Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

VMware-wor...37.exe

windows7-x64

1

VMware-wor...37.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    81s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2022, 03:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VMware-workstation-full-16.2.4-20089737.exe

  • Size

    615.6MB

  • MD5

    d60f20003600b70defb72215417aadee

  • SHA1

    b89035349ad4894e1837b81e3e826ca4572f4f88

  • SHA256

    758f7211d631b2b5b52df7214485fe2082661e5ba18054c8d91be0d7e27dbb2f

  • SHA512

    e9be925c8d3fe9fe81383398709fa4a992ccf2a50b833421ff54d629b1088cb8a773af64c87bed3c513f03a6a84f8eb5001f8cf52f895808c6f002c49d44abfe

  • SSDEEP

    12582912:HsiQc7JR+tkXSznRL4KY0XxCDhc/jVPil7pbuhbKDe0uDe07:MiQc7JR+tMSznJY0XxCD6/jVPil7pbDi

Score
8/10
discoveryevasion

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VMware-workstation-full-16.2.4-20089737.exe
    "C:\Users\Admin\AppData\Local\Temp\VMware-workstation-full-16.2.4-20089737.exe"
    1⤵
    • Looks for VMWare Tools registry key
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x86.exe" /Q /norestart
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\Temp\{9B6B9E5C-9924-4541-8265-09B2A28D7BE7}\.cr\vcredist_x86.exe
        "C:\Windows\Temp\{9B6B9E5C-9924-4541-8265-09B2A28D7BE7}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /Q /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4892
    • C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x64.exe" /Q /norestart
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\Temp\{FA3B4156-EA11-4EC2-9A6B-8027379BDA36}\.cr\vcredist_x64.exe
        "C:\Windows\Temp\{FA3B4156-EA11-4EC2-9A6B-8027379BDA36}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /Q /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1812
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0B14CF2673166BCB98FE2A5FB80E8487 C
      2⤵
      • Loads dropped DLL
      PID:3948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 932
        3⤵
        • Program crash
        PID:1412
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3948 -ip 3948
    1⤵
      PID:4708

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MSIE7A1.tmp
      Filesize

      2.7MB

      MD5

      828b8828a7600b984e212dec961d4c3f

      SHA1

      cb74a27bf2d09e90fe26cd058f72a663be9effb7

      SHA256

      ff3ffc884bfaf4717d60d0a07afd970479c24c560a25b625c21aaa231b1a3969

      SHA512

      c49a29e9981a6034f6049daae441e03a8e46690c6052eae84b83e05bfb915d4803140242bc7e5ece61c33f11ed22a4bb7dbfcebf0b6d16f24478224070dcf4c1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIE7A1.tmp
      Filesize

      2.7MB

      MD5

      828b8828a7600b984e212dec961d4c3f

      SHA1

      cb74a27bf2d09e90fe26cd058f72a663be9effb7

      SHA256

      ff3ffc884bfaf4717d60d0a07afd970479c24c560a25b625c21aaa231b1a3969

      SHA512

      c49a29e9981a6034f6049daae441e03a8e46690c6052eae84b83e05bfb915d4803140242bc7e5ece61c33f11ed22a4bb7dbfcebf0b6d16f24478224070dcf4c1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIF202.tmp
      Filesize

      202KB

      MD5

      d773d9bd091e712df7560f576da53de8

      SHA1

      165cfbdce1811883360112441f7237b287cf0691

      SHA256

      e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

      SHA512

      15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIF202.tmp
      Filesize

      202KB

      MD5

      d773d9bd091e712df7560f576da53de8

      SHA1

      165cfbdce1811883360112441f7237b287cf0691

      SHA256

      e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

      SHA512

      15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\vminst.log
      Filesize

      34KB

      MD5

      b24961b12c344a557cf45423f4a0ba62

      SHA1

      300e556e7f33e1d736543b5b7c1595ad110a5c1d

      SHA256

      ffd99bb3ef92bb63e0533d84053da6f80e66113ea20ff5070f09b0bd20cf9a17

      SHA512

      61612fda1f60527ed893195c6988604970a980a6cab638a64fa8fce1c392dee58c62b691ccdc14c1be443418be701c8687087bc89cc98bf28389e3213496603d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x64.exe
      Filesize

      14.2MB

      MD5

      a56672c4522a1b9bb767c8b6cfbe0ba4

      SHA1

      18a31b3f7fed28870b882909d91dfa8ec5bc87a6

      SHA256

      015edd4e5d36e053b23a01adb77a2b12444d3fb6eccefe23e3a8cd6388616a16

      SHA512

      5170b3fd4a0fc637184044c9dbe7ab3f8ca115fbac5ec851802c290139a3d99aacfd458fe2e925eb3282612c9b18d4c857f8c39284efbf3da49317a1fecc16ff

