Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
18/12/2024, 14:27
241218-rsv35stjdr 1018/12/2024, 13:54
241218-q71rha1mfw 1018/12/2024, 13:48
241218-q4epvs1ldw 1018/12/2024, 02:32
241218-c1s67azqhq 10Analysis
-
max time kernel
595s -
max time network
600s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
53f8a46c948c968fe753a5f723bdf99d3b3d141dc3dec3d8e36480975c7ce879.js
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
600 seconds
General
-
Target
53f8a46c948c968fe753a5f723bdf99d3b3d141dc3dec3d8e36480975c7ce879.js
-
Size
281KB
-
MD5
95238ad5a91d721c6e8fdf4c36187798
-
SHA1
7b468a279606b62b0abe1a3e14aa16f0c9e6b93d
-
SHA256
53f8a46c948c968fe753a5f723bdf99d3b3d141dc3dec3d8e36480975c7ce879
-
SHA512
26139d8e3a97a9971f1163af0754c3f990b82f4af04f0fc6862dc1b2ae6186a6948a001c7c8ab2b6e981b409715e30b8c2bdf007e8d02e539c37f95438486441
-
SSDEEP
6144:i53Ih6ntcHCDMwfT2jP4OfSqy+QBFm9E7JFy8PlI4I1f8sATRZtr:ivs4OfSDFmcNe1f8sATtr
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Gootloader family
-
Blocklisted process makes network request 24 IoCs
flow pid Process 45 2044 powershell.exe 52 2044 powershell.exe 55 2044 powershell.exe 57 2044 powershell.exe 58 2044 powershell.exe 59 2044 powershell.exe 61 2044 powershell.exe 63 2044 powershell.exe 65 2044 powershell.exe 67 2044 powershell.exe 73 2044 powershell.exe 75 2044 powershell.exe 76 2044 powershell.exe 77 2044 powershell.exe 79 2044 powershell.exe 82 2044 powershell.exe 85 2044 powershell.exe 86 2044 powershell.exe 87 2044 powershell.exe 89 2044 powershell.exe 91 2044 powershell.exe 92 2044 powershell.exe 94 2044 powershell.exe 96 2044 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3896 powershell.exe 3896 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeIncreaseQuotaPrivilege 2044 powershell.exe Token: SeSecurityPrivilege 2044 powershell.exe Token: SeTakeOwnershipPrivilege 2044 powershell.exe Token: SeLoadDriverPrivilege 2044 powershell.exe Token: SeSystemProfilePrivilege 2044 powershell.exe Token: SeSystemtimePrivilege 2044 powershell.exe Token: SeProfSingleProcessPrivilege 2044 powershell.exe Token: SeIncBasePriorityPrivilege 2044 powershell.exe Token: SeCreatePagefilePrivilege 2044 powershell.exe Token: SeBackupPrivilege 2044 powershell.exe Token: SeRestorePrivilege 2044 powershell.exe Token: SeShutdownPrivilege 2044 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeSystemEnvironmentPrivilege 2044 powershell.exe Token: SeRemoteShutdownPrivilege 2044 powershell.exe Token: SeUndockPrivilege 2044 powershell.exe Token: SeManageVolumePrivilege 2044 powershell.exe Token: 33 2044 powershell.exe Token: 34 2044 powershell.exe Token: 35 2044 powershell.exe Token: 36 2044 powershell.exe Token: SeIncreaseQuotaPrivilege 2044 powershell.exe Token: SeSecurityPrivilege 2044 powershell.exe Token: SeTakeOwnershipPrivilege 2044 powershell.exe Token: SeLoadDriverPrivilege 2044 powershell.exe Token: SeSystemProfilePrivilege 2044 powershell.exe Token: SeSystemtimePrivilege 2044 powershell.exe Token: SeProfSingleProcessPrivilege 2044 powershell.exe Token: SeIncBasePriorityPrivilege 2044 powershell.exe Token: SeCreatePagefilePrivilege 2044 powershell.exe Token: SeBackupPrivilege 2044 powershell.exe Token: SeRestorePrivilege 2044 powershell.exe Token: SeShutdownPrivilege 2044 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeSystemEnvironmentPrivilege 2044 powershell.exe Token: SeRemoteShutdownPrivilege 2044 powershell.exe Token: SeUndockPrivilege 2044 powershell.exe Token: SeManageVolumePrivilege 2044 powershell.exe Token: 33 2044 powershell.exe Token: 34 2044 powershell.exe Token: 35 2044 powershell.exe Token: 36 2044 powershell.exe Token: SeIncreaseQuotaPrivilege 2044 powershell.exe Token: SeSecurityPrivilege 2044 powershell.exe Token: SeTakeOwnershipPrivilege 2044 powershell.exe Token: SeLoadDriverPrivilege 2044 powershell.exe Token: SeSystemProfilePrivilege 2044 powershell.exe Token: SeSystemtimePrivilege 2044 powershell.exe Token: SeProfSingleProcessPrivilege 2044 powershell.exe Token: SeIncBasePriorityPrivilege 2044 powershell.exe Token: SeCreatePagefilePrivilege 2044 powershell.exe Token: SeBackupPrivilege 2044 powershell.exe Token: SeRestorePrivilege 2044 powershell.exe Token: SeShutdownPrivilege 2044 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeSystemEnvironmentPrivilege 2044 powershell.exe Token: SeRemoteShutdownPrivilege 2044 powershell.exe Token: SeUndockPrivilege 2044 powershell.exe Token: SeManageVolumePrivilege 2044 powershell.exe Token: 33 2044 powershell.exe Token: 34 2044 powershell.exe Token: 35 2044 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2648 conhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2648 3016 wscript.EXE 101 PID 3016 wrote to memory of 2648 3016 wscript.EXE 101 PID 2648 wrote to memory of 1844 2648 conhost.exe 102 PID 2648 wrote to memory of 1844 2648 conhost.exe 102 PID 1844 wrote to memory of 3896 1844 cscript.exe 103 PID 1844 wrote to memory of 3896 1844 cscript.exe 103 PID 3896 wrote to memory of 2044 3896 powershell.exe 104 PID 3896 wrote to memory of 2044 3896 powershell.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\53f8a46c948c968fe753a5f723bdf99d3b3d141dc3dec3d8e36480975c7ce879.js1⤵PID:4128
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE AUTOMO~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" cscript "AUTOMO~1.JS"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\System32\cscript.execscript AUTOMO~1.JS3⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell powershell4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4.4MB
MD56166491ad0afd48ddf8a220c09647acf
SHA1eab4db5de13cd5a0dc2ae132fc99417c0d04df8c
SHA2563fafb3a2d8317e616647c7a8515109b517fd7a194694d7992f0cc451175687e0
SHA51225952807d8044f3dbd2f597139ff38873666cb8529dc5eb98b35a10b2ac8df2d6f07eddf4d29575a4ae6037b4164cb1792615f7fc289eb2f6f863ef313908285