Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e.ps1
Resource
win7-20240611-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e.ps1
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e.ps1
-
Size
1KB
-
MD5
7c81cf8237e58f041ef1627eb04a2611
-
SHA1
da3d8d66045d951a1c57f04316e3e27e450fd3f4
-
SHA256
2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e
-
SHA512
327e3792c508b69e7bf9e7b91bbae0591bcf2e3a0fed6065e02266f5fc63f08ab86576d72f9b1d17a0a886521cde2b32101f729f83be14cd374be062f93089c4
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2240 powershell.exe -
pid Process 2240 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2240 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2240 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2efb8e05f9b74fb551ceab2883a98e2e2300a4f29b050c0b747ba8250caf0c9e.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240