Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2024, 09:34

General

  • Target

    DOC934798848.js

  • Size

    238KB

  • MD5

    208ac4eb6c75aced85071562b1bc079d

  • SHA1

    0a3bb6f310317d31bad26a0076c5e7313699739b

  • SHA256

    427e4dcb36206392d10846d4aa4e37ec0c724d2b5c26c662b3670b120bdf84c3

  • SHA512

    1f2d13791bbc1e58f42eee63e6e5708b333d476d0f3ea39c185a99a7f11079477c80ddbef4304a27a4b62114579b5443d0d698a689929ccea3e0b27bee3d9b13

  • SSDEEP

    6144:eQrh+XeVWsUDMmQPiXmvnuKFESB51tsr3wtNX5ihm:19xWsUDaESBBsr3uXl

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Strrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\DOC934798848.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\gqvexlbl.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Program Files\Java\jre-1.8\bin\java.exe
        "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\gqvexlbl.txt"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\gqvexlbl.txt"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3308
          • C:\Windows\system32\schtasks.exe
            schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\gqvexlbl.txt"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4948
        • C:\Program Files\Java\jre-1.8\bin\java.exe
          "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\gqvexlbl.txt"
          4⤵
          • Loads dropped DLL
          PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    3ec26d34e1b682f04a3330664ddbb477

    SHA1

    c2812681f5b72a9f16975964a7f159e2d0205f75

    SHA256

    289d0481f97388dd8d7806476dc92c52e8add519e3411c17cf311556442f8f58

    SHA512

    d391f01a7f59f2750c5b505021fa33e312568db58efca7f56b708452769505ef6f8f9cab4b143b30f517ac8ed72ff6ef9d06856de87e59e9533e05fda4b76c46

  • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna3576087263014502951.dll

    Filesize

    241KB

    MD5

    e02979ecd43bcc9061eb2b494ab5af50

    SHA1

    3122ac0e751660f646c73b10c4f79685aa65c545

    SHA256

    a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a

    SHA512

    1e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\83aa4cc77f591dfc2374580bbd95f6ba_896de533-e5fb-4eb9-8f2b-d363f3584dc5

    Filesize

    45B

    MD5

    c8366ae350e7019aefc9d1e6e6a498c6

    SHA1

    5731d8a3e6568a5f2dfbbc87e3db9637df280b61

    SHA256

    11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

    SHA512

    33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

  • C:\Users\Admin\AppData\Roaming\gqvexlbl.txt

    Filesize

    109KB

    MD5

    7a5c4c8206af87ef76588eaa1fab0060

    SHA1

    30a4b99d4a65cf9bd7997fe2365bf677b7849a54

    SHA256

    e70bb96d50cb6319c4da5972c986dd4732ab6c4c78af96687454ffdb95b56b4b

    SHA512

    352b5dc4081928a713ea79c761752c0e2ef5f4cdfc5e2426f9e2643ee0a490415d27d29f92373ba8e463b773f3e2b0e5236336673ce0b27f68bed3b3c3a3a7fe

  • C:\Users\Admin\lib\jna-5.5.0.jar

    Filesize

    1.4MB

    MD5

    acfb5b5fd9ee10bf69497792fd469f85

    SHA1

    0e0845217c4907822403912ad6828d8e0b256208

    SHA256

    b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e

    SHA512

    e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa

  • C:\Users\Admin\lib\jna-platform-5.5.0.jar

    Filesize

    2.6MB

    MD5

    2f4a99c2758e72ee2b59a73586a2322f

    SHA1

    af38e7c4d0fc73c23ecd785443705bfdee5b90bf

    SHA256

    24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5

    SHA512

    b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494

  • C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar

    Filesize

    4.1MB

    MD5

    b33387e15ab150a7bf560abdc73c3bec

    SHA1

    66b8075784131f578ef893fd7674273f709b9a4c

    SHA256

    2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491

    SHA512

    25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279

  • C:\Users\Admin\lib\system-hook-3.5.jar

    Filesize

    772KB

    MD5

    e1aa38a1e78a76a6de73efae136cdb3a

    SHA1

    c463da71871f780b2e2e5dba115d43953b537daf

    SHA256

    2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609

    SHA512

    fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d

  • memory/212-245-0x0000027E15CA0000-0x0000027E15CA1000-memory.dmp

    Filesize

    4KB

  • memory/3524-201-0x000001D723BF0000-0x000001D723BF1000-memory.dmp

    Filesize

    4KB

  • memory/4852-102-0x0000024433C00000-0x0000024433C10000-memory.dmp

    Filesize

    64KB

  • memory/4852-175-0x0000024433BA0000-0x0000024433BB0000-memory.dmp

    Filesize

    64KB

  • memory/4852-25-0x0000024433AA0000-0x0000024433AB0000-memory.dmp

    Filesize

    64KB

  • memory/4852-27-0x0000024433AB0000-0x0000024433AC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-29-0x0000024433AC0000-0x0000024433AD0000-memory.dmp

    Filesize

    64KB

  • memory/4852-40-0x0000024433AF0000-0x0000024433B00000-memory.dmp

    Filesize

    64KB

  • memory/4852-39-0x0000024433AE0000-0x0000024433AF0000-memory.dmp

    Filesize

    64KB

  • memory/4852-38-0x0000024433AD0000-0x0000024433AE0000-memory.dmp

    Filesize

    64KB

  • memory/4852-43-0x0000024433B00000-0x0000024433B10000-memory.dmp

    Filesize

    64KB

  • memory/4852-42-0x0000024433A50000-0x0000024433A60000-memory.dmp

    Filesize

    64KB

  • memory/4852-37-0x00000244337E0000-0x0000024433A50000-memory.dmp

    Filesize

    2.4MB

  • memory/4852-45-0x0000024433A60000-0x0000024433A70000-memory.dmp

    Filesize

    64KB

  • memory/4852-46-0x0000024433B10000-0x0000024433B20000-memory.dmp

    Filesize

    64KB

  • memory/4852-51-0x0000024433B20000-0x0000024433B30000-memory.dmp

    Filesize

    64KB

  • memory/4852-50-0x0000024433A80000-0x0000024433A90000-memory.dmp

    Filesize

    64KB

  • memory/4852-53-0x0000024433B30000-0x0000024433B40000-memory.dmp

    Filesize

    64KB

  • memory/4852-49-0x0000024433A70000-0x0000024433A80000-memory.dmp

    Filesize

    64KB

  • memory/4852-55-0x0000024433B40000-0x0000024433B50000-memory.dmp

    Filesize

    64KB

  • memory/4852-54-0x0000024433A90000-0x0000024433AA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-57-0x0000024433AA0000-0x0000024433AB0000-memory.dmp

    Filesize

    64KB

  • memory/4852-58-0x0000024433B50000-0x0000024433B60000-memory.dmp

    Filesize

    64KB

  • memory/4852-63-0x0000024433B60000-0x0000024433B70000-memory.dmp

    Filesize

    64KB

  • memory/4852-62-0x0000024433AB0000-0x0000024433AC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-65-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-69-0x0000024433AE0000-0x0000024433AF0000-memory.dmp

    Filesize

    64KB

  • memory/4852-68-0x0000024433AD0000-0x0000024433AE0000-memory.dmp

    Filesize

    64KB

  • memory/4852-67-0x0000024433B70000-0x0000024433B80000-memory.dmp

    Filesize

    64KB

  • memory/4852-66-0x0000024433AC0000-0x0000024433AD0000-memory.dmp

    Filesize

    64KB

  • memory/4852-73-0x0000024433AF0000-0x0000024433B00000-memory.dmp

    Filesize

    64KB

  • memory/4852-74-0x0000024433B80000-0x0000024433B90000-memory.dmp

    Filesize

    64KB

  • memory/4852-78-0x0000024433B90000-0x0000024433BA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-77-0x0000024433B00000-0x0000024433B10000-memory.dmp

    Filesize

    64KB

  • memory/4852-79-0x0000024433B10000-0x0000024433B20000-memory.dmp

    Filesize

    64KB

  • memory/4852-80-0x0000024433BA0000-0x0000024433BB0000-memory.dmp

    Filesize

    64KB

  • memory/4852-83-0x0000024433BB0000-0x0000024433BC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-82-0x0000024433B20000-0x0000024433B30000-memory.dmp

    Filesize

    64KB

  • memory/4852-85-0x0000024433B30000-0x0000024433B40000-memory.dmp

    Filesize

    64KB

  • memory/4852-87-0x0000024433BC0000-0x0000024433BD0000-memory.dmp

    Filesize

    64KB

  • memory/4852-90-0x0000024433B40000-0x0000024433B50000-memory.dmp

    Filesize

    64KB

  • memory/4852-94-0x0000024433B50000-0x0000024433B60000-memory.dmp

    Filesize

    64KB

  • memory/4852-93-0x0000024433BF0000-0x0000024433C00000-memory.dmp

    Filesize

    64KB

  • memory/4852-92-0x0000024433BE0000-0x0000024433BF0000-memory.dmp

    Filesize

    64KB

  • memory/4852-91-0x0000024433BD0000-0x0000024433BE0000-memory.dmp

    Filesize

    64KB

  • memory/4852-99-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-101-0x0000024433B60000-0x0000024433B70000-memory.dmp

    Filesize

    64KB

  • memory/4852-20-0x0000024433A70000-0x0000024433A80000-memory.dmp

    Filesize

    64KB

  • memory/4852-105-0x0000024433C10000-0x0000024433C20000-memory.dmp

    Filesize

    64KB

  • memory/4852-104-0x0000024433B70000-0x0000024433B80000-memory.dmp

    Filesize

    64KB

  • memory/4852-107-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-108-0x0000024433C20000-0x0000024433C30000-memory.dmp

    Filesize

    64KB

  • memory/4852-24-0x0000024433A90000-0x0000024433AA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-111-0x0000024433C30000-0x0000024433C40000-memory.dmp

    Filesize

    64KB

  • memory/4852-174-0x0000024433B90000-0x0000024433BA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-114-0x0000024433BA0000-0x0000024433BB0000-memory.dmp

    Filesize

    64KB

  • memory/4852-113-0x0000024433B90000-0x0000024433BA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-118-0x0000024433C50000-0x0000024433C60000-memory.dmp

    Filesize

    64KB

  • memory/4852-121-0x0000024433C60000-0x0000024433C70000-memory.dmp

    Filesize

    64KB

  • memory/4852-120-0x0000024433BB0000-0x0000024433BC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-124-0x0000024433C70000-0x0000024433C80000-memory.dmp

    Filesize

    64KB

  • memory/4852-123-0x0000024433BC0000-0x0000024433BD0000-memory.dmp

    Filesize

    64KB

  • memory/4852-126-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-134-0x0000024433C80000-0x0000024433C90000-memory.dmp

    Filesize

    64KB

  • memory/4852-133-0x0000024433BF0000-0x0000024433C00000-memory.dmp

    Filesize

    64KB

  • memory/4852-135-0x0000024433C90000-0x0000024433CA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-132-0x0000024433BE0000-0x0000024433BF0000-memory.dmp

    Filesize

    64KB

  • memory/4852-131-0x0000024433BD0000-0x0000024433BE0000-memory.dmp

    Filesize

    64KB

  • memory/4852-142-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-143-0x0000024433C00000-0x0000024433C10000-memory.dmp

