Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    209s
  • max time network
    261s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/12/2023, 22:06

General

  • Target

    0dcd00510d7cdf90218c8acb28802f46.ps1

  • Size

    421KB

  • MD5

    0dcd00510d7cdf90218c8acb28802f46

  • SHA1

    669ecf1747dd4b2c9251668fe38e0d42169221c8

  • SHA256

    1d430cca16d4a5663d6d59465552322e488a8f576fee2efd41d38040686b3d0f

  • SHA512

    6b0b7f810fba079e13fc7991d5ff6c4607e4f59032f6d509a45fb72ed635f4e51933ebf0ec3ef8d53fdae192d1e89980e1875221a9767336ccf82ab24e1a2914

  • SSDEEP

    12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw640L68:q3P

Score
10/10

Malware Config

Extracted

Family

oski

C2

103.114.107.28/l1/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0dcd00510d7cdf90218c8acb28802f46.ps1
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
      "{path}"
      2⤵
        PID:1652

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1652-17-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-30-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-29-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-27-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-25-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1652-23-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-22-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-21-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1652-19-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2532-10-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-4-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

      Filesize

      2.9MB

    • memory/2532-16-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-14-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-13-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-12-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

      Filesize

      9.6MB

    • memory/2532-11-0x0000000002660000-0x000000000266A000-memory.dmp

      Filesize

      40KB

    • memory/2532-15-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-9-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

      Filesize

      9.6MB

    • memory/2532-8-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-28-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

      Filesize

      9.6MB

    • memory/2532-7-0x0000000002820000-0x00000000028A0000-memory.dmp

      Filesize

      512KB

    • memory/2532-6-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

      Filesize

      9.6MB

    • memory/2532-5-0x00000000023E0000-0x00000000023E8000-memory.dmp

      Filesize

      32KB