Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
rJustificantedepago.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
rJustificantedepago.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Variabelforklaringen.ps1
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Variabelforklaringen.ps1
Resource
win10v2004-20241007-en
General
-
Target
Variabelforklaringen.ps1
-
Size
51KB
-
MD5
b38fc73651b54a201ea1815e9fbdb7e1
-
SHA1
11dcb7973511a7f58eacd0c6b519d4c57b843ece
-
SHA256
3cd2de55689d75d77cd308184060364fcf48b990e025e918233e528a3373a27b
-
SHA512
0e6055ab2c490f2c67184e3dea070f6b0d9cd0e557e1c51d792da53c4674d844d8d5c9a5dd036261437db2bb7b8b8e0425168ac143da01b2b1ce116540989b1d
-
SSDEEP
1536:wzAstLJaBT7rCnMxEVnq50oJbvVWezp1PQwQ66FkvKbzd:wcsOTgYEVqnYc/Pw7zd
Malware Config
Signatures
-
pid Process 2096 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2096 powershell.exe 2096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2096 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2096 wrote to memory of 1588 2096 powershell.exe 31 PID 2096 wrote to memory of 1588 2096 powershell.exe 31 PID 2096 wrote to memory of 1588 2096 powershell.exe 31
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Variabelforklaringen.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2096" "860"2⤵PID:1588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a6b16300a02498dbb19eb31bfa26677c
SHA14015ab8868bdf427b36c4d8d102b520d1f558f52
SHA25699366e7fb7473d24642c1f733948a2209061a9aad19004c31d39004be7d22889
SHA5123c13d00ed4bc4189523479d5b728e41acdcca1036b529bb0f1ae6f9e32a70c4d60f90a1cdf1e4358c490651dfebe3ddf78ad7622d372f3dd25ec246de06bced9