffffeb767c838e74e644683d70f63cca9e995d6136a45e30ab521038304b8c637ff9fa7d18153c937c4980d635c62b6e868bb0847ae411a3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
pid Process 1172 taskkill.exe 1784 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1172 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1172 2368 WScript.exe 28 PID 2368 wrote to memory of 1172 2368 WScript.exe 28 PID 2368 wrote to memory of 1172 2368 WScript.exe 28 PID 2368 wrote to memory of 3012 2368 WScript.exe 30 PID 2368 wrote to memory of 3012 2368 WScript.exe 30 PID 2368 wrote to memory of 3012 2368 WScript.exe 30 PID 2368 wrote to memory of 2540 2368 WScript.exe 32 PID 2368 wrote to memory of 2540 2368 WScript.exe 32 PID 2368 wrote to memory of 2540 2368 WScript.exe 32 PID 2368 wrote to memory of 2556 2368 WScript.exe 34 PID 2368 wrote to memory of 2556 2368 WScript.exe 34 PID 2368 wrote to memory of 2556 2368 WScript.exe 34 PID 2368 wrote to memory of 2700 2368 WScript.exe 36 PID 2368 wrote to memory of 2700 2368 WScript.exe 36 PID 2368 wrote to memory of 2700 2368 WScript.exe 36 PID 2368 wrote to memory of 2696 2368 WScript.exe 38 PID 2368 wrote to memory of 2696 2368 WScript.exe 38 PID 2368 wrote to memory of 2696 2368 WScript.exe 38 PID 2368 wrote to memory of 2456 2368 WScript.exe 40 PID 2368 wrote to memory of 2456 2368 WScript.exe 40 PID 2368 wrote to memory of 2456 2368 WScript.exe 40 PID 2368 wrote to memory of 2344 2368 WScript.exe 43 PID 2368 wrote to memory of 2344 2368 WScript.exe 43 PID 2368 wrote to memory of 2344 2368 WScript.exe 43 PID 2368 wrote to memory of 2216 2368 WScript.exe 45 PID 2368 wrote to memory of 2216 2368 WScript.exe 45 PID 2368 wrote to memory of 2216 2368 WScript.exe 45 PID 2368 wrote to memory of 2468 2368 WScript.exe 47 PID 2368 wrote to memory of 2468 2368 WScript.exe 47 PID 2368 wrote to memory of 2468 2368 WScript.exe 47 PID 2368 wrote to memory of 2168 2368 WScript.exe 49 PID 2368 wrote to memory of 2168 2368 WScript.exe 49 PID 2368 wrote to memory of 2168 2368 WScript.exe 49 PID 2368 wrote to memory of 2944 2368 WScript.exe 51 PID 2368 wrote to memory of 2944 2368 WScript.exe 51 PID 2368 wrote to memory of 2944 2368 WScript.exe 51 PID 2368 wrote to memory of 1944 2368 WScript.exe 53 PID 2368 wrote to memory of 1944 2368 WScript.exe 53 PID 2368 wrote to memory of 1944 2368 WScript.exe 53 PID 2368 wrote to memory of 2676 2368 WScript.exe 55 PID 2368 wrote to memory of 2676 2368 WScript.exe 55 PID 2368 wrote to memory of 2676 2368 WScript.exe 55 PID 2368 wrote to memory of 2672 2368 WScript.exe 57 PID 2368 wrote to memory of 2672 2368 WScript.exe 57 PID 2368 wrote to memory of 2672 2368 WScript.exe 57 PID 2368 wrote to memory of 2768 2368 WScript.exe 59 PID 2368 wrote to memory of 2768 2368 WScript.exe 59 PID 2368 wrote to memory of 2768 2368 WScript.exe 59 PID 2368 wrote to memory of 2636 2368 WScript.exe 61 PID 2368 wrote to memory of 2636 2368 WScript.exe 61 PID 2368 wrote to memory of 2636 2368 WScript.exe 61 PID 2368 wrote to memory of 1772 2368 WScript.exe 63 PID 2368 wrote to memory of 1772 2368 WScript.exe 63 PID 2368 wrote to memory of 1772 2368 WScript.exe 63 PID 2368 wrote to memory of 1192 2368 WScript.exe 65 PID 2368 wrote to memory of 1192 2368 WScript.exe 65 PID 2368 wrote to memory of 1192 2368 WScript.exe 65 PID 2368 wrote to memory of 2036 2368 WScript.exe 67 PID 2368 wrote to memory of 2036 2368 WScript.exe 67 PID 2368 wrote to memory of 2036 2368 WScript.exe 67 PID 2368 wrote to memory of 2340 2368 WScript.exe 69 PID 2368 wrote to memory of 2340 2368 WScript.exe 69 PID 2368 wrote to memory of 2340 2368 WScript.exe 69 PID 2368 wrote to memory of 1784 2368 WScript.exe 71
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:3012
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2700
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2696
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2456
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2344
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2216
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2468
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2168
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2944
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1944
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2672
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2768
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2636
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1772
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1192
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2036
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2340
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im svchost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1164