Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

run.vbs

windows7-x64

8

run.vbs

windows10-2004-x64

7

Analysis

  • max time kernel
    165s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 13:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    run.vbs

  • Size

    1KB

  • MD5

    32fb13fef9f5adf8feae5d9b538c2ba9

  • SHA1

    aebd08892d4698afee572d7a8fe71af2d3b23647

  • SHA256

    29b918a9bb7c8c7f8a03f91f40e5739eaddf1c4ac03a72d3dbd078186638a369

  • SHA512

    09968550b8dfe16649ce602debf2762b24f6ad5842a2826ce1c94d4ebe706b47a37372043d726366440d8d7c69510c1af1dd9e258be511c47f43fe193903163a

Score
8/10
evasionpersistence

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 1 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies registry key 1 TTPs 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd/s/q C:\Windows\System32
      2⤵
      • Drops file in Drivers directory
      • Manipulates Digital Signatures
      • Boot or Logon Autostart Execution: Print Processors
      • Drops file in System32 directory
      • Modifies termsrv.dll
      PID:2460
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:2704
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:3064
    • C:\Windows\regedit.exe
      "C:\Windows\regedit.exe"
      1⤵
      • Runs regedit.exe
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:1300
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1844
      • C:\Windows\System32\Notepad.exe
        "C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\run.vbs
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:2840
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /im wscript.exe
        1⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2980
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /f /im wscript.exe
        1⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2404
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:1092
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\run.vbs"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:1028
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c rd/s/q C:\Windows\System32
            2⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            PID:1044
          • C:\Windows\System32\reg.exe
            "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            2⤵
            • Modifies registry key
            PID:1868

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\what.txt
          Filesize

          157B

          MD5

          e5f22d63d0a22259cd37aafbc2c5e6d3

          SHA1

          d2a6eb75cf7addf54a9c4379c3a7783747db2f5e

          SHA256

          629d26d2d68dca1803fa1c17117c83fb5547b56a633b54f38989d135488693cf

          SHA512

          2524afebbc591a98a250ffe72df8efb94367ddb275df2b4347569986207f86e093e06c0291c5592c765d4c12dcc458a734067df41f01edf1c99553397976c5db

          Download Submit