Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2023, 15:57

General

  • Target

    aa3cef8ba3e68fdaeb122b3c6e71e473.ps1

  • Size

    1KB

  • MD5

    aa3cef8ba3e68fdaeb122b3c6e71e473

  • SHA1

    5ba7aa3bf6433446bebe6c0e9d078d6ea2545a18

  • SHA256

    838ceb715f6a2cf668b9e9a2a7adf1f12514bb919f8f63336f2972af8d9a1dee

  • SHA512

    54c8cb96013ec83b25a3a2462bf307f21a8eac76730b5705525141a1757509a7c49bb23fe88afd922d037da453f24645d893e6638c7ce124f03a20f9e68a8491

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\aa3cef8ba3e68fdaeb122b3c6e71e473.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-54-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

    Filesize

    8KB

  • memory/1056-56-0x000007FEF4010000-0x000007FEF4B6D000-memory.dmp

    Filesize

    11.4MB

  • memory/1056-57-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

    Filesize

    3.0MB

  • memory/1056-58-0x00000000023C0000-0x0000000002440000-memory.dmp

    Filesize

    512KB

  • memory/1056-59-0x000007FEEF7B0000-0x000007FEEFC70000-memory.dmp

    Filesize

    4.8MB

  • memory/1056-60-0x000007FEEE5E0000-0x000007FEEF5AA000-memory.dmp

    Filesize

    15.8MB

  • memory/1056-61-0x00000000023C0000-0x0000000002440000-memory.dmp

    Filesize

    512KB

  • memory/1056-62-0x00000000023C0000-0x0000000002440000-memory.dmp

    Filesize

    512KB

  • memory/1056-63-0x00000000023C0000-0x0000000002440000-memory.dmp

    Filesize

    512KB