Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/10/2023, 14:07
231031-re37labd66 131/10/2023, 14:02
231031-rcf92shb8s 131/10/2023, 13:59
231031-rahebsha3x 131/10/2023, 13:47
231031-q3rb9sad36 1Analysis
-
max time kernel
170s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
run.ps1
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
run.ps1
Resource
win10v2004-20231023-en
General
-
Target
run.ps1
-
Size
351B
-
MD5
020b64c77751bf39ac87056235310827
-
SHA1
57fce2282987f8864085c1220094f63b1b74af2a
-
SHA256
5d7da2e714b49bb444fba61118db5762657c42590eceff66a890f238c039269f
-
SHA512
15546845dec53569ee3678af33edc0076954300d880207f8bebf6ca3ba611d41c293d90e7cbcbb7c1f6cacea00aa89adc7b67d6d5c34e83fb972b7882ff4ba42
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 23 IoCs
pid Process 5108 PING.EXE 2640 PING.EXE 4900 PING.EXE 1948 PING.EXE 544 PING.EXE 412 PING.EXE 1420 PING.EXE 3288 PING.EXE 2456 PING.EXE 3164 PING.EXE 4976 PING.EXE 1596 PING.EXE 3952 PING.EXE 3152 PING.EXE 2176 PING.EXE 1688 PING.EXE 2444 PING.EXE 4636 PING.EXE 1504 PING.EXE 3036 PING.EXE 1952 PING.EXE 264 PING.EXE 916 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 powershell.exe 2716 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2716 powershell.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2716 wrote to memory of 1952 2716 powershell.exe 90 PID 2716 wrote to memory of 1952 2716 powershell.exe 90 PID 2716 wrote to memory of 3952 2716 powershell.exe 91 PID 2716 wrote to memory of 3952 2716 powershell.exe 91 PID 2716 wrote to memory of 264 2716 powershell.exe 92 PID 2716 wrote to memory of 264 2716 powershell.exe 92 PID 2716 wrote to memory of 1420 2716 powershell.exe 93 PID 2716 wrote to memory of 1420 2716 powershell.exe 93 PID 2716 wrote to memory of 916 2716 powershell.exe 94 PID 2716 wrote to memory of 916 2716 powershell.exe 94 PID 2716 wrote to memory of 1688 2716 powershell.exe 95 PID 2716 wrote to memory of 1688 2716 powershell.exe 95 PID 2716 wrote to memory of 2640 2716 powershell.exe 96 PID 2716 wrote to memory of 2640 2716 powershell.exe 96 PID 2716 wrote to memory of 3288 2716 powershell.exe 97 PID 2716 wrote to memory of 3288 2716 powershell.exe 97 PID 2716 wrote to memory of 3152 2716 powershell.exe 98 PID 2716 wrote to memory of 3152 2716 powershell.exe 98 PID 2716 wrote to memory of 2176 2716 powershell.exe 101 PID 2716 wrote to memory of 2176 2716 powershell.exe 101 PID 2716 wrote to memory of 2456 2716 powershell.exe 102 PID 2716 wrote to memory of 2456 2716 powershell.exe 102 PID 2716 wrote to memory of 544 2716 powershell.exe 104 PID 2716 wrote to memory of 544 2716 powershell.exe 104 PID 2716 wrote to memory of 4900 2716 powershell.exe 105 PID 2716 wrote to memory of 4900 2716 powershell.exe 105 PID 2716 wrote to memory of 1948 2716 powershell.exe 106 PID 2716 wrote to memory of 1948 2716 powershell.exe 106 PID 2716 wrote to memory of 2444 2716 powershell.exe 107 PID 2716 wrote to memory of 2444 2716 powershell.exe 107 PID 2716 wrote to memory of 4636 2716 powershell.exe 108 PID 2716 wrote to memory of 4636 2716 powershell.exe 108 PID 2716 wrote to memory of 1504 2716 powershell.exe 109 PID 2716 wrote to memory of 1504 2716 powershell.exe 109 PID 2716 wrote to memory of 3164 2716 powershell.exe 110 PID 2716 wrote to memory of 3164 2716 powershell.exe 110 PID 2716 wrote to memory of 3036 2716 powershell.exe 111 PID 2716 wrote to memory of 3036 2716 powershell.exe 111 PID 2716 wrote to memory of 4976 2716 powershell.exe 112 PID 2716 wrote to memory of 4976 2716 powershell.exe 112 PID 2716 wrote to memory of 1596 2716 powershell.exe 113 PID 2716 wrote to memory of 1596 2716 powershell.exe 113 PID 2716 wrote to memory of 5108 2716 powershell.exe 114 PID 2716 wrote to memory of 5108 2716 powershell.exe 114 PID 2716 wrote to memory of 412 2716 powershell.exe 115 PID 2716 wrote to memory of 412 2716 powershell.exe 115
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:1952
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:3952
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.gov2⤵
- Runs ping.exe
PID:264
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" bfo.guv2⤵
- Runs ping.exe
PID:1420
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.gov2⤵
- Runs ping.exe
PID:916
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi,gu2⤵
- Runs ping.exe
PID:1688
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:2640
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:3288
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbilgiv2⤵
- Runs ping.exe
PID:3152
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.cov2⤵
- Runs ping.exe
PID:2176
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:2456
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:544
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:4900
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:1948
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:2444
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.giv2⤵
- Runs ping.exe
PID:4636
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:1504
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:3164
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbo.guv2⤵
- Runs ping.exe
PID:3036
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:4976
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:1596
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:5108
-
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" fbi.guv2⤵
- Runs ping.exe
PID:412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82