Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2023, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
AESCrypt.msi
Resource
win10-20230220-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
AESCrypt.msi
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral3
Sample
AESCrypt.msi
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
AESCrypt.msi
-
Size
1.2MB
-
MD5
e738da4ddde4ec6a45f0e5e64acc99aa
-
SHA1
bd7d7aab63690429eda5d715d7199fa1ea658fea
-
SHA256
aa96e7facf48235b091b01453ae6290860b1ff28889026e72936172875efe70c
-
SHA512
1bf3191ebca190d28750ba59aa0bb93d0006b8804c377764e7b6358acfdfcc6ea3676d3fd4033c2bb0dd0eb69ec35dc010ba761c3cf91f85d1a3ea765d1a854b
-
SSDEEP
24576:wzmzCXj/uGPBc6ba10EW5SfNP7FVHWw6YJXnqCGoHCX2Fa:wzmzCDuUBo0EWgFjFVH7fFa
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 3464 MsiExec.exe 3464 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3932 msiexec.exe Token: SeIncreaseQuotaPrivilege 3932 msiexec.exe Token: SeSecurityPrivilege 1644 msiexec.exe Token: SeCreateTokenPrivilege 3932 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3932 msiexec.exe Token: SeLockMemoryPrivilege 3932 msiexec.exe Token: SeIncreaseQuotaPrivilege 3932 msiexec.exe Token: SeMachineAccountPrivilege 3932 msiexec.exe Token: SeTcbPrivilege 3932 msiexec.exe Token: SeSecurityPrivilege 3932 msiexec.exe Token: SeTakeOwnershipPrivilege 3932 msiexec.exe Token: SeLoadDriverPrivilege 3932 msiexec.exe Token: SeSystemProfilePrivilege 3932 msiexec.exe Token: SeSystemtimePrivilege 3932 msiexec.exe Token: SeProfSingleProcessPrivilege 3932 msiexec.exe Token: SeIncBasePriorityPrivilege 3932 msiexec.exe Token: SeCreatePagefilePrivilege 3932 msiexec.exe Token: SeCreatePermanentPrivilege 3932 msiexec.exe Token: SeBackupPrivilege 3932 msiexec.exe Token: SeRestorePrivilege 3932 msiexec.exe Token: SeShutdownPrivilege 3932 msiexec.exe Token: SeDebugPrivilege 3932 msiexec.exe Token: SeAuditPrivilege 3932 msiexec.exe Token: SeSystemEnvironmentPrivilege 3932 msiexec.exe Token: SeChangeNotifyPrivilege 3932 msiexec.exe Token: SeRemoteShutdownPrivilege 3932 msiexec.exe Token: SeUndockPrivilege 3932 msiexec.exe Token: SeSyncAgentPrivilege 3932 msiexec.exe Token: SeEnableDelegationPrivilege 3932 msiexec.exe Token: SeManageVolumePrivilege 3932 msiexec.exe Token: SeImpersonatePrivilege 3932 msiexec.exe Token: SeCreateGlobalPrivilege 3932 msiexec.exe Token: SeCreateTokenPrivilege 3932 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3932 msiexec.exe Token: SeLockMemoryPrivilege 3932 msiexec.exe Token: SeIncreaseQuotaPrivilege 3932 msiexec.exe Token: SeMachineAccountPrivilege 3932 msiexec.exe Token: SeTcbPrivilege 3932 msiexec.exe Token: SeSecurityPrivilege 3932 msiexec.exe Token: SeTakeOwnershipPrivilege 3932 msiexec.exe Token: SeLoadDriverPrivilege 3932 msiexec.exe Token: SeSystemProfilePrivilege 3932 msiexec.exe Token: SeSystemtimePrivilege 3932 msiexec.exe Token: SeProfSingleProcessPrivilege 3932 msiexec.exe Token: SeIncBasePriorityPrivilege 3932 msiexec.exe Token: SeCreatePagefilePrivilege 3932 msiexec.exe Token: SeCreatePermanentPrivilege 3932 msiexec.exe Token: SeBackupPrivilege 3932 msiexec.exe Token: SeRestorePrivilege 3932 msiexec.exe Token: SeShutdownPrivilege 3932 msiexec.exe Token: SeDebugPrivilege 3932 msiexec.exe Token: SeAuditPrivilege 3932 msiexec.exe Token: SeSystemEnvironmentPrivilege 3932 msiexec.exe Token: SeChangeNotifyPrivilege 3932 msiexec.exe Token: SeRemoteShutdownPrivilege 3932 msiexec.exe Token: SeUndockPrivilege 3932 msiexec.exe Token: SeSyncAgentPrivilege 3932 msiexec.exe Token: SeEnableDelegationPrivilege 3932 msiexec.exe Token: SeManageVolumePrivilege 3932 msiexec.exe Token: SeImpersonatePrivilege 3932 msiexec.exe Token: SeCreateGlobalPrivilege 3932 msiexec.exe Token: SeCreateTokenPrivilege 3932 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3932 msiexec.exe Token: SeLockMemoryPrivilege 3932 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3932 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1644 wrote to memory of 3464 1644 msiexec.exe 88 PID 1644 wrote to memory of 3464 1644 msiexec.exe 88 PID 1644 wrote to memory of 3464 1644 msiexec.exe 88
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AESCrypt.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3932
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 007AE522384C1FE74B7F9EA3DB8D0F91 C2⤵
- Loads dropped DLL
PID:3464
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613