Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/06/2024, 10:09

240614-l65xlswcne 8

14/06/2024, 10:08

240614-l6jdlszcpj 3

14/06/2024, 10:02

240614-l2ws5sward 6

14/06/2024, 09:59

240614-l1cnwazapm 3

Analysis

  • max time kernel
    107s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 10:02

General

  • Target

    output.ps1

  • Size

    1.3MB

  • MD5

    79c5a7175002efbba4e43635d6b4efdd

  • SHA1

    7967fdc4c9c457d79922169547fa135264cb844b

  • SHA256

    d6334f9a9eebc74ff286ae30a54c0afe6ae2732a4ab97b1be097c2e4f66c5124

  • SHA512

    d091f85ba25d6e608b4d650c524ba2f74c067706de3a3e090380957f8a71be9272d07e79bedaedc2a67c1c84d4e943c6f0c657577c95bf2dcd647a6faa3dc3cd

  • SSDEEP

    24576:rxI9ydWnhHtTgTuGa14HKYktMpicPC3IyIBwnkx7Cn:V+pdRttczPmFxu7+

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\output.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2032
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\output.ps1"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1568-13-0x0000000000D70000-0x0000000000D92000-memory.dmp

      Filesize

      136KB

    • memory/1568-14-0x0000000000D70000-0x0000000000D92000-memory.dmp

      Filesize

      136KB

    • memory/2032-4-0x000007FEF5D1E000-0x000007FEF5D1F000-memory.dmp

      Filesize

      4KB

    • memory/2032-5-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

      Filesize

      2.9MB

    • memory/2032-7-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2032-6-0x0000000001E00000-0x0000000001E08000-memory.dmp

      Filesize

      32KB

    • memory/2032-8-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2032-9-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2032-10-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2032-11-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2032-12-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

      Filesize

      9.6MB