Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

6d8f25b723...b5.ps1

windows7-x64

1

6d8f25b723...b5.ps1

windows10-2004-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 13:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d8f25b723141c66c36ea547176b10776a170b3ba9ef3b68adce6c0f48effeb5.ps1

  • Size

    43KB

  • MD5

    0b7f34b84cbde54ee83dcf02eb4ffe9d

  • SHA1

    966da29e6f51eb35e2d2a615f32d01ba758777cb

  • SHA256

    6d8f25b723141c66c36ea547176b10776a170b3ba9ef3b68adce6c0f48effeb5

  • SHA512

    47176a58fa396c81758832fff8783035cf774aad4afad4fee35cfd85bf2e68b3bcb835d8908569a14b3c3a69a1136b2865ae41a3a3dbcb2bf1e44b78140624c0

  • SSDEEP

    768:uUO6bXvueupoDOnag6fh9uto1bogI68nNK2X6wHsoObEzn/Qwtfs13WififP:ICX1UaOn82Wi3

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6d8f25b723141c66c36ea547176b10776a170b3ba9ef3b68adce6c0f48effeb5.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4564-132-0x000001A1C1CA0000-0x000001A1C1CC2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4564-133-0x00007FF9C12C0000-0x00007FF9C1D81000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4564-134-0x00007FF9C12C0000-0x00007FF9C1D81000-memory.dmp

    Filesize

    10.8MB

    Download