Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2024, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftScript.ps1
Resource
win7-20240729-en
General
-
Target
MicrosoftScript.ps1
-
Size
6KB
-
MD5
45f9661bb41a7c25b211f4e71ecdef09
-
SHA1
0cedd0635e20e7b61b0c507962d290db8c00d942
-
SHA256
dd3893426bcfecb6cabe3419b30d250731c4a81324b2adfe64d3d0f912eef301
-
SHA512
604a262ef96774b182455009119a87a85bdc5ec8d4ae656bc1e35b5de601bf840f786b7e070dffc02c88ed538095bbe49040af63cd1bdf6ccb69877111aa521e
-
SSDEEP
192:fF89UppmWcYXg4Uvmky5CzdCyusCjTf0p8:fF8SppmWtevmkkedCyhuAW
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Dozzy[1]
Setup_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/AJqrj5ZH
Signatures
-
Asyncrat family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 15 3636 powershell.exe 17 3636 powershell.exe -
pid Process 3124 powershell.exe 3636 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 14 pastebin.com 15 pastebin.com 24 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3636 set thread context of 3180 3636 powershell.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3124 powershell.exe 3124 powershell.exe 3636 powershell.exe 3636 powershell.exe 3180 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 3124 powershell.exe Token: SeIncreaseQuotaPrivilege 3124 powershell.exe Token: SeSecurityPrivilege 3124 powershell.exe Token: SeTakeOwnershipPrivilege 3124 powershell.exe Token: SeLoadDriverPrivilege 3124 powershell.exe Token: SeSystemProfilePrivilege 3124 powershell.exe Token: SeSystemtimePrivilege 3124 powershell.exe Token: SeProfSingleProcessPrivilege 3124 powershell.exe Token: SeIncBasePriorityPrivilege 3124 powershell.exe Token: SeCreatePagefilePrivilege 3124 powershell.exe Token: SeBackupPrivilege 3124 powershell.exe Token: SeRestorePrivilege 3124 powershell.exe Token: SeShutdownPrivilege 3124 powershell.exe Token: SeDebugPrivilege 3124 powershell.exe Token: SeSystemEnvironmentPrivilege 3124 powershell.exe Token: SeRemoteShutdownPrivilege 3124 powershell.exe Token: SeUndockPrivilege 3124 powershell.exe Token: SeManageVolumePrivilege 3124 powershell.exe Token: 33 3124 powershell.exe Token: 34 3124 powershell.exe Token: 35 3124 powershell.exe Token: 36 3124 powershell.exe Token: SeDebugPrivilege 3636 powershell.exe Token: SeDebugPrivilege 3180 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3180 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4024 wrote to memory of 4328 4024 WScript.exe 88 PID 4024 wrote to memory of 4328 4024 WScript.exe 88 PID 4328 wrote to memory of 3636 4328 cmd.exe 90 PID 4328 wrote to memory of 3636 4328 cmd.exe 90 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 PID 3636 wrote to memory of 3180 3636 powershell.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\MicrosoftScript.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Public\vortex.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\vortex.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\vortex.ps1'"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3180
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD500e7da020005370a518c26d5deb40691
SHA1389b34fdb01997f1de74a5a2be0ff656280c0432
SHA256a529468d442b807290b41565130e4c52760af9abec37613114db3857f11ad4fe
SHA5129a02bacc6fb922d6202548e80e345c6cdec346b79ef7ac7a56f89fd342ff128de004065b9d010d015b54d4ca72f665ca658c7ffcd8eb906e14bfa5b48b43f2cf
-
Filesize
1KB
MD5032ecfae3d898f4ba9779fea44d37004
SHA18b94484cc8f791b1c173eaac0bc5e6bd289c6a95
SHA256711e7c2607a81517e905adf043981cb850bc65dbb2b1f0d4e2dd6c703fb7c38e
SHA51213530538c0ac08c41931085805e76acc036fb18d02d40180593b73120e90027a8b4efabb95cda500a2a52fc4199f08c5f941f44609276add69eb6cdd557398da
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
205B
MD59e080ffad515e7422eae88b1603dd245
SHA1f778fc7bab19fa683955adb8e5b9a6a0d3e98799
SHA2568ac42d8ea294305e1c06e2f1ccc0d2350f39b0b53d42046422ad6d88d73f7357
SHA5129bca376fae8397e52c0afaed7d4e17a0628c8b275ebae621f42e7ed42f17193ca4a49ded1c58de7386683d7a1afd833869eb8dd173ea3ad1bc07ecb84284c0c7
-
Filesize
1KB
MD5447b55e5c593faa2ec0ab9de7cfb6d35
SHA119291456fc4d69858e39c1b9310175e27e7d0c46
SHA256ef15530111872f9b1ea3754da1569b5379e54359c200ee0e97a990589b46bec1
SHA512560071e4757243c1f8bbd4ce4da387f4e8368120bb331f53741c1ce8dceea4151e1b1374ade9ba93cc4c37bebd78ab848714909b1cc48fcce2a5128b40122f80
-
Filesize
1KB
MD50308ee03b5a25139600c8b9ef7341b00
SHA18c33169449f22fdf32559b59752cd0de01595bf0
SHA256786fd0de97c74547db9b970afa4eed09e16583b4ad5a2142ef42122068ac1f5b
SHA512d813a012e35e2760a144aa1e05b80502fb2bfadfe5be620a8fdcde8e38c4068e91be2924c22fac351f6ec0b3d858f331eeebc6de9c91054fd31e1733a2d52ea5