Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

a5624fbc69...96.ps1

windows7-x64

1

a5624fbc69...96.ps1

windows10-2004-x64

1

Analysis

  • max time kernel
    91s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 17:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5624fbc69190bf108c976c5f79c67c80382efc4633379818978ffd323229696.ps1

  • Size

    36KB

  • MD5

    8cc2fed65661d9dba8f9c386d8011559

  • SHA1

    1553d9f89e616e1ca4b40a156353a7a7f51eb02e

  • SHA256

    a5624fbc69190bf108c976c5f79c67c80382efc4633379818978ffd323229696

  • SHA512

    f0f42230e938a8db840125596f8cb7ae615c22f9bfb1769b74222dccc40eb15333e7ee999f342383de86c16ca71de7b539026e7bf57d282e8b5aa7109acf228b

  • SSDEEP

    768:2Ww73vKYVQhy14KTu7G46K+Z7qDvhQ4oFRjE5lgPA5w4OCVsfEPTADjjhECNECoq:2WSKYVQhy14Uu7G46K+Z7qDvhQ4oFRjD

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a5624fbc69190bf108c976c5f79c67c80382efc4633379818978ffd323229696.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5032-132-0x00000207CC3A0000-0x00000207CC3C2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/5032-133-0x00007FFBFEF90000-0x00007FFBFFA51000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5032-134-0x00007FFBFEF90000-0x00007FFBFFA51000-memory.dmp

    Filesize

    10.8MB

    Download