Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 01:42

General

  • Target

    CanadaPost.vbs

  • Size

    992KB

  • MD5

    96c5986b404a8c6e6de74d0cfb8378e3

  • SHA1

    4d1da67b3435078a52b93fb152cd0fdeb961e9df

  • SHA256

    09d140195418ed9897b3e54c59eb4f3a4b400d3334c59d5e531ae33e41cfd417

  • SHA512

    c6177c267998a221a5b2216f88adc99e6f58bd14aef5aaadd2b3ad05a302112750fda3cd9031e523f31fbd1d7af5a09c3582787e43a2b2c2e00de39bb5e24ca3

  • SSDEEP

    6144:bCJ1K7dEWn1Tm3dKRZObCHTiR5hejeGyWuMEV9ZOLEJ77DXWtE8dPbnsch48T88m:/MsFAAa4esRzuhX

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CanadaPost.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Copy-Item -Path "C:\Users\Admin\AppData\Local\Temp\CanadaPost.vbs" -Destination "C:\Users\Admin\AppData\Roaming\jwNfQwRWXjqVQOaZcSYkamfRK.vbs"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep unrestricted -file "C:\Users\Admin\AppData\Roaming\9ZXSD69X1NMFTKPF9I5B0ZPOO.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -Name ARSv5 -PropertyType String -Value C:\Users\Admin\AppData\Roaming\jwNfQwRWXjqVQOaZcSYkamfRK.vbs
      2⤵
      • Adds Run key to start application
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command New-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -Name ARSv5 -PropertyType String -Value C:\Users\Admin\AppData\Roaming\jwNfQwRWXjqVQOaZcSYkamfRK.vbs
      2⤵
      • Adds Run key to start application
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3344
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep unrestricted -file "C:\Users\Admin\AppData\Roaming\arsguarded.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep unrestricted -file "C:\Users\Admin\AppData\Roaming\arsguarded.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    6cf293cb4d80be23433eecf74ddb5503

    SHA1

    24fe4752df102c2ef492954d6b046cb5512ad408

    SHA256

    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

    SHA512

    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    367b1c81198bfdcdba813c2c336627a3

    SHA1

    37fe6414eafaaed4abb91c1aafde62c5b688b711

    SHA256

    1141e163d84d5ef0038593c866647f27c55510de2147dc1578130e518a22cced

    SHA512

    e0493957e6602efb156d372e5e66147056f6e3c2e01996ba9b4e04f82b2b1e4c7236d0e3681dce9ab4911a62546b6a141f1ae731de6e8184e758caf120cf594b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    4725b0a7fb8936b5dc7e17258640b730

    SHA1

    15ce498309e81e61167045dc5461311cee1a37e8

    SHA256

    679695e9cce9b9348f537e4a5393c0c2f89896506234826c30bd08b600d630b9

    SHA512

    33de39066d210f0c4fafa25350c6d839530fe0ca79a7a63e4592eb87f72fe260ffdf43f89a1adbcb2054bf378166d8825ec823c318d4d2af64e31cd1aff6f42f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    235a8eb126d835efb2e253459ab8b089

    SHA1

    293fbf68e6726a5a230c3a42624c01899e35a89f

    SHA256

    5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

    SHA512

    a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    446dd1cf97eaba21cf14d03aebc79f27

    SHA1

    36e4cc7367e0c7b40f4a8ace272941ea46373799

    SHA256

    a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

    SHA512

    a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ezkuqfsj.kjg.psm1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\9ZXSD69X1NMFTKPF9I5B0ZPOO.ps1

    Filesize

    1KB

    MD5

    169c9c7b67ebcb07c14f64f6f2e5352e

    SHA1

    c255e575564b6b963aba03b4ae03a9addcfbc177

    SHA256

    c6a718c05967e8afb26b7093debecba788986bacacbe6f8a1660ededcc85c6b1

    SHA512

    69584d79bb9d8e92bc1024ada7a920511c4b8dd3a09f8d5b717b69863629c603da5acb1b56073daf667f52ffedc2b809f7b719fba8cd6900e688c47a72f26c7e

  • C:\Users\Admin\AppData\Roaming\arsguarded.ps1

    Filesize

    874B

    MD5

    8753eddd386bc6f0a95c814d2d84a8d9

    SHA1

    6a00b8217a0f87e0dd56d1c0c1f72dcf2a6e14ab

    SHA256

    682c5e9a2d08cb4679fdf63b387c0640f9ec7e5121a467c48d8db365873043c7

    SHA512

    aeef2730cd9cf9413813682574fadcc31c22783aa3ace0163186d8746957fb329b17cb619c74b0ddd72cce4753f1ae199877ac248e0b3ea85795abd235c0f591

  • C:\Users\Admin\AppData\Roaming\~tmp_st_scr.png

    Filesize

    429KB

    MD5

    68b4da093e862ffc4027d35e9620d32c

    SHA1

    d8435d664f408bd40cffa29411a8ca262ea1502f

    SHA256

    ca944183e4f037f1b87429ad4f4307296b34cd2dc715bc6584ef4029ef89c992

    SHA512

    8afd1ddf67f07055320b924db7c5a73285e6a010906ca813b7515e41e3e2902094df45de8e708999ab3495caf933c9b7d4cc3e3370bbd05f5132b0f846980bd4

  • memory/4860-0-0x00007FFEC3B73000-0x00007FFEC3B75000-memory.dmp

    Filesize

    8KB

  • memory/4860-16-0x00007FFEC3B70000-0x00007FFEC4631000-memory.dmp

    Filesize

    10.8MB

  • memory/4860-12-0x00007FFEC3B70000-0x00007FFEC4631000-memory.dmp

    Filesize

    10.8MB

  • memory/4860-11-0x00007FFEC3B70000-0x00007FFEC4631000-memory.dmp

    Filesize

    10.8MB

  • memory/4860-6-0x000001DFED2B0000-0x000001DFED2D2000-memory.dmp

    Filesize

    136KB