Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

cd7bb7396f...40.msi

windows7_x64

8

cd7bb7396f...40.msi

windows10_x64

8

Analysis

  • max time kernel
    129s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28/01/2022, 18:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cd7bb7396f21c88742fefb278e6e7c9a564dfe109b434494d159518175739c40.msi

  • Size

    372KB

  • MD5

    4acd155b901884134f01b383eb035c23

  • SHA1

    63aeb16b5d001cbd94b636e9f557fe97b8467c8d

  • SHA256

    cd7bb7396f21c88742fefb278e6e7c9a564dfe109b434494d159518175739c40

  • SHA512

    e1dcd24397793fcf8d9e3575d2f37ccf4323c90f50dafeb36ae4d9f8f8dc98ed49435f38d0269a38db0a491b52bb6c693038c24764201527b24a232d75462047

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cd7bb7396f21c88742fefb278e6e7c9a564dfe109b434494d159518175739c40.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3504
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1164
    • C:\Windows\Installer\MSI1779.tmp
      "C:\Windows\Installer\MSI1779.tmp"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c rundll32 C:\Users\Admin\AppData\Local\Temp\pegas.dll, kest
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 C:\Users\Admin\AppData\Local\Temp\pegas.dll, kest
          4⤵
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3196
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C powershell -nop -ep bypass -f %temp%\enu.ps1
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3724
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nop -ep bypass -f C:\Users\Admin\AppData\Local\Temp\enu.ps1
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3884
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4992
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2536

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3196-426-0x0000000013140000-0x0000000013266000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3884-431-0x0000000004D70000-0x0000000004DA6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/3884-432-0x0000000007670000-0x0000000007C98000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/3884-433-0x0000000007490000-0x00000000074B2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3884-434-0x0000000007530000-0x0000000007596000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3884-435-0x0000000007E80000-0x0000000007EE6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3884-436-0x0000000007EF0000-0x0000000008240000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/3884-437-0x0000000007CC0000-0x0000000007D36000-memory.dmp

    Filesize

    472KB

    Download