Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 14:34
Behavioral task
behavioral1
Sample
aasd.ps1
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
aasd.ps1
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
aasd.ps1
-
Size
194KB
-
MD5
d5bda808df861bbda7835e9cc88bf8f8
-
SHA1
d8044382a5f1e3f855d1882e7d6447fc1111947e
-
SHA256
702722319c2f771675257417051213d26a9709ef6dd1c867e093e6f407fcdfae
-
SHA512
9a758e4bc523529f8264622d047a5ea6c2a69d01887db22c919f681e4c2a69b15e6f540076f1c99e386ef4985ac5047d284abb40c8a8a0b8c4b29d0ea0ca98d0
-
SSDEEP
3072:BN3qRnrPNhO0Vm9AdbTPJls5JeuGsP32mF4WQx8x8AYjmY8yoZNBd0Y2Du5/ASQt:6RjtVuwT/s5J7zGdZC28yYH0KB7+
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 3 984 powershell.exe 6 984 powershell.exe 8 984 powershell.exe 9 984 powershell.exe 10 984 powershell.exe 11 984 powershell.exe 12 984 powershell.exe 13 984 powershell.exe 14 984 powershell.exe 15 984 powershell.exe 16 984 powershell.exe 17 984 powershell.exe 18 984 powershell.exe 19 984 powershell.exe 20 984 powershell.exe 21 984 powershell.exe 22 984 powershell.exe 23 984 powershell.exe 24 984 powershell.exe 25 984 powershell.exe 26 984 powershell.exe 27 984 powershell.exe 28 984 powershell.exe 29 984 powershell.exe 30 984 powershell.exe 31 984 powershell.exe 32 984 powershell.exe 33 984 powershell.exe 34 984 powershell.exe 35 984 powershell.exe 36 984 powershell.exe 37 984 powershell.exe 38 984 powershell.exe 39 984 powershell.exe 40 984 powershell.exe 41 984 powershell.exe 42 984 powershell.exe 43 984 powershell.exe 44 984 powershell.exe 45 984 powershell.exe 46 984 powershell.exe 47 984 powershell.exe 48 984 powershell.exe 49 984 powershell.exe 50 984 powershell.exe 51 984 powershell.exe 52 984 powershell.exe 53 984 powershell.exe 54 984 powershell.exe 55 984 powershell.exe 56 984 powershell.exe 57 984 powershell.exe 58 984 powershell.exe 59 984 powershell.exe 60 984 powershell.exe 61 984 powershell.exe 62 984 powershell.exe 63 984 powershell.exe 64 984 powershell.exe 65 984 powershell.exe 66 984 powershell.exe 67 984 powershell.exe 68 984 powershell.exe 69 984 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2036 powershell.exe 984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2036 powershell.exe Token: SeDebugPrivilege 984 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 984 2036 powershell.exe 27 PID 2036 wrote to memory of 984 2036 powershell.exe 27 PID 2036 wrote to memory of 984 2036 powershell.exe 27 PID 2036 wrote to memory of 984 2036 powershell.exe 27
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aasd.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-