Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    318s
  • max time network
    506s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2022, 05:38

General

  • Target

    VengefulLeather.msi

  • Size

    267.0MB

  • MD5

    e487592d43f5ca2045a3ac4e635cd5e1

  • SHA1

    06523feddb2be5089e154bdfe570e1cef2ad00d3

  • SHA256

    a43fe5ebc7bb94b76b3031efb7f4e6cb3932066683ea55a214e6ae3e00b2822e

  • SHA512

    5c08d9063c79cbf7efcdb83642a19b8dc4a8d905ca5279d19e8a1065d75e725789fc53fbd26480ea583eb374779d5256e2ca644419463b81d7fa3b3af7617405

  • SSDEEP

    196608:OZCjrKC82BT3tT4j9mcMMkxbgWw6Zi5sS:OkjT82Bztkj4cMMWgi

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\VengefulLeather.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1708
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E730B0A308EF63AE506671D8299C15AE
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4476

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI9010.tmp

    Filesize

    91KB

    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • C:\Windows\Installer\MSI9010.tmp

    Filesize

    91KB

    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • C:\Windows\Installer\MSI935C.tmp

    Filesize

    91KB

    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • C:\Windows\Installer\MSI935C.tmp

    Filesize

    91KB

    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • C:\Windows\Installer\MSI9B5D.tmp

    Filesize

    264.6MB

    MD5

    afddffa061874d57c30657ca8bfecba5

    SHA1

    c6f6b3a00a704ed1ddeaf1cc3277f92872b308cc

    SHA256

    72276ed4421e592116f1720b01464e43306fbc3a9d97b7a43fe201237258234b

    SHA512

    40417d574d44a3cfd59b20e07ff3b86ba0eb0e57d54355202cd5e86dda7217e9d8113e2648701ec6d15d41dcaff030748d0cfa4e9442bea96d63a6168ffdc203

  • C:\Windows\Installer\MSI9B5D.tmp

    Filesize

    264.6MB

    MD5

    afddffa061874d57c30657ca8bfecba5

    SHA1

    c6f6b3a00a704ed1ddeaf1cc3277f92872b308cc

    SHA256

    72276ed4421e592116f1720b01464e43306fbc3a9d97b7a43fe201237258234b

    SHA512

    40417d574d44a3cfd59b20e07ff3b86ba0eb0e57d54355202cd5e86dda7217e9d8113e2648701ec6d15d41dcaff030748d0cfa4e9442bea96d63a6168ffdc203

  • C:\Windows\Installer\MSI9B5D.tmp

    Filesize

    264.6MB

    MD5

    afddffa061874d57c30657ca8bfecba5

    SHA1

    c6f6b3a00a704ed1ddeaf1cc3277f92872b308cc

    SHA256

    72276ed4421e592116f1720b01464e43306fbc3a9d97b7a43fe201237258234b

    SHA512

    40417d574d44a3cfd59b20e07ff3b86ba0eb0e57d54355202cd5e86dda7217e9d8113e2648701ec6d15d41dcaff030748d0cfa4e9442bea96d63a6168ffdc203

  • memory/4476-140-0x0000000002C30000-0x0000000003C30000-memory.dmp

    Filesize

    16.0MB