Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1base/class...el.ps1
windows7-x64
3base/class...el.ps1
windows10-2004-x64
3base/class...ry.ps1
windows7-x64
3base/class...ry.ps1
windows10-2004-x64
3base/新云软件.url
windows7-x64
1base/新云软件.url
windows10-2004-x64
1clantiger/filter.html
windows7-x64
1clantiger/filter.html
windows10-2004-x64
1clantiger/...ay.ps1
windows7-x64
3clantiger/...ay.ps1
windows10-2004-x64
3clantiger/...er.ps1
windows7-x64
3clantiger/...er.ps1
windows10-2004-x64
3clantiger/index.js
windows7-x64
3clantiger/index.js
windows10-2004-x64
3clantiger/...ls.ps1
windows7-x64
3clantiger/...ls.ps1
windows10-2004-x64
3clantiger/...gs.ps1
windows7-x64
3clantiger/...gs.ps1
windows10-2004-x64
3clantiger/...es.ps1
windows7-x64
3clantiger/...es.ps1
windows10-2004-x64
3clantiger/...rd.ps1
windows7-x64
3clantiger/...rd.ps1
windows10-2004-x64
3clantiger/...um.ps1
windows7-x64
3clantiger/...um.ps1
windows10-2004-x64
3clantiger/...x.html
windows7-x64
1clantiger/...x.html
windows10-2004-x64
1clantiger/...es.ps1
windows7-x64
3clantiger/...es.ps1
windows10-2004-x64
3clantiger/...es.ps1
windows7-x64
3clantiger/...es.ps1
windows10-2004-x64
3clantiger/...ws.ps1
windows7-x64
3clantiger/...ws.ps1
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
base/class.accesslevel.ps1
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
base/class.accesslevel.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
base/class.forumcategory.ps1
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
base/class.forumcategory.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
base/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
base/新云软件.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
clantiger/filter.html
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
clantiger/filter.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
clantiger/functions/class.display.ps1
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
clantiger/functions/class.display.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
clantiger/functions/class.super.ps1
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
clantiger/functions/class.super.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
clantiger/index.js
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
clantiger/index.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
clantiger/modules/accesslevels.ps1
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
clantiger/modules/accesslevels.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
clantiger/modules/blogs.ps1
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
clantiger/modules/blogs.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
clantiger/modules/custompages.ps1
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
clantiger/modules/custompages.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
clantiger/modules/dashboard.ps1
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
clantiger/modules/dashboard.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
clantiger/modules/forum.ps1
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
clantiger/modules/forum.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
clantiger/modules/index.html
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
clantiger/modules/index.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
clantiger/modules/matches.ps1
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
clantiger/modules/matches.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
clantiger/modules/modules.ps1
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
clantiger/modules/modules.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
clantiger/modules/news.ps1
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
clantiger/modules/news.ps1
Resource
win10v2004-20240508-en
General
-
Target
clantiger/functions/class.display.ps1
-
Size
5KB
-
MD5
feb1eb61b07f55110ca19126856efb5f
-
SHA1
d31fa449f423453668d9ea25810da166513b6c67
-
SHA256
8420287af21e37dac9c9e03b6520fe76da4ff8475e2990e7e6b1d4825f95fcc7
-
SHA512
99e20f9d28907eebd30e032432d2c94a1a330d59883b7154713503ddcb6872d28bcff081e810dd3185db661d8230cbf59eb4e8859c8911a96c7d61862c8c61bf
-
SSDEEP
96:5MiGdnr0qx6GAG7v5dghVge5gcg2wgYgBK0UVUmq46vhaHBnWHlR:aikn4q0GAGbcd5JDwtG5oUmh8xFR
Malware Config
Signatures
-
pid Process 1724 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1724 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1724 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\clantiger\functions\class.display.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724