    Filesize

    64KB

  • memory/4852-145-0x0000024433C10000-0x0000024433C20000-memory.dmp

    Filesize

    64KB

  • memory/4852-146-0x0000024433C20000-0x0000024433C30000-memory.dmp

    Filesize

    64KB

  • memory/4852-149-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-150-0x0000024433AF0000-0x0000024433B00000-memory.dmp

    Filesize

    64KB

  • memory/4852-154-0x0000024433A80000-0x0000024433A90000-memory.dmp

    Filesize

    64KB

  • memory/4852-160-0x0000024433AE0000-0x0000024433AF0000-memory.dmp

    Filesize

    64KB

  • memory/4852-159-0x0000024433AD0000-0x0000024433AE0000-memory.dmp

    Filesize

    64KB

  • memory/4852-158-0x0000024433AC0000-0x0000024433AD0000-memory.dmp

    Filesize

    64KB

  • memory/4852-157-0x0000024433AB0000-0x0000024433AC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-156-0x0000024433AA0000-0x0000024433AB0000-memory.dmp

    Filesize

    64KB

  • memory/4852-155-0x0000024433A90000-0x0000024433AA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-153-0x0000024433A70000-0x0000024433A80000-memory.dmp

    Filesize

    64KB

  • memory/4852-152-0x0000024433A60000-0x0000024433A70000-memory.dmp

    Filesize

    64KB

  • memory/4852-151-0x0000024433A50000-0x0000024433A60000-memory.dmp

    Filesize

    64KB

  • memory/4852-179-0x0000024433BF0000-0x0000024433C00000-memory.dmp

    Filesize

    64KB

  • memory/4852-178-0x0000024433BE0000-0x0000024433BF0000-memory.dmp

    Filesize

    64KB

  • memory/4852-177-0x0000024433BD0000-0x0000024433BE0000-memory.dmp

    Filesize

    64KB

  • memory/4852-176-0x0000024433BC0000-0x0000024433BD0000-memory.dmp

    Filesize

    64KB

  • memory/4852-110-0x0000024433B80000-0x0000024433B90000-memory.dmp

    Filesize

    64KB

  • memory/4852-115-0x0000024433C40000-0x0000024433C50000-memory.dmp

    Filesize

    64KB

  • memory/4852-173-0x0000024433B80000-0x0000024433B90000-memory.dmp

    Filesize

    64KB

  • memory/4852-172-0x0000024433B70000-0x0000024433B80000-memory.dmp

    Filesize

    64KB

  • memory/4852-171-0x0000024433B60000-0x0000024433B70000-memory.dmp

    Filesize

    64KB

  • memory/4852-170-0x0000024433B50000-0x0000024433B60000-memory.dmp

    Filesize

    64KB

  • memory/4852-169-0x0000024433B40000-0x0000024433B50000-memory.dmp

    Filesize

    64KB

  • memory/4852-21-0x0000024433A80000-0x0000024433A90000-memory.dmp

    Filesize

    64KB

  • memory/4852-17-0x0000024433A60000-0x0000024433A70000-memory.dmp

    Filesize

    64KB

  • memory/4852-15-0x0000024433A50000-0x0000024433A60000-memory.dmp

    Filesize

    64KB

  • memory/4852-13-0x0000024431F80000-0x0000024431F81000-memory.dmp

    Filesize

    4KB

  • memory/4852-4-0x00000244337E0000-0x0000024433A50000-memory.dmp

    Filesize

    2.4MB

  • memory/4852-168-0x0000024433B30000-0x0000024433B40000-memory.dmp

    Filesize

    64KB

  • memory/4852-167-0x0000024433B20000-0x0000024433B30000-memory.dmp

    Filesize

    64KB

  • memory/4852-166-0x0000024433B10000-0x0000024433B20000-memory.dmp

    Filesize

    64KB

  • memory/4852-165-0x0000024433B00000-0x0000024433B10000-memory.dmp

    Filesize

    64KB

  • memory/4852-164-0x00000244337E0000-0x0000024433A50000-memory.dmp

    Filesize

    2.4MB