Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
19/09/2022, 14:30
General
-
Target
aasd.ps1
-
Size
194KB
-
MD5
d5bda808df861bbda7835e9cc88bf8f8
-
SHA1
d8044382a5f1e3f855d1882e7d6447fc1111947e
-
SHA256
702722319c2f771675257417051213d26a9709ef6dd1c867e093e6f407fcdfae
-
SHA512
9a758e4bc523529f8264622d047a5ea6c2a69d01887db22c919f681e4c2a69b15e6f540076f1c99e386ef4985ac5047d284abb40c8a8a0b8c4b29d0ea0ca98d0
-
SSDEEP
3072:BN3qRnrPNhO0Vm9AdbTPJls5JeuGsP32mF4WQx8x8AYjmY8yoZNBd0Y2Du5/ASQt:6RjtVuwT/s5J7zGdZC28yYH0KB7+
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 50 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aasd.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
10.1MB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
3.0MB
-
Filesize
124KB
-
Filesize
8KB
-
Filesize
124KB
-
Filesize
8KB
-
Filesize
208KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
208KB