Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 10:42

General

  • Target

    mantisbt-1.2.1/admin/install_functions.ps1

  • Size

    7KB

  • MD5

    c7ce944effcd07743e7c93a38b4c1ce8

  • SHA1

    80c1a98c06346e12f6f7479007ed139d2fd354cd

  • SHA256

    75e057b652a1d6dcc45bb1129dd1348f1373c633a26a990811db6d9ecd8d168c

  • SHA512

    04f4df12a0915c9f56cb351109cf0fdbaed1df7a6a0fbcf70ebb7802f9859d3179b04d4e00d97b205c2fe1db100a7351756fa9ae2ff537f2c712a108febff6c5

  • SSDEEP

    192:0xqRkYVLiS3H6/RsbszqPe91dKNPRaI3S9IOSD:0xqV3H6Js7Pe911wS9TSD

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mantisbt-1.2.1\admin\install_functions.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1680-4-0x000000001B660000-0x000000001B942000-memory.dmp

    Filesize

    2.9MB

  • memory/1680-5-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

    Filesize

    32KB

  • memory/1680-6-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

    Filesize

    9.6MB

  • memory/1680-7-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/1680-8-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

    Filesize

    9.6MB

  • memory/1680-9-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/1680-10-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/1680-11-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

    Filesize

    9.6MB