Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/06/2024, 13:44
240620-q2accs1ajh 1020/06/2024, 13:38
240620-qxh4pszglg 1020/06/2024, 13:15
240620-qhkc8azajd 1020/06/2024, 12:55
240620-p58hwsycke 1020/06/2024, 12:49
240620-p2g7jasdql 10Analysis
-
max time kernel
293s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-uk -
resource tags
arch:x64arch:x86image:win10v2004-20240611-uklocale:uk-uaos:windows10-2004-x64systemwindows -
submitted
20/06/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
pa collective agreement pay 90174.js
Resource
win10v2004-20240611-uk
windows10-2004-x64
General
-
Target
pa collective agreement pay 90174.js
-
Size
18.5MB
-
MD5
c4d8fa6feaef5aba8eb9b2bd2b906176
-
SHA1
31fef4eff4cda276264650c2dd1addbba9b03346
-
SHA256
a330c0d7cabdfc88e979d72f69e0c9076964b1f16c805c445426cf2b61c9ea9a
-
SHA512
6057bd5a06db48f567b8ed4ef66c67c6fc79b3f27ecfbf0b1dbb7e42e9cf7e37e0a9d9fd5097089868c9746acfe6602097eae5874d490151574fe3a01db6b5fd
-
SSDEEP
49152:ojk08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDVjk08dPXWR4ba/JOtz:ac43mMc43mMc43mMc43ml
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 10 IoCs
flow pid Process 53 1096 powershell.exe 68 1096 powershell.exe 75 1096 powershell.exe 81 1096 powershell.exe 84 1096 powershell.exe 87 1096 powershell.exe 90 1096 powershell.exe 93 1096 powershell.exe 96 1096 powershell.exe 98 1096 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1096 powershell.exe Token: SeIncreaseQuotaPrivilege 1096 powershell.exe Token: SeSecurityPrivilege 1096 powershell.exe Token: SeTakeOwnershipPrivilege 1096 powershell.exe Token: SeLoadDriverPrivilege 1096 powershell.exe Token: SeSystemProfilePrivilege 1096 powershell.exe Token: SeSystemtimePrivilege 1096 powershell.exe Token: SeProfSingleProcessPrivilege 1096 powershell.exe Token: SeIncBasePriorityPrivilege 1096 powershell.exe Token: SeCreatePagefilePrivilege 1096 powershell.exe Token: SeBackupPrivilege 1096 powershell.exe Token: SeRestorePrivilege 1096 powershell.exe Token: SeShutdownPrivilege 1096 powershell.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeSystemEnvironmentPrivilege 1096 powershell.exe Token: SeRemoteShutdownPrivilege 1096 powershell.exe Token: SeUndockPrivilege 1096 powershell.exe Token: SeManageVolumePrivilege 1096 powershell.exe Token: 33 1096 powershell.exe Token: 34 1096 powershell.exe Token: 35 1096 powershell.exe Token: 36 1096 powershell.exe Token: SeIncreaseQuotaPrivilege 1096 powershell.exe Token: SeSecurityPrivilege 1096 powershell.exe Token: SeTakeOwnershipPrivilege 1096 powershell.exe Token: SeLoadDriverPrivilege 1096 powershell.exe Token: SeSystemProfilePrivilege 1096 powershell.exe Token: SeSystemtimePrivilege 1096 powershell.exe Token: SeProfSingleProcessPrivilege 1096 powershell.exe Token: SeIncBasePriorityPrivilege 1096 powershell.exe Token: SeCreatePagefilePrivilege 1096 powershell.exe Token: SeBackupPrivilege 1096 powershell.exe Token: SeRestorePrivilege 1096 powershell.exe Token: SeShutdownPrivilege 1096 powershell.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeSystemEnvironmentPrivilege 1096 powershell.exe Token: SeRemoteShutdownPrivilege 1096 powershell.exe Token: SeUndockPrivilege 1096 powershell.exe Token: SeManageVolumePrivilege 1096 powershell.exe Token: 33 1096 powershell.exe Token: 34 1096 powershell.exe Token: 35 1096 powershell.exe Token: 36 1096 powershell.exe Token: SeIncreaseQuotaPrivilege 1096 powershell.exe Token: SeSecurityPrivilege 1096 powershell.exe Token: SeTakeOwnershipPrivilege 1096 powershell.exe Token: SeLoadDriverPrivilege 1096 powershell.exe Token: SeSystemProfilePrivilege 1096 powershell.exe Token: SeSystemtimePrivilege 1096 powershell.exe Token: SeProfSingleProcessPrivilege 1096 powershell.exe Token: SeIncBasePriorityPrivilege 1096 powershell.exe Token: SeCreatePagefilePrivilege 1096 powershell.exe Token: SeBackupPrivilege 1096 powershell.exe Token: SeRestorePrivilege 1096 powershell.exe Token: SeShutdownPrivilege 1096 powershell.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeSystemEnvironmentPrivilege 1096 powershell.exe Token: SeRemoteShutdownPrivilege 1096 powershell.exe Token: SeUndockPrivilege 1096 powershell.exe Token: SeManageVolumePrivilege 1096 powershell.exe Token: 33 1096 powershell.exe Token: 34 1096 powershell.exe Token: 35 1096 powershell.exe Token: 36 1096 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3836 wrote to memory of 1448 3836 wscript.EXE 97 PID 3836 wrote to memory of 1448 3836 wscript.EXE 97 PID 1448 wrote to memory of 1096 1448 cscript.exe 99 PID 1448 wrote to memory of 1096 1448 cscript.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\pa collective agreement pay 90174.js"1⤵PID:3644
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE FUNCTI~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "FUNCTI~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
47.1MB
MD5b743009be3d7ca7180d24c4756fbc8a1
SHA156e2987ae7553c1a7e76084f606ccd709eb31527
SHA256619ef36a80c85ea88366656df3307dceebf24dca8c04b1e8f864de53f49ade86
SHA512ee4a4e83660ba0dd70a481396626ec6ad23a745b60065f0ea751140b730c6fbfed27bed9cea312a62075795a157c58c6a72d39223403d51827794ecc37b47805