Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2023, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
AgentRansack_867.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
AgentRansack_867.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
AgentRansack_867.exe
-
Size
14.9MB
-
MD5
7747481db9322b854024f98d43f57e2e
-
SHA1
6af2115b473fde77a9dc958de4ff730eb25810ea
-
SHA256
c5f5524e60adcb5019b33b07892da0a24822f5b85dfdc0419b256aee802f5811
-
SHA512
b98be6fd4189133ff7bb74a86e751aebb62b67aa1f47b74ea73f116a44df42790709292928abef8b0666e4cff1e8a64e5b089818c413faed23cb73f173fa9587
-
SSDEEP
393216:imhHKnM/cj1E1xXnc4g4wbsgz7hi+qyrU01EwZ9FDycyVWdhZ+:lInM/waxXaBI+9i+qP0i2hy3VUhw
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 20 4408 msiexec.exe 44 4408 msiexec.exe 47 4408 msiexec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Loads dropped DLL 3 IoCs
pid Process 4664 AgentRansack_867.exe 2768 MsiExec.exe 2768 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4408 msiexec.exe Token: SeIncreaseQuotaPrivilege 4408 msiexec.exe Token: SeSecurityPrivilege 3660 msiexec.exe Token: SeCreateTokenPrivilege 4408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4408 msiexec.exe Token: SeLockMemoryPrivilege 4408 msiexec.exe Token: SeIