Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/02/2024, 08:00
General
-
Target
Algoesthesiometer/Kvitteringer/Naaletrs.ps1
-
Size
45KB
-
MD5
134c07fce8184c599cb40754d2ae6db7
-
SHA1
af5f44ed3b7ab716af0a5b683218f5ca96b0175c
-
SHA256
a17d8d7ec7a761817970478b591b1b8e69d41119636067ce4d221e72b9ca058a
-
SHA512
82c58aa95897217226a15674154b5c0a567962c60bd60ecdb98b486767391b05eaa2d03bcadcf6cf102aaa632f5bb2527af791b9e7049cde112107a3c874c221
-
SSDEEP
768:L9FgRj8sOglYNISbpapSUGxX+V8k0R6ljVP1W2HXhqIwKjLdHmH1BsB7WHl4C+bK:L9FgRIgMtpapS0WRapM2HFZjFK/l4dK
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Algoesthesiometer\Kvitteringer\Naaletrs.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1064" "1072"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55a70215fc20ee0b56537cb13b7e0382a
SHA1647dbef60402582b806bbf667e83e36b2792dabd
SHA256498bdb896aa765ec711b34f33dc46a2a9dacd8337e624121ca04544428f4d820
SHA51231273854936e16338841f510ed56e3eadaaf29a8129c4bd58065ede653fb43e20a17314ed474a345eb217614e9eaa462258cddd520e6e39cb36ed8526509e56d
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
16KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB