Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10mediawiki-...api.js
windows7-x64
1mediawiki-...api.js
windows10-2004-x64
1mediawiki-...ed.vbs
windows7-x64
1mediawiki-...ed.vbs
windows10-2004-x64
mediawiki-...e.html
windows7-x64
1mediawiki-...e.html
windows10-2004-x64
1mediawiki-...n.html
windows7-x64
1mediawiki-...n.html
windows10-2004-x64
1mediawiki-...e.html
windows7-x64
1mediawiki-...e.html
windows10-2004-x64
mediawiki-...Log.js
windows7-x64
1mediawiki-...Log.js
windows10-2004-x64
1mediawiki-...ger.js
windows7-x64
1mediawiki-...ger.js
windows10-2004-x64
1mediawiki-...oup.js
windows7-x64
1mediawiki-...oup.js
windows10-2004-x64
1mediawiki-...le.ps1
windows7-x64
1mediawiki-...le.ps1
windows10-2004-x64
1mediawiki-...tor.js
windows7-x64
1mediawiki-...tor.js
windows10-2004-x64
1mediawiki-...kup.js
windows7-x64
1mediawiki-...kup.js
windows10-2004-x64
1mediawiki-...or.ps1
windows7-x64
1mediawiki-...or.ps1
windows10-2004-x64
1mediawiki-...er.ps1
windows7-x64
1mediawiki-...er.ps1
windows10-2004-x64
1mediawiki-...er.ps1
windows7-x64
1mediawiki-...er.ps1
windows10-2004-x64
1mediawiki-...ger.js
windows7-x64
1mediawiki-...ger.js
windows10-2004-x64
1mediawiki-...de.ps1
windows7-x64
1mediawiki-...de.ps1
windows10-2004-x64
1Analysis
-
max time kernel
124s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 14:04
Behavioral task
behavioral1
Sample
mediawiki-1.39.1/api.js
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
mediawiki-1.39.1/api.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral3
Sample
mediawiki-1.39.1/docs/memcached.vbs
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
mediawiki-1.39.1/docs/memcached.vbs
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
mediawiki-1.39.1/docs/uidesign/confirmable.html
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
mediawiki-1.39.1/docs/uidesign/confirmable.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
mediawiki-1.39.1/docs/uidesign/design.html
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
mediawiki-1.39.1/docs/uidesign/design.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
mediawiki-1.39.1/docs/uidesign/monospace.html
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
mediawiki-1.39.1/docs/uidesign/monospace.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Api/QueryAbuseLog.js
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Api/QueryAbuseLog.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral13
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/ChangeTags/ChangeTagsManager.js
Resource
win7-20231025-en
Behavioral task
behavioral14
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/ChangeTags/ChangeTagsManager.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Consequences/Consequence/Degroup.js
Resource
win7-20231020-en
Behavioral task
behavioral16
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Consequences/Consequence/Degroup.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Consequences/Consequence/Throttle.ps1
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Consequences/Consequence/Throttle.ps1
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Consequences/ConsequencesExecutor.js
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Consequences/ConsequencesExecutor.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/FilterLookup.js
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/FilterLookup.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/FilterValidator.ps1
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/FilterValidator.ps1
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseFilterHistoryPager.ps1
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseFilterHistoryPager.ps1
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseFilterPager.ps1
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseFilterPager.ps1
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseLogPager.js
Resource
win7-20231023-en
Behavioral task
behavioral30
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseLogPager.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral31
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Parser/AFPTreeNode.ps1
Resource
win7-20231025-en
Behavioral task
behavioral32
Sample
mediawiki-1.39.1/extensions/AbuseFilter/includes/Parser/AFPTreeNode.ps1
Resource
win10v2004-20231023-en
General
-
Target
mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseFilterPager.ps1
-
Size
11KB
-
MD5
e6e553852d3eb051eb547a125c715037
-
SHA1
1528b00ae72d2dcb3ef308c960446c73ff841eb9
-
SHA256
9fa29112bdb2ac2ef9ca56b3a120264f396e24a63b98b383db8c05ee0d2e6ba3
-
SHA512
f9c8dda4dbd10587c5fc9967a62d8330ebdec3fc0aa86cd526d0c495a59dc0cd06dca576ba4eb9113fe87a7227df11cdc14af8a783e3d6f58d74670a15afa2c5
-
SSDEEP
192:r5K2wHZhLIh0dqn0CUf1EQuJNgA3n+H2AJ242M3+Gj+UWaYIUIs1NSWlyId7rVrt:rAZP/b1FuJNg2n+H29IYNSWoId7rVrfF
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2516 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mediawiki-1.39.1\extensions\AbuseFilter\includes\Pager\AbuseFilterPager.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516