Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/06/2024, 13:44
240620-q2accs1ajh 1020/06/2024, 13:38
240620-qxh4pszglg 1020/06/2024, 13:15
240620-qhkc8azajd 1020/06/2024, 12:55
240620-p58hwsycke 1020/06/2024, 12:49
240620-p2g7jasdql 10Analysis
-
max time kernel
281s -
max time network
290s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
pa collective agreement pay 90174.js
Resource
win10v2004-20240508-en
General
-
Target
pa collective agreement pay 90174.js
-
Size
18.5MB
-
MD5
c4d8fa6feaef5aba8eb9b2bd2b906176
-
SHA1
31fef4eff4cda276264650c2dd1addbba9b03346
-
SHA256
a330c0d7cabdfc88e979d72f69e0c9076964b1f16c805c445426cf2b61c9ea9a
-
SHA512
6057bd5a06db48f567b8ed4ef66c67c6fc79b3f27ecfbf0b1dbb7e42e9cf7e37e0a9d9fd5097089868c9746acfe6602097eae5874d490151574fe3a01db6b5fd
-
SSDEEP
49152:ojk08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDVjk08dPXWR4ba/JOtz:ac43mMc43mMc43mMc43ml
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2428 powershell.exe Token: SeIncreaseQuotaPrivilege 2428 powershell.exe Token: SeSecurityPrivilege 2428 powershell.exe Token: SeTakeOwnershipPrivilege 2428 powershell.exe Token: SeLoadDriverPrivilege 2428 powershell.exe Token: SeSystemProfilePrivilege 2428 powershell.exe Token: SeSystemtimePrivilege 2428 powershell.exe Token: SeProfSingleProcessPrivilege 2428 powershell.exe Token: SeIncBasePriorityPrivilege 2428 powershell.exe Token: SeCreatePagefilePrivilege 2428 powershell.exe Token: SeBackupPrivilege 2428 powershell.exe Token: SeRestorePrivilege 2428 powershell.exe Token: SeShutdownPrivilege 2428 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeSystemEnvironmentPrivilege 2428 powershell.exe Token: SeRemoteShutdownPrivilege 2428 powershell.exe Token: SeUndockPrivilege 2428 powershell.exe Token: SeManageVolumePrivilege 2428 powershell.exe Token: 33 2428 powershell.exe Token: 34 2428 powershell.exe Token: 35 2428 powershell.exe Token: 36 2428 powershell.exe Token: SeIncreaseQuotaPrivilege 2428 powershell.exe Token: SeSecurityPrivilege 2428 powershell.exe Token: SeTakeOwnershipPrivilege 2428 powershell.exe Token: SeLoadDriverPrivilege 2428 powershell.exe Token: SeSystemProfilePrivilege 2428 powershell.exe Token: SeSystemtimePrivilege 2428 powershell.exe Token: SeProfSingleProcessPrivilege 2428 powershell.exe Token: SeIncBasePriorityPrivilege 2428 powershell.exe Token: SeCreatePagefilePrivilege 2428 powershell.exe Token: SeBackupPrivilege 2428 powershell.exe Token: SeRestorePrivilege 2428 powershell.exe Token: SeShutdownPrivilege 2428 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeSystemEnvironmentPrivilege 2428 powershell.exe Token: SeRemoteShutdownPrivilege 2428 powershell.exe Token: SeUndockPrivilege 2428 powershell.exe Token: SeManageVolumePrivilege 2428 powershell.exe Token: 33 2428 powershell.exe Token: 34 2428 powershell.exe Token: 35 2428 powershell.exe Token: 36 2428 powershell.exe Token: SeIncreaseQuotaPrivilege 2428 powershell.exe Token: SeSecurityPrivilege 2428 powershell.exe Token: SeTakeOwnershipPrivilege 2428 powershell.exe Token: SeLoadDriverPrivilege 2428 powershell.exe Token: SeSystemProfilePrivilege 2428 powershell.exe Token: SeSystemtimePrivilege 2428 powershell.exe Token: SeProfSingleProcessPrivilege 2428 powershell.exe Token: SeIncBasePriorityPrivilege 2428 powershell.exe Token: SeCreatePagefilePrivilege 2428 powershell.exe Token: SeBackupPrivilege 2428 powershell.exe Token: SeRestorePrivilege 2428 powershell.exe Token: SeShutdownPrivilege 2428 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeSystemEnvironmentPrivilege 2428 powershell.exe Token: SeRemoteShutdownPrivilege 2428 powershell.exe Token: SeUndockPrivilege 2428 powershell.exe Token: SeManageVolumePrivilege 2428 powershell.exe Token: 33 2428 powershell.exe Token: 34 2428 powershell.exe Token: 35 2428 powershell.exe Token: 36 2428 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4724 1144 wscript.EXE 92 PID 1144 wrote to memory of 4724 1144 wscript.EXE 92 PID 4724 wrote to memory of 2428 4724 cscript.exe 94 PID 4724 wrote to memory of 2428 4724 cscript.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\pa collective agreement pay 90174.js"1⤵PID:2872
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE FUNCTI~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "FUNCTI~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
47.1MB
MD5b743009be3d7ca7180d24c4756fbc8a1
SHA156e2987ae7553c1a7e76084f606ccd709eb31527
SHA256619ef36a80c85ea88366656df3307dceebf24dca8c04b1e8f864de53f49ade86
SHA512ee4a4e83660ba0dd70a481396626ec6ad23a745b60065f0ea751140b730c6fbfed27bed9cea312a62075795a157c58c6a72d39223403d51827794ecc37b47805