Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 01:16

General

  • Target

    2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e.ps1

  • Size

    1KB

  • MD5

    7c81cf8237e58f041ef1627eb04a2611

  • SHA1

    da3d8d66045d951a1c57f04316e3e27e450fd3f4

  • SHA256

    2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e

  • SHA512

    327e3792c508b69e7bf9e7b91bbae0591bcf2e3a0fed6065e02266f5fc63f08ab86576d72f9b1d17a0a886521cde2b32101f729f83be14cd374be062f93089c4

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e.ps1
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2240-4-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

    Filesize

    4KB

  • memory/2240-5-0x000000001B250000-0x000000001B532000-memory.dmp

    Filesize

    2.9MB

  • memory/2240-6-0x0000000002410000-0x0000000002418000-memory.dmp

    Filesize

    32KB

  • memory/2240-7-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2240-8-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2240-9-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2240-10-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2240-11-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2240-12-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

    Filesize

    9.6MB