Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/03/2023, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
AESCrypt.msi
Resource
win10-20230220-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
AESCrypt.msi
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral3
Sample
AESCrypt.msi
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
AESCrypt.msi
-
Size
1.2MB
-
MD5
e738da4ddde4ec6a45f0e5e64acc99aa
-
SHA1
bd7d7aab63690429eda5d715d7199fa1ea658fea
-
SHA256
aa96e7facf48235b091b01453ae6290860b1ff28889026e72936172875efe70c
-
SHA512
1bf3191ebca190d28750ba59aa0bb93d0006b8804c377764e7b6358acfdfcc6ea3676d3fd4033c2bb0dd0eb69ec35dc010ba761c3cf91f85d1a3ea765d1a854b
-
SSDEEP
24576:wzmzCXj/uGPBc6ba10EW5SfNP7FVHWw6YJXnqCGoHCX2Fa:wzmzCDuUBo0EWgFjFVH7fFa
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4324 MsiExec.exe 4324 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2452 msiexec.exe Token: SeIncreaseQuotaPrivilege 2452 msiexec.exe Token: SeSecurityPrivilege 2908 msiexec.exe Token: SeCreateTokenPrivilege 2452 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2452 msiexec.exe Token: SeLockMemoryPrivilege 2452 msiexec.exe Token: SeIncreaseQuotaPrivilege 2452 msiexec.exe Token: SeMachineAccountPrivilege 2452 msiexec.exe Token: SeTcbPrivilege 2452 msiexec.exe Token: SeSecurityPrivilege 2452 msiexec.exe Token: SeTakeOwnershipPrivilege 2452 msiexec.exe Token: SeLoadDriverPrivilege 2452 msiexec.exe Token: SeSystemProfilePrivilege 2452 msiexec.exe Token: SeSystemtimePrivilege 2452 msiexec.exe Token: SeProfSingleProcessPrivilege 2452 msiexec.exe Token: SeIncBasePriorityPrivilege 2452 msiexec.exe Token: SeCreatePagefilePrivilege 2452 msiexec.exe Token: SeCreatePermanentPrivilege 2452 msiexec.exe Token: SeBackupPrivilege 2452 msiexec.exe Token: SeRestorePrivilege 2452 msiexec.exe Token: SeShutdownPrivilege 2452 msiexec.exe Token: SeDebugPrivilege 2452 msiexec.exe Token: SeAuditPrivilege 2452 msiexec.exe Token: SeSystemEnvironmentPrivilege 2452 msiexec.exe Token: SeChangeNotifyPrivilege 2452 msiexec.exe Token: SeRemoteShutdownPrivilege 2452 msiexec.exe Token: SeUndockPrivilege 2452 msiexec.exe Token: SeSyncAgentPrivilege 2452 msiexec.exe Token: SeEnableDelegationPrivilege 2452 msiexec.exe Token: SeManageVolumePrivilege 2452 msiexec.exe Token: SeImpersonatePrivilege 2452 msiexec.exe Token: SeCreateGlobalPrivilege 2452 msiexec.exe Token: SeCreateTokenPrivilege 2452 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2452 msiexec.exe Token: SeLockMemoryPrivilege 2452 msiexec.exe Token: SeIncreaseQuotaPrivilege 2452 msiexec.exe Token: SeMachineAccountPrivilege 2452 msiexec.exe Token: SeTcbPrivilege 2452 msiexec.exe Token: SeSecurityPrivilege 2452 msiexec.exe Token: SeTakeOwnershipPrivilege 2452 msiexec.exe Token: SeLoadDriverPrivilege 2452 msiexec.exe Token: SeSystemProfilePrivilege 2452 msiexec.exe Token: SeSystemtimePrivilege 2452 msiexec.exe Token: SeProfSingleProcessPrivilege 2452 msiexec.exe Token: SeIncBasePriorityPrivilege 2452 msiexec.exe Token: SeCreatePagefilePrivilege 2452 msiexec.exe Token: SeCreatePermanentPrivilege 2452 msiexec.exe Token: SeBackupPrivilege 2452 msiexec.exe Token: SeRestorePrivilege 2452 msiexec.exe Token: SeShutdownPrivilege 2452 msiexec.exe Token: SeDebugPrivilege 2452 msiexec.exe Token: SeAuditPrivilege 2452 msiexec.exe Token: SeSystemEnvironmentPrivilege 2452 msiexec.exe Token: SeChangeNotifyPrivilege 2452 msiexec.exe Token: SeRemoteShutdownPrivilege 2452 msiexec.exe Token: SeUndockPrivilege 2452 msiexec.exe Token: SeSyncAgentPrivilege 2452 msiexec.exe Token: SeEnableDelegationPrivilege 2452 msiexec.exe Token: SeManageVolumePrivilege 2452 msiexec.exe Token: SeImpersonatePrivilege 2452 msiexec.exe Token: SeCreateGlobalPrivilege 2452 msiexec.exe Token: SeCreateTokenPrivilege 2452 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2452 msiexec.exe Token: SeLockMemoryPrivilege 2452 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2452 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2908 wrote to memory of 4324 2908 msiexec.exe 68 PID 2908 wrote to memory of 4324 2908 msiexec.exe 68 PID 2908 wrote to memory of 4324 2908 msiexec.exe 68
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AESCrypt.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2452
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 146E98A074B96D602587141941D7C9C2 C2⤵
- Loads dropped DLL
PID:4324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613