Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    124s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2023, 14:04

General

  • Target

    mediawiki-1.39.1/extensions/AbuseFilter/includes/Pager/AbuseFilterPager.ps1

  • Size

    11KB

  • MD5

    e6e553852d3eb051eb547a125c715037

  • SHA1

    1528b00ae72d2dcb3ef308c960446c73ff841eb9

  • SHA256

    9fa29112bdb2ac2ef9ca56b3a120264f396e24a63b98b383db8c05ee0d2e6ba3

  • SHA512

    f9c8dda4dbd10587c5fc9967a62d8330ebdec3fc0aa86cd526d0c495a59dc0cd06dca576ba4eb9113fe87a7227df11cdc14af8a783e3d6f58d74670a15afa2c5

  • SSDEEP

    192:r5K2wHZhLIh0dqn0CUf1EQuJNgA3n+H2AJ242M3+Gj+UWaYIUIs1NSWlyId7rVrt:rAZP/b1FuJNg2n+H29IYNSWoId7rVrfF

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mediawiki-1.39.1\extensions\AbuseFilter\includes\Pager\AbuseFilterPager.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2516-4-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2516-6-0x0000000002410000-0x0000000002418000-memory.dmp

    Filesize

    32KB

  • memory/2516-7-0x00000000025D0000-0x0000000002650000-memory.dmp

    Filesize

    512KB

  • memory/2516-5-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-8-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-9-0x00000000025D0000-0x0000000002650000-memory.dmp

    Filesize

    512KB

  • memory/2516-10-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

    Filesize

    9.6MB