Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 12:42
Behavioral task
behavioral1
Sample
unobswin.ps1
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
unobswin.ps1
Resource
win10v2004-20231020-en
General
-
Target
unobswin.ps1
-
Size
2KB
-
MD5
f5890b9f06e330d27fdca75a5c463cf7
-
SHA1
e4e4d1aa11dea167e2a668e1d1fab3edd3237784
-
SHA256
12c8c3d9dc6418bc3add4c452fd56b78948ef37166cfaa6c5347e5f2e9734891
-
SHA512
909feb05cfccf92a24c384f0d24960ea90e9eac79a4dec671cd9099baa9697c0544b791361d28bf29d6bf226a67e974887831ec3d1cb35f79569529fccdcb58e
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4972 powershell.exe 4972 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4972 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4972 wrote to memory of 4056 4972 powershell.exe 87 PID 4972 wrote to memory of 4056 4972 powershell.exe 87 PID 4056 wrote to memory of 2748 4056 csc.exe 88 PID 4056 wrote to memory of 2748 4056 csc.exe 88
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\unobswin.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mzgrnsh2\mzgrnsh2.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA2A.tmp" "c:\Users\Admin\AppData\Local\Temp\mzgrnsh2\CSC9E8B8E1AAFD64FDB9DA5BABCB633C9.TMP"3⤵PID:2748
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5341760d37e8037f9a1cf4a3087c24cf2
SHA1cddad51cf2c61b4a8a8c65efbae9ac1d1a56bbcd
SHA256367c3b12ff175464e15dd8d4e5b33bf497a1f3bc9bf4286be8906930a440bff9
SHA512f6097c90812da8a048d8f509c19ba607cdb36b2d47856c45f8435b76d07a898f78e4ce0f02d0b7edfd295d56066b2f4a24290a79dc3fb6da295ba343cdc7d0be
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD5b293cf8106f1c2592c1f053b60f06871
SHA196f107a112de164573d6d85e838c80a656b54edd
SHA2569792fb45c497fbd8f2eaa0f3765c60e3461cb96904b222d09fd6cfb39f34143e
SHA512cd0453d9d49c2371bebac26ee2c67a129d7c7ae3d40bcee7d58835fd104c3da022585a4e7ae6296d8e1cfe02f9b8c97b787854251dd951b13ecb36144e4452fb
-
Filesize
652B
MD543ee72d94b0fb96a1a067e0d5689d142
SHA13fec20ef39a34f5c0a70e884b8d66126bc2bff33
SHA2565db5655383bc5c86f0b8bc39f7daaad3bb36060d7bbc03dea50421645bf5bb6d
SHA512df84d4ffe31ee629a047b8cb675177954364d721f32f6c1d603f418cb4a58b4bb19b3f877bccdd151ceefc3f1bfebf41caf103c97dba2819beef1671075a8ad7
-
Filesize
566B
MD55e0d17750a88ae9904d318b1f74958d2
SHA113e656826bd7798077dcfb124b0fdcbbc7c4a008
SHA256160c9e4d4cc91e8eb915616395e206079c35766bfba43c227418252184866c5f
SHA512db330adceb94cac65076f53cf2f03662f62b17ab167cccfac302a5a4400dfdd18ec2b395c0322c3a94eedc667ce7a78869f5a5f9f55deba9cddc8ffdbb4403ab
-
Filesize
369B
MD5e1faa3b17caffd971ef903ec5baab66b
SHA1e856291eb926b70598a8b165d207dc5c86f174bc
SHA256df1927600093b8455454fe1b1ca180014d2692757c846d36b3cae89aa412b341
SHA5126376346c61a2c9897686c5de2ab699df096963fe8219f539806884dedb44e17b29e49fa524f5b3428c80122c784ce5122761397ba11e5e81f742db33c3b333d4