Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
script.ps1
Resource
win7-20240704-en
General
-
Target
script.ps1
-
Size
195B
-
MD5
10c96c74a759c05ce13b93cb66682028
-
SHA1
9d55576077b4a6e78dd8c3454e4e0cf3c318adc2
-
SHA256
fca25adc23b7255059d672609cd4bc4e6ad18a4bec1ef7500409218ea9af16bd
-
SHA512
3308fa52372e48d6ffdc56abb6775ab6e426ddf540677085cf02f7344a28a1c2f7163050ec40f2757ada2768e031ab7f507fbe50dcffb02c8d1bb056422ae5c4
Malware Config
Signatures
-
pid Process 2632 powershell.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1940 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1940 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2632 powershell.exe 2632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2632 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 1940 2632 powershell.exe 86 PID 2632 wrote to memory of 1940 2632 powershell.exe 86 PID 2632 wrote to memory of 1616 2632 powershell.exe 98 PID 2632 wrote to memory of 1616 2632 powershell.exe 98
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 8.8.8.82⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1940
-
-
C:\Windows\system32\wsl.exe"C:\Windows\system32\wsl.exe" --install ubuntu2⤵PID:1616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82