Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2023, 12:08

General

  • Target

    53tahW0A.ps1

  • Size

    22KB

  • MD5

    717300f29fe153e00f0a243d443f87f6

  • SHA1

    73eb161dd1f29c64b7451a05405eda69f7962681

  • SHA256

    13d3317ccae3bdeb9d275369fbd7106d91f75096c62c663d0b3e277b2d228dc2

  • SHA512

    0c0a6c19c9c7790b506d1af305eee9eb0149f1c5dcaefad29514cdd713045b6a846f75b3854c85fefcd4ccff43f9d5a7861d762a07f88b033619b6f15b6098fd

  • SSDEEP

    384:xWmuW06ul03vm1uv+FOiuH+937sG0z47xx:eFX0OZOiue9LsG0s7xx

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\53tahW0A.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1272-58-0x000000001B140000-0x000000001B422000-memory.dmp

    Filesize

    2.9MB

  • memory/1272-59-0x0000000002460000-0x0000000002468000-memory.dmp

    Filesize

    32KB

  • memory/1272-60-0x00000000024D0000-0x0000000002550000-memory.dmp

    Filesize

    512KB

  • memory/1272-61-0x00000000024D0000-0x0000000002550000-memory.dmp

    Filesize

    512KB

  • memory/1272-62-0x00000000024D0000-0x0000000002550000-memory.dmp

    Filesize

    512KB

  • memory/1272-63-0x00000000024DB000-0x0000000002512000-memory.dmp

    Filesize

    220KB