Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
runner.ps1
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
runner.ps1
Resource
win10v2004-20250129-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
runner.ps1
-
Size
276KB
-
MD5
e255c745717b00f238c5b41aa2196153
-
SHA1
4aea97c6ecbd3de68791cc2591c930965962d6e7
-
SHA256
47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593
-
SHA512
7e155e523a895bf2bd97ba41316c674a828948c3d6ee7f49c2b2342188d76c53a29bef819a4ec3533106f841b021153ec9f18cfd2f2db6fd01d1d15d06e5468d
-
SSDEEP
1536:iQEjSvrxQrgoc7I5eFgk7OQdjdlYG76p/zIOO5Ys:O2vtQrO7I5eFgk7OQd0g6p/NO5Ys
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\System32\WmiMgmt.msc powershell.exe File created C:\Windows\System32\en-US\WmiMgmt.msc powershell.exe File opened for modification C:\Windows\System32\WmiMgmt.msc mmc.exe -
pid Process 3012 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3012 powershell.exe 3012 powershell.exe 3012 powershell.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2920 mmc.exe 2844 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3012 powershell.exe Token: 33 2920 mmc.exe Token: SeIncBasePriorityPrivilege 2920 mmc.exe Token: 33 2920 mmc.exe Token: SeIncBasePriorityPrivilege 2920 mmc.exe Token: 33 2920 mmc.exe Token: SeIncBasePriorityPrivilege 2920 mmc.exe Token: 33 2920 mmc.exe Token: SeIncBasePriorityPrivilege 2920 mmc.exe Token: 33 2920 mmc.exe Token: SeIncBasePriorityPrivilege 2920 mmc.exe Token: SeDebugPrivilege 2844 taskmgr.exe Token: SeShutdownPrivilege 2844 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2920 mmc.exe 2920 mmc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2920 3012 powershell.exe 31 PID 3012 wrote to memory of 2920 3012 powershell.exe 31 PID 3012 wrote to memory of 2920 3012 powershell.exe 31
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\runner.ps11⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\WmiMgmt.msc"2⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2844