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x64.exe
      Filesize

      14.2MB

      MD5

      a56672c4522a1b9bb767c8b6cfbe0ba4

      SHA1

      18a31b3f7fed28870b882909d91dfa8ec5bc87a6

      SHA256

      015edd4e5d36e053b23a01adb77a2b12444d3fb6eccefe23e3a8cd6388616a16

      SHA512

      5170b3fd4a0fc637184044c9dbe7ab3f8ca115fbac5ec851802c290139a3d99aacfd458fe2e925eb3282612c9b18d4c857f8c39284efbf3da49317a1fecc16ff

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x86.exe
      Filesize

      13.7MB

      MD5

      b347c30bd3394b01039b1bf0c3efde53

      SHA1

      d7a91e4225d0b52310fdfec2331b15ad39f3391f

      SHA256

      e830c313aa99656748f9d2ed582c28101eaaf75f5377e3fb104c761bf3f808b2

      SHA512

      a5c33e0f588e11b228caf7da0d64ee1456601680703ed35769bd7bc56a891e182fd35d5501598e344ca46f2bcc83fc388f27489f7512c81d27bff4a61d1fdbda

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{927A213D-406C-4CE6-9C80-7EFDB4FBE97A}~setup\vcredist_x86.exe
      Filesize

      13.7MB

      MD5

      b347c30bd3394b01039b1bf0c3efde53

      SHA1

      d7a91e4225d0b52310fdfec2331b15ad39f3391f

      SHA256

      e830c313aa99656748f9d2ed582c28101eaaf75f5377e3fb104c761bf3f808b2

      SHA512

      a5c33e0f588e11b228caf7da0d64ee1456601680703ed35769bd7bc56a891e182fd35d5501598e344ca46f2bcc83fc388f27489f7512c81d27bff4a61d1fdbda

      Download Submit

    • C:\Windows\Temp\{5DCEB25D-978C-4F4C-8AD4-8C8AE3421150}\.ba\wixstdba.dll
      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

      Download Submit

    • C:\Windows\Temp\{9B6B9E5C-9924-4541-8265-09B2A28D7BE7}\.cr\vcredist_x86.exe
      Filesize

      632KB

      MD5

      4d6b31d542ec3fd96bcf8a0cfae9f8ea

      SHA1

      b5be29ab2f0d30825c763df5a3cb071d1a708e05

      SHA256

      55d27902ffebfc7e5ab55962c0c3e6f9c901729a40abe5e564ee8e436a07ba17

      SHA512

      bbbb13c0aca849ebd5369a07e2b089d298f7d1f0ccb4dfaaf23c6d7deb9bda885f6c12d62f921dbdac2a473d0ffd23b60f04bc387210bf3e9ab33ee60e3f2c20

      Download Submit

    • C:\Windows\Temp\{9B6B9E5C-9924-4541-8265-09B2A28D7BE7}\.cr\vcredist_x86.exe
      Filesize

      632KB

      MD5

      4d6b31d542ec3fd96bcf8a0cfae9f8ea

      SHA1

      b5be29ab2f0d30825c763df5a3cb071d1a708e05

      SHA256

      55d27902ffebfc7e5ab55962c0c3e6f9c901729a40abe5e564ee8e436a07ba17

      SHA512

      bbbb13c0aca849ebd5369a07e2b089d298f7d1f0ccb4dfaaf23c6d7deb9bda885f6c12d62f921dbdac2a473d0ffd23b60f04bc387210bf3e9ab33ee60e3f2c20

      Download Submit

    • C:\Windows\Temp\{FA3B4156-EA11-4EC2-9A6B-8027379BDA36}\.cr\vcredist_x64.exe
      Filesize

      632KB

      MD5

      cd3e6f264b47b68097363494b9a389ad

      SHA1

      a9af64b7608e66338e90709e7d1fd3aed8a3b83e

      SHA256

      63debb4675d2875d5787e7bae52e73bddc040939ea9235df897c3fd7818de9d3

      SHA512

      171e42561f3e9a2dcec37ead64bed9b754e52f8bcd45a4ad157e2ca1cc85cac94547cda5ade8d34b64029d14e4545cea7508d9ca9bb3e2b914dc953f7de332f4

      Download Submit

    • C:\Windows\Temp\{FA3B4156-EA11-4EC2-9A6B-8027379BDA36}\.cr\vcredist_x64.exe
      Filesize

      632KB

      MD5

      cd3e6f264b47b68097363494b9a389ad

      SHA1

      a9af64b7608e66338e90709e7d1fd3aed8a3b83e

      SHA256

      63debb4675d2875d5787e7bae52e73bddc040939ea9235df897c3fd7818de9d3

      SHA512

      171e42561f3e9a2dcec37ead64bed9b754e52f8bcd45a4ad157e2ca1cc85cac94547cda5ade8d34b64029d14e4545cea7508d9ca9bb3e2b914dc953f7de332f4

      Download Submit

    • C:\Windows\Temp\{FFD0856E-D225-42EE-9DBD-82336F410C33}\.ba\wixstdba.dll
      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

      Download Submit