Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

97051x50.js

windows7-x64

3

97051x50.js

windows10-1703-x64

3

97051x50.js

windows10-2004-x64

3

97051x50.js

windows11-21h2-x64

3

97051x50.js

macos-10.15-amd64

4

97051x50.js

debian-12-armhf

1

97051x50.js

debian-12-mipsel

97051x50.js

debian-9-armhf

1

97051x50.js

debian-9-mips

97051x50.js

debian-9-mipsel

97051x50.js

ubuntu-18.04-amd64

3

97051x50.js

ubuntu-20.04-amd64

3

Analysis

  • max time kernel
    98s
  • max time network
    142s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    07/05/2024, 08:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97051x50.js

  • Size

    198KB

  • MD5

    1e59346be8425c4f32d45208f317a310

  • SHA1

    07c4a37296d45525df6438c275e399e441c137d0

  • SHA256

    47c7fe6dc2bba538c46e3386b15d975e01c9502c8ef4b7befb590aa2c106806f

  • SHA512

    bcba915dab243c0bef3fd584bc1c32db6f4bb2e99e32271edc20285ae7647a04ffb79e47bc8bf9c371b3342a545617903e79e79b13776fcc22e69764a2cb91bd

  • SSDEEP

    3072:0Uxe74Ver9oM+X8TbBV1kjY+Kqv4lGR1kh0KhsUUWml2lLvT/+acgnY923vJ0iB:08bMvnfSM+Kqv40khnsUU3l2lDT/Ni98

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.gkreport
    1⤵
      PID:480
    • /usr/libexec/xpcproxy
      xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
      1⤵
        PID:481
      • /usr/libexec/gkreport
        /usr/libexec/gkreport
        1⤵
          PID:480
        • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
          /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
          1⤵
            PID:481
          • /usr/libexec/xpcproxy
            xpcproxy com.apple.systemstats.daily
            1⤵
              PID:482
            • /bin/sh
              sh -c "sudo /bin/zsh -c \"/Users/run/97051x50.js\""
              1⤵
                PID:483
              • /usr/libexec/xpcproxy
                xpcproxy com.oracle.java.Java-Updater
                1⤵
                  PID:484
                • /bin/bash
                  sh -c "sudo /bin/zsh -c \"/Users/run/97051x50.js\""
                  1⤵
                    PID:483
                  • /usr/bin/sudo
                    sudo /bin/zsh -c /Users/run/97051x50.js
                    1⤵
                      PID:483
                      • /bin/zsh
                        /bin/zsh -c /Users/run/97051x50.js
                        2⤵
                          PID:486
                        • /Users/run/97051x50.js
                          /Users/run/97051x50.js
                          2⤵
                            PID:486
                          • /bin/sh
                            sh /Users/run/97051x50.js
                            2⤵
                              PID:486
                            • /bin/bash
                              sh /Users/run/97051x50.js
                              2⤵
                                PID:486
                            • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                              "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                              1⤵
                                PID:484

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads