Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/05/2024, 02:46
240513-c9jzwahd4v 1013/05/2024, 02:46
240513-c9d4mahd4s 1013/05/2024, 02:45
240513-c89h5shd3y 1013/05/2024, 02:45
240513-c832csce34 1013/05/2024, 02:45
240513-c8xjkshd3w 1013/05/2024, 02:45
240513-c8qq2ace32 1013/05/2024, 02:42
240513-c65geahd2z 1013/05/2024, 02:41
240513-c6q9sahd2x 10Analysis
-
max time kernel
1559s -
max time network
1559s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
13/05/2024, 02:46
General
-
Target
file01 - copia (3).ps1
-
Size
510B
-
MD5
2dcb4d51653aec1a829f3232d69f5e12
-
SHA1
dd096e7d800b9f3ca0edc64955b4464d71789f80
-
SHA256
d1902d3e519d0d87097fd8969280bd01bd139a5191faadaed0149e61b4a7495c
-
SHA512
7def3731bbb3f7ac3895edcf14c645bbcc0608f09c6b03bf7ddaebf049f1f6f1aad4086548ab9fce7b2bbefd837de8377f8b81cf94022d84e35f1bba0af89143
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\file01 - copia (3).ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB