Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/04/2024, 14:19
General
-
Target
rigsombudsmndenes/Vildspors/Tjenestefries/Abrased.ps1
-
Size
43KB
-
MD5
bdc6750fa9e7f3f0e0967e682d730c3f
-
SHA1
592f466b066cd59938eef2c53b9e41942d7cacce
-
SHA256
3bf087d329e163f4300a66e02e102e45f58d39a13acf1a116ecb946233d69aa6
-
SHA512
529621f4d8213bf2bcf9199c9b4add2c3c77461c8e1b75bc37aa1512590eb58af681f741489d023493fbb2043ba6ca4d00d6b9bab18d9e59ef3e1c8ea6ffc7eb
-
SSDEEP
768:nXMWOJ+6hgfLifOQ7BFUMVqF+vNTg5aXSohz/5OcLxjqvtiXl/B7YRDY1KrvY3oV:n8zM6gSbLqFENTdioh9OcL1+i1UbQ4uO
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\rigsombudsmndenes\Vildspors\Tjenestefries\Abrased.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1736" "1076"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bd4486a32e418685a7003700f82279cf
SHA15d620751fa22a8109c8324dd1e64ce0c9fbdaa24
SHA256261a5a9bb80412c51f8cfee80a9a4f9110bc7e717ffa9a37a1f44323e4cecb95
SHA5120d54f334eaa73a6e936e555507f4c3776a4ceb50092f91302a2d7a545d077b61bc6a7e90da076fbf3084e7360f9fe14f20706f79fa28218ac47b5f67471b1785
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
16KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB