Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    243s
  • max time network
    333s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 13:09

General

  • Target

    6d8f25b723141c66c36ea547176b10776a170b3ba9ef3b68adce6c0f48effeb5.ps1

  • Size

    43KB

  • MD5

    0b7f34b84cbde54ee83dcf02eb4ffe9d

  • SHA1

    966da29e6f51eb35e2d2a615f32d01ba758777cb

  • SHA256

    6d8f25b723141c66c36ea547176b10776a170b3ba9ef3b68adce6c0f48effeb5

  • SHA512

    47176a58fa396c81758832fff8783035cf774aad4afad4fee35cfd85bf2e68b3bcb835d8908569a14b3c3a69a1136b2865ae41a3a3dbcb2bf1e44b78140624c0

  • SSDEEP

    768:uUO6bXvueupoDOnag6fh9uto1bogI68nNK2X6wHsoObEzn/Qwtfs13WififP:ICX1UaOn82Wi3

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6d8f25b723141c66c36ea547176b10776a170b3ba9ef3b68adce6c0f48effeb5.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/876-54-0x000007FEFBF61000-0x000007FEFBF63000-memory.dmp

    Filesize

    8KB

  • memory/876-55-0x000007FEF3DA0000-0x000007FEF47C3000-memory.dmp

    Filesize

    10.1MB

  • memory/876-57-0x0000000002754000-0x0000000002757000-memory.dmp

    Filesize

    12KB

  • memory/876-56-0x000007FEF3180000-0x000007FEF3CDD000-memory.dmp

    Filesize

    11.4MB

  • memory/876-58-0x000000001B790000-0x000000001BA8F000-memory.dmp

    Filesize

    3.0MB

  • memory/876-59-0x0000000002754000-0x0000000002757000-memory.dmp

    Filesize

    12KB

  • memory/876-60-0x000000000275B000-0x000000000277A000-memory.dmp

    Filesize

    124KB