Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/07/2024, 14:48

240728-r6fwdatfnh 3

24/07/2024, 05:35

240724-gahd8azgpp 3

05/07/2024, 10:33

240705-mlkxdawgrr 3

05/07/2024, 10:21

240705-md26paygng 3

05/07/2024, 10:21

240705-mdp65awfqp 3

05/07/2024, 10:18

240705-mbw7nawfpk 3

05/07/2024, 10:15

240705-mahb4syfrg 3

03/07/2024, 18:34

240703-w7y6katfmf 3

Analysis

  • max time kernel
    1561s
  • max time network
    1562s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 05:35

General

  • Target

    windows.ps1

  • Size

    7B

  • MD5

    0f4137ed1502b5045d6083aa258b5c42

  • SHA1

    ab378b80a8a4aafabac7db7ae169f25796e65994

  • SHA256

    340d600392818df2413382dc7d8325c360d83ea49a262d31760348484bbc10b5

  • SHA512

    716280a95a7860c1854caaf45b63fc4b67b4aece0370ea6ec5dc21cc3b6794ea7f10d724aca13d57c81a7e92ae64929d90be8c1cf449fe86e91937a9a6e1f2c6

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/388-4-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

    Filesize

    4KB

  • memory/388-5-0x000000001B760000-0x000000001BA42000-memory.dmp

    Filesize

    2.9MB

  • memory/388-7-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB

  • memory/388-8-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB

  • memory/388-6-0x0000000002240000-0x0000000002248000-memory.dmp

    Filesize

    32KB

  • memory/388-9-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB

  • memory/388-10-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB

  • memory/388-11-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

    Filesize

    9.6MB