Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/12/2022, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
Daniel 22Khz MLG voice.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Daniel 22Khz MLG voice.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Daniel 22Khz MLG voice.exe
-
Size
89.8MB
-
MD5
e482ebadb6bbf1f5d69bf6d1e6e12008
-
SHA1
0aee3d19ab94a3ca15f6406dcada0fbe5d281ad5
-
SHA256
d00f0f3177144d12e243e18c44690c3a6ac62923bc0344ecd6f69a729f4efdda
-
SHA512
f36f08f0625f40a53a8c5b4e3f9a77f8e873f9e8db84b6c2e8ba6febae503a7bb1546fb6e62cc9df67e205a00ea119b72ee72da1844a8ce125bec01ea45464ee
-
SSDEEP
1572864:FziL1l5ZNspxolotkEq1JIxsWGsZIodnFbA4lenCrpXzHL3fjacSsd7AzkbOMAr:FzixjIoEx+UnF+C5bIQ6p
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Downloaded Installations\{952F792A-172C-4F2F-88F7-C002F916C583}\NextUp-ScanSoft Daniel British Voice.msi Daniel 22Khz MLG voice.exe File created C:\Windows\Downloaded Installations\{952F792A-172C-4F2F-88F7-C002F916C583}\NextUp-ScanSoft Daniel British Voice.msi Daniel 22Khz MLG voice.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 916 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 916 MSIEXEC.EXE Token: SeRestorePrivilege 1468 msiexec.exe Token: SeTakeOwnershipPrivilege 1468 msiexec.exe Token: SeSecurityPrivilege 1468 msiexec.exe Token: SeCreateTokenPrivilege 916 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 916 MSIEXEC.EXE Token: SeLockMemoryPrivilege 916 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 916 MSIEXEC.EXE Token: SeMachineAccountPrivilege 916 MSIEXEC.EXE Token: SeTcbPrivilege 916 MSIEXEC.EXE Token: SeSecurityPrivilege 916 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 916 MSIEXEC.EXE Token: SeLoadDriverPrivilege 916 MSIEXEC.EXE Token: SeSystemProfilePrivilege 916 MSIEXEC.EXE Token: SeSystemtimePrivilege 916 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 916 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 916 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 916 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 916 MSIEXEC.EXE Token: SeBackupPrivilege 916 MSIEXEC.EXE Token: SeRestorePrivilege 916 MSIEXEC.EXE Token: SeShutdownPrivilege 916 MSIEXEC.EXE Token: SeDebugPrivilege 916 MSIEXEC.EXE Token: SeAuditPrivilege 916 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 916 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 916 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 916 MSIEXEC.EXE Token: SeUndockPrivilege 916 MSIEXEC.EXE Token: SeSyncAgentPrivilege 916 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 916 MSIEXEC.EXE Token: SeManageVolumePrivilege 916 MSIEXEC.EXE Token: SeImpersonatePrivilege 916 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 916 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 916 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27 PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27 PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27 PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27 PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27 PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27 PID 992 wrote to memory of 916 992 Daniel 22Khz MLG voice.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Daniel 22Khz MLG voice.exe"C:\Users\Admin\AppData\Local\Temp\Daniel 22Khz MLG voice.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Windows\Downloaded Installations\{952F792A-172C-4F2F-88F7-C002F916C583}\NextUp-ScanSoft Daniel British Voice.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:916
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Downloaded Installations\{952F792A-172C-4F2F-88F7-C002F916C583}\NextUp-ScanSoft Daniel British Voice.msi
Filesize86.2MB
MD510234110938540fce092cc515e1e1982
SHA1900826136a7cb68e44accc650d2eaf563bc03329
SHA256c8a22e33bcf6c12b75fe18a5651207c6f462c03bd5ceab56380c9e3b7b9974c9
SHA512764b9aecfb892e2ae18bcb95ccdbefbe5cea0e4d20a969729695e495c99d08711f79ed1b16b8b59d983f7cf486597af121307eda7fcde31a74f65899f7463667