Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
AUTOMO~1.js
Resource
win7-20240708-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
AUTOMO~1.js
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
300 seconds
General
-
Target
AUTOMO~1.js
-
Size
4.4MB
-
MD5
6166491ad0afd48ddf8a220c09647acf
-
SHA1
eab4db5de13cd5a0dc2ae132fc99417c0d04df8c
-
SHA256
3fafb3a2d8317e616647c7a8515109b517fd7a194694d7992f0cc451175687e0
-
SHA512
25952807d8044f3dbd2f597139ff38873666cb8529dc5eb98b35a10b2ac8df2d6f07eddf4d29575a4ae6037b4164cb1792615f7fc289eb2f6f863ef313908285
-
SSDEEP
12288:5ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ3:h
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Gootloader family
-
Blocklisted process makes network request 13 IoCs
flow pid Process 25 4812 powershell.exe 38 4812 powershell.exe 43 4812 powershell.exe 51 4812 powershell.exe 54 4812 powershell.exe 56 4812 powershell.exe 58 4812 powershell.exe 61 4812 powershell.exe 63 4812 powershell.exe 65 4812 powershell.exe 67 4812 powershell.exe 68 4812 powershell.exe 69 4812 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4500 powershell.exe 4500 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe 4812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4500 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeIncreaseQuotaPrivilege 4812 powershell.exe Token: SeSecurityPrivilege 4812 powershell.exe Token: SeTakeOwnershipPrivilege 4812 powershell.exe Token: SeLoadDriverPrivilege 4812 powershell.exe Token: SeSystemProfilePrivilege 4812 powershell.exe Token: SeSystemtimePrivilege 4812 powershell.exe Token: SeProfSingleProcessPrivilege 4812 powershell.exe Token: SeIncBasePriorityPrivilege 4812 powershell.exe Token: SeCreatePagefilePrivilege 4812 powershell.exe Token: SeBackupPrivilege 4812 powershell.exe Token: SeRestorePrivilege 4812 powershell.exe Token: SeShutdownPrivilege 4812 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeSystemEnvironmentPrivilege 4812 powershell.exe Token: SeRemoteShutdownPrivilege 4812 powershell.exe Token: SeUndockPrivilege 4812 powershell.exe Token: SeManageVolumePrivilege 4812 powershell.exe Token: 33 4812 powershell.exe Token: 34 4812 powershell.exe Token: 35 4812 powershell.exe Token: 36 4812 powershell.exe Token: SeIncreaseQuotaPrivilege 4812 powershell.exe Token: SeSecurityPrivilege 4812 powershell.exe Token: SeTakeOwnershipPrivilege 4812 powershell.exe Token: SeLoadDriverPrivilege 4812 powershell.exe Token: SeSystemProfilePrivilege 4812 powershell.exe Token: SeSystemtimePrivilege 4812 powershell.exe Token: SeProfSingleProcessPrivilege 4812 powershell.exe Token: SeIncBasePriorityPrivilege 4812 powershell.exe Token: SeCreatePagefilePrivilege 4812 powershell.exe Token: SeBackupPrivilege 4812 powershell.exe Token: SeRestorePrivilege 4812 powershell.exe Token: SeShutdownPrivilege 4812 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeSystemEnvironmentPrivilege 4812 powershell.exe Token: SeRemoteShutdownPrivilege 4812 powershell.exe Token: SeUndockPrivilege 4812 powershell.exe Token: SeManageVolumePrivilege 4812 powershell.exe Token: 33 4812 powershell.exe Token: 34 4812 powershell.exe Token: 35 4812 powershell.exe Token: 36 4812 powershell.exe Token: SeIncreaseQuotaPrivilege 4812 powershell.exe Token: SeSecurityPrivilege 4812 powershell.exe Token: SeTakeOwnershipPrivilege 4812 powershell.exe Token: SeLoadDriverPrivilege 4812 powershell.exe Token: SeSystemProfilePrivilege 4812 powershell.exe Token: SeSystemtimePrivilege 4812 powershell.exe Token: SeProfSingleProcessPrivilege 4812 powershell.exe Token: SeIncBasePriorityPrivilege 4812 powershell.exe Token: SeCreatePagefilePrivilege 4812 powershell.exe Token: SeBackupPrivilege 4812 powershell.exe Token: SeRestorePrivilege 4812 powershell.exe Token: SeShutdownPrivilege 4812 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeSystemEnvironmentPrivilege 4812 powershell.exe Token: SeRemoteShutdownPrivilege 4812 powershell.exe Token: SeUndockPrivilege 4812 powershell.exe Token: SeManageVolumePrivilege 4812 powershell.exe Token: 33 4812 powershell.exe Token: 34 4812 powershell.exe Token: 35 4812 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1104 conhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1104 2064 wscript.exe 89 PID 2064 wrote to memory of 1104 2064 wscript.exe 89 PID 1104 wrote to memory of 232 1104 conhost.exe 91 PID 1104 wrote to memory of 232 1104 conhost.exe 91 PID 232 wrote to memory of 4500 232 cscript.exe 97 PID 232 wrote to memory of 4500 232 cscript.exe 97 PID 4500 wrote to memory of 4812 4500 powershell.exe 98 PID 4500 wrote to memory of 4812 4500 powershell.exe 98
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\AUTOMO~1.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" cscript "AUTOMO~1.js"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\System32\cscript.execscript AUTOMO~1.js3⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell powershell4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82