Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/03/2024, 02:03
General
-
Target
Infami/Metagaster/Brnehaveklasserne.ps1
-
Size
53KB
-
MD5
2a4402450d6e37b4c5f6434e8e2548ae
-
SHA1
29b0d015b4c7420b576f3ce745b95f16f416045e
-
SHA256
05e03c9da534face56a3181a98e7194ce73a4638f713523d26aa97486f427eea
-
SHA512
e5a69a27041b0c1f8592861e820da036edc41cf3b0d630a6eea8e1cb8935ff88a5aec6a231e240c2c3fa52c47c64608ea84924cb6165170e3ee144335fbb4387
-
SSDEEP
1536:7uclUIfUW1MRADKnHPiRLeZ1/3pJ45WhfDntzBZ:7unW1MBnaFeZ1/3pJ40Rz
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Infami\Metagaster\Brnehaveklasserne.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2276" "1124"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e706bd6370b0ab710fc6fb5e49b9d642
SHA1bad5f28988d1d2c4df251b393f75340935de6269
SHA2562531b6d829a8a798f239d7225efaba93973c6bb16029267f37ea1a347900bb41
SHA5125a51ac3c56b740865f7be88cc09d553a2b8c47f46d097b8fc4779acabb63468a1ecfd79cf0bef70650dffa335140315f0332f24e62420c0992315055305a9f54
-
Filesize
512KB
-
Filesize
16KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB