Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

wordfence/...er.ps1

windows7-x64

1

wordfence/...er.ps1

windows10-2004-x64

1

wordfence/...al.ps1

windows7-x64

1

wordfence/...al.ps1

windows10-2004-x64

1

wordfence/...dom.js

windows7-x64

1

wordfence/...dom.js

windows10-2004-x64

1

wordfence/...net.js

windows7-x64

1

wordfence/...net.js

windows10-2004-x64

1

wordfence/...dom.js

windows7-x64

1

wordfence/...dom.js

windows10-2004-x64

1

wordfence/...ium.js

windows7-x64

1

wordfence/...ium.js

windows10-2004-x64

1

wordfence/...acy.js

windows7-x64

1

wordfence/...acy.js

windows10-2004-x64

1

wordfence/...ypt.js

windows7-x64

1

wordfence/...ypt.js

windows10-2004-x64

1

wordfence/...int.js

windows7-x64

1

wordfence/...int.js

windows10-2004-x64

1

wordfence/...pat.js

windows7-x64

1

wordfence/...pat.js

windows10-2004-x64

1

wordfence/...pat.js

windows7-x64

1

wordfence/...pat.js

windows10-2004-x64

1

wordfence/...pat.js

windows7-x64

1

wordfence/...pat.js

windows10-2004-x64

1

wordfence/...519.js

windows7-x64

1

wordfence/...519.js

windows10-2004-x64

1

wordfence/...a20.js

windows7-x64

1

wordfence/...a20.js

windows10-2004-x64

1

wordfence/...Fe.ps1

windows7-x64

1

wordfence/...Fe.ps1

windows10-2004-x64

1

wordfence/...519.js

windows7-x64

1

wordfence/...519.js

windows10-2004-x64

1

Analysis

  • max time kernel
    42s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2022, 10:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wordfence/crypto/vendor/composer/ClassLoader.ps1

  • Size

    13KB

  • MD5

    92fe79b147d64dfa1421651d7839c9d9

  • SHA1

    f16a84d9abd7d61ba44d025ade55e5cec1273823

  • SHA256

    ae5f9cac4d65c0bfbc5d6301b4f0aafe26b54adaa99057909673d15344a50e6e

  • SHA512

    e95f90be793a521568a3bbe14f724e47f58173b8ed8c7907f799932fd9ef483ac4b9e741b572a0867a1afdba0c96fe7eb919980df240e158313286e4979cc66a

  • SSDEEP

    384:bRMAJdEE8VVa8j5QDnGtewQbuUNN7dJbZ:bjL6NyX

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wordfence\crypto\vendor\composer\ClassLoader.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2016-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2016-55-0x000007FEF4930000-0x000007FEF5353000-memory.dmp

    Filesize

    10.1MB

    Download

  • memory/2016-56-0x000007FEF3DD0000-0x000007FEF492D000-memory.dmp

    Filesize

    11.4MB

    Download

  • memory/2016-57-0x00000000024A4000-0x00000000024A7000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2016-58-0x00000000024A4000-0x00000000024A7000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2016-59-0x00000000024AB000-0x00000000024CA000-memory.dmp

    Filesize

    124KB

    Download