Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 14:10

General

  • Target

    billsball_born.ps1

  • Size

    21KB

  • MD5

    a0b31283f7f2dab84070be08ec41d348

  • SHA1

    2449b402366f0d4ca31cc073382c21cd75f3bc3c

  • SHA256

    401423049597443e0bc4a19bdf5e88ab58d22c09c5b46cfc3eeaa48115244401

  • SHA512

    af08340460c9c89e68a87e40db3ed4700cdf20001843f4aae81e9aca4ff48de0562f36c3c9165ef0e5cda89fe7afc1f3b7e102c30705d06e77da261e279c7b83

  • SSDEEP

    384:KiJKXg1/E6creBcrczJauRppVUqyk1gIt/SbMPBjPRLJT8+4JWAMtShnB:Z/E62U9JhBVJLtfFPRd8+KRMtiB

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\billsball_born.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1864-4-0x000000001B310000-0x000000001B5F2000-memory.dmp

    Filesize

    2.9MB

  • memory/1864-5-0x0000000002410000-0x0000000002418000-memory.dmp

    Filesize

    32KB

  • memory/1864-6-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

    Filesize

    9.6MB

  • memory/1864-7-0x00000000024A0000-0x0000000002520000-memory.dmp

    Filesize

    512KB

  • memory/1864-8-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

    Filesize

    9.6MB

  • memory/1864-9-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

    Filesize

    9.6MB

  • memory/1864-10-0x00000000024A0000-0x0000000002520000-memory.dmp

    Filesize

    512KB