Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    13/11/2023, 12:42

General

  • Target

    obsc.ps1

  • Size

    7KB

  • MD5

    d60199c5d5443411506fbb85797819e8

  • SHA1

    8c0155cffc9ca162b11fb80feda257c06e9301ca

  • SHA256

    03c50363dbb1adabd46920615a1fa5f47b673622b69698225d4b5df63ae58770

  • SHA512

    728ec31c0679da7fd17b64cec267f00a3170e7002a5a55e8920852f4bce66c1d474638633693017612dc86ae4563b5be6e37038e01497927793eb82a8307e64c

  • SSDEEP

    192:zHJ/HZsy2MSWnNCwSjlnDJ+EdnwdCkz1zQdI9Xf6:b0kMwslnDJRwEqQdI9Xf6

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\obsc.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2124-5-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2124-4-0x000000001B350000-0x000000001B632000-memory.dmp

    Filesize

    2.9MB

  • memory/2124-7-0x00000000024C0000-0x0000000002540000-memory.dmp

    Filesize

    512KB

  • memory/2124-8-0x00000000024C0000-0x0000000002540000-memory.dmp

    Filesize

    512KB

  • memory/2124-9-0x00000000024C0000-0x0000000002540000-memory.dmp

    Filesize

    512KB

  • memory/2124-6-0x00000000025A0000-0x00000000025A8000-memory.dmp

    Filesize

    32KB

  • memory/2124-10-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2124-11-0x00000000024C0000-0x0000000002540000-memory.dmp

    Filesize

    512KB

  • memory/2124-12-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2124-13-0x00000000024C0000-0x0000000002540000-memory.dmp

    Filesize

    512KB