Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2023, 09:25

General

  • Target

    yt_ram_rickroll.ps1

  • Size

    212B

  • MD5

    e843b2c3c493b8803a2105ee3323a18e

  • SHA1

    307edd0f9fd99aa30241e2996c04ef35bd1224ca

  • SHA256

    d37ca460faa346da4b554a8fb8dd6bff88a9c14c59e6aecbb18ed7d14994479e

  • SHA512

    b3d4af70d365be84bf7d795d15baafd4b5f6a8ad0d8a67865ab7679b2aa4112e1ead9000392de579bae5067bae0a350daadfb9d45f881ce76118c809a7bc4c06

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\yt_ram_rickroll.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2468-59-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2468-60-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-58-0x000000001B2A0000-0x000000001B582000-memory.dmp

    Filesize

    2.9MB

  • memory/2468-62-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-63-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-61-0x0000000001F50000-0x0000000001F58000-memory.dmp

    Filesize

    32KB

  • memory/2468-64-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2468-65-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-66-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2468-67-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-68-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-69-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2468-70-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB