Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    106s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2022, 14:38

General

  • Target

    anydesk setup.msi

  • Size

    8.2MB

  • MD5

    1491e78be7e5a4c5a0475c7c679d1628

  • SHA1

    d591dfa1bc1fce94018be12b0c45627d053406ca

  • SHA256

    49e0e5f0de62fb6647ac6a76a8e57a9b636c777f9304337bff11971a7c6966e3

  • SHA512

    cd0e0f4082fe2cba3e6719776f0ba0663f3c969950edcff118b03fa30f38fde278f80063f207b8cc2f0c4607a2a976e826fdbec165ab3aadafa1a76a25e3c243

  • SSDEEP

    196608:EsmqQDx19HKjYh8EFwIR8j9IR8fsNHKSEv7c:EsmqQdqdIR85IRxNqS8c

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\anydesk setup.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4988
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4132
    • C:\Windows\Installer\MSID48C.tmp
      "C:\Windows\Installer\MSID48C.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Users\Admin\AppData\Local\Temp\is-022TP.tmp\MSID48C.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-022TP.tmp\MSID48C.tmp" /SL5="$90044,7703614,831488,C:\Windows\Installer\MSID48C.tmp"
        3⤵
        • Executes dropped EXE
        PID:4028
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-022TP.tmp\MSID48C.tmp

    Filesize

    3.0MB

    MD5

    f380cb51b5d8198c0f31f717949c4f00

    SHA1

    088fd106ee395bb75a2ade6e51d21bd2faf63f51

    SHA256

    2aae78bb1eff723a663d54be4973cad7a99ffece60d40524d9dbfac17694c455

    SHA512

    72a8de30962014c78dca691cabc848705af53db452150bc3f7fdfe3a8e1db504b03bb6a6b5fe74d6a9719efd792ce69e839d936bd2918616598ea4b2295b3dd9

  • C:\Windows\Installer\MSID48C.tmp

    Filesize

    8.1MB

    MD5

    591e2cb28ab4c2c8729b7b8b21797779

    SHA1

    0708d8bade5e1c1e4198b440f988c1b1b722c1e6

    SHA256

    87e0e6a8898d0d8043aec584b4a563943e539a5e7f3cadd78264dec1096f67f7

    SHA512

    08e1ba57ae8364f16c6129a08ee6fcf7380aff036f8946601ab2311143227ef8a10a2057d8eff92e971ddd0006c3dbdeffbeb84bcf2d118228a9859e57186ae4

  • C:\Windows\Installer\MSID48C.tmp

    Filesize

    8.1MB

    MD5

    591e2cb28ab4c2c8729b7b8b21797779

    SHA1

    0708d8bade5e1c1e4198b440f988c1b1b722c1e6

    SHA256

    87e0e6a8898d0d8043aec584b4a563943e539a5e7f3cadd78264dec1096f67f7

    SHA512

    08e1ba57ae8364f16c6129a08ee6fcf7380aff036f8946601ab2311143227ef8a10a2057d8eff92e971ddd0006c3dbdeffbeb84bcf2d118228a9859e57186ae4

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

    Filesize

    23.0MB

    MD5

    e9d0094e73a4e6592a1a63e69b977e3f

    SHA1

    b238e3baf61851c9573fc57a3686f268275fa9a3

    SHA256

    4c1eae97442c5a9419074a269534e743251306903c5fd987f1c071b6d17c05fa

    SHA512

    aadde5b85b82648cafedb11bab164967423580a8acaf44f9e1507c521263fca6f68683a112877d809a7d0513d97ef4a04d7feafeb546755b7b50d7f950a9e0e8

  • \??\Volume{06969d78-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{eea36801-4a45-4fe3-8c23-1535b5ccf54b}_OnDiskSnapshotProp

    Filesize

    5KB

    MD5

    b6291153a39c5656187561f775a6f10b

    SHA1

    923310131b2756dffb9b5a084847fd659dccbbdd

    SHA256

    40b16d15573f4c7d8757f59d7a526dca61ed79da350ef8641a79fea040876187

    SHA512

    782d7bc3d338994aeb7c3261ab6131320fca96196d01d4da132d20722355a948dbef876773e980a76744128128f9f32f4e3ab57a1cb831b3f258f22adf415d0b

  • memory/1924-135-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1924-138-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1924-143-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB