Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/03/2023, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
AESCrypt.msi
Resource
win10-20230220-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
AESCrypt.msi
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral3
Sample
AESCrypt.msi
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
AESCrypt.msi
-
Size
1.2MB
-
MD5
e738da4ddde4ec6a45f0e5e64acc99aa
-
SHA1
bd7d7aab63690429eda5d715d7199fa1ea658fea
-
SHA256
aa96e7facf48235b091b01453ae6290860b1ff28889026e72936172875efe70c
-
SHA512
1bf3191ebca190d28750ba59aa0bb93d0006b8804c377764e7b6358acfdfcc6ea3676d3fd4033c2bb0dd0eb69ec35dc010ba761c3cf91f85d1a3ea765d1a854b
-
SSDEEP
24576:wzmzCXj/uGPBc6ba10EW5SfNP7FVHWw6YJXnqCGoHCX2Fa:wzmzCDuUBo0EWgFjFVH7fFa
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 852 MsiExec.exe 852 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1712 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1712 msiexec.exe Token: SeIncreaseQuotaPrivilege 1712 msiexec.exe Token: SeRestorePrivilege 1740 msiexec.exe Token: SeTakeOwnershipPrivilege 1740 msiexec.exe Token: SeSecurityPrivilege 1740 msiexec.exe Token: SeCreateTokenPrivilege 1712 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1712 msiexec.exe Token: SeLockMemoryPrivilege 1712 msiexec.exe Token: SeIncreaseQuotaPrivilege 1712 msiexec.exe Token: SeMachineAccountPrivilege 1712 msiexec.exe Token: SeTcbPrivilege 1712 msiexec.exe Token: SeSecurityPrivilege 1712 msiexec.exe Token: SeTakeOwnershipPrivilege 1712 msiexec.exe Token: SeLoadDriverPrivilege 1712 msiexec.exe Token: SeSystemProfilePrivilege 1712 msiexec.exe Token: SeSystemtimePrivilege 1712 msiexec.exe Token: SeProfSingleProcessPrivilege 1712 msiexec.exe Token: SeIncBasePriorityPrivilege 1712 msiexec.exe Token: SeCreatePagefilePrivilege 1712 msiexec.exe Token: SeCreatePermanentPrivilege 1712 msiexec.exe Token: SeBackupPrivilege 1712 msiexec.exe Token: SeRestorePrivilege 1712 msiexec.exe Token: SeShutdownPrivilege 1712 msiexec.exe Token: SeDebugPrivilege 1712 msiexec.exe Token: SeAuditPrivilege 1712 msiexec.exe Token: SeSystemEnvironmentPrivilege 1712 msiexec.exe Token: SeChangeNotifyPrivilege 1712 msiexec.exe Token: SeRemoteShutdownPrivilege 1712 msiexec.exe Token: SeUndockPrivilege 1712 msiexec.exe Token: SeSyncAgentPrivilege 1712 msiexec.exe Token: SeEnableDelegationPrivilege 1712 msiexec.exe Token: SeManageVolumePrivilege 1712 msiexec.exe Token: SeImpersonatePrivilege 1712 msiexec.exe Token: SeCreateGlobalPrivilege 1712 msiexec.exe Token: SeCreateTokenPrivilege 1712 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1712 msiexec.exe Token: SeLockMemoryPrivilege 1712 msiexec.exe Token: SeIncreaseQuotaPrivilege 1712 msiexec.exe Token: SeMachineAccountPrivilege 1712 msiexec.exe Token: SeTcbPrivilege 1712 msiexec.exe Token: SeSecurityPrivilege 1712 msiexec.exe Token: SeTakeOwnershipPrivilege 1712 msiexec.exe Token: SeLoadDriverPrivilege 1712 msiexec.exe Token: SeSystemProfilePrivilege 1712 msiexec.exe Token: SeSystemtimePrivilege 1712 msiexec.exe Token: SeProfSingleProcessPrivilege 1712 msiexec.exe Token: SeIncBasePriorityPrivilege 1712 msiexec.exe Token: SeCreatePagefilePrivilege 1712 msiexec.exe Token: SeCreatePermanentPrivilege 1712 msiexec.exe Token: SeBackupPrivilege 1712 msiexec.exe Token: SeRestorePrivilege 1712 msiexec.exe Token: SeShutdownPrivilege 1712 msiexec.exe Token: SeDebugPrivilege 1712 msiexec.exe Token: SeAuditPrivilege 1712 msiexec.exe Token: SeSystemEnvironmentPrivilege 1712 msiexec.exe Token: SeChangeNotifyPrivilege 1712 msiexec.exe Token: SeRemoteShutdownPrivilege 1712 msiexec.exe Token: SeUndockPrivilege 1712 msiexec.exe Token: SeSyncAgentPrivilege 1712 msiexec.exe Token: SeEnableDelegationPrivilege 1712 msiexec.exe Token: SeManageVolumePrivilege 1712 msiexec.exe Token: SeImpersonatePrivilege 1712 msiexec.exe Token: SeCreateGlobalPrivilege 1712 msiexec.exe Token: SeCreateTokenPrivilege 1712 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1740 wrote to memory of 852 1740 msiexec.exe 29 PID 1740 wrote to memory of 852 1740 msiexec.exe 29 PID 1740 wrote to memory of 852 1740 msiexec.exe 29 PID 1740 wrote to memory of 852 1740 msiexec.exe 29 PID 1740 wrote to memory of 852 1740 msiexec.exe 29 PID 1740 wrote to memory of 852 1740 msiexec.exe 29 PID 1740 wrote to memory of 852 1740 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AESCrypt.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1712
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1BFCF3E3D0E9F4A7ADD0A3DF495180A0 C2⤵
- Loads dropped DLL
PID:852
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613