Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 02:02

General

  • Target

    94057dc5b2e667878d433bf0e2e14ec4c264ec1f8679f54b7ce538ba3c667e6d.ps1

  • Size

    1KB

  • MD5

    f8d9fefdf59b457db60c2e048b477869

  • SHA1

    bca8aace5097332225a0872cf2acfa4a4337cffa

  • SHA256

    94057dc5b2e667878d433bf0e2e14ec4c264ec1f8679f54b7ce538ba3c667e6d

  • SHA512

    7ef0dfea4f0fe8f71e13779a256d803b3fbd4ce7c5fb5c4e35d412bb50909f628a410990042ca124b252ce4b6550ee020e6aad7de14d8dd5981b0b6a5f5fc31d

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\94057dc5b2e667878d433bf0e2e14ec4c264ec1f8679f54b7ce538ba3c667e6d.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2172-5-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2172-4-0x000000001B330000-0x000000001B612000-memory.dmp

    Filesize

    2.9MB

  • memory/2172-6-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2172-7-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2172-9-0x0000000001E60000-0x0000000001E68000-memory.dmp

    Filesize

    32KB

  • memory/2172-8-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2172-10-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2172-11-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2172-12-0x00000000026E0000-0x00000000026EC000-memory.dmp

    Filesize

    48KB

  • memory/2172-13-0x0000000002870000-0x000000000288C000-memory.dmp

    Filesize

    112KB

  • memory/2172-14-0x0000000002890000-0x000000000289E000-memory.dmp

    Filesize

    56KB

  • memory/2172-15-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2172-16-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2172-17-0x00000000028A0000-0x0000000002920000-memory.dmp

    Filesize

    512KB

  • memory/2172-18-0x000007FEF6020000-0x000007FEF69BD000-memory.dmp

    Filesize

    9.6MB