Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/10/2024, 09:23 UTC

General

  • Target

    Stenklver219.ps1

  • Size

    52KB

  • MD5

    78082e39dd451e1d5043bcd0d5a72b8e

  • SHA1

    ae870a41f8b0585cacd05d5c6651e83460092325

  • SHA256

    2f554bddfe10ada0fc5106bced02c8fc45e910848688146287d3423ef094a58f

  • SHA512

    8780e10971c1179d341e7f4bfd0089e9586cb05048a75196fbf1a09ec8f48f80ecce8e10b5e5546b311e48bf0c2b2a9e9c481050bfae184f8dfbd7eb5ee984e8

  • SSDEEP

    1536:D+e7Lz+gJMhdGvU91sV6KlRDGzjWqK3f61:SECx+y1swKlcWqAfw

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Stenklver219.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "1428" "912"
      2⤵
        PID:2816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259519397.txt

      Filesize

      1KB

      MD5

      e535d09cc72e3865632c3ab4a1079d48

      SHA1

      2b8d39515f3f52ae62d318d3d9c4d92cb8cb0449

      SHA256

      ab0f17cf63135abc54878710765b868aa80e40d001b3db8a6cbc768624ad2b1e

      SHA512

      00b4fd005e2e3deb4bb17c0d594a00808601cf8a26d6b2cdbc5edd6e1a8c44a3300049f77f7f313f09b73778bf63cb7df7025beefe47eee39f59b6f25f3ada03

    • memory/1428-10-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-12-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-7-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-8-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-9-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-4-0x000007FEF630E000-0x000007FEF630F000-memory.dmp

      Filesize

      4KB

    • memory/1428-11-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-6-0x0000000002470000-0x0000000002478000-memory.dmp

      Filesize

      32KB

    • memory/1428-13-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-14-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-15-0x000007FEF630E000-0x000007FEF630F000-memory.dmp

      Filesize

      4KB

    • memory/1428-5-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

      Filesize

      2.9MB

    • memory/1428-18-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    • memory/1428-19-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

      Filesize

      9.6MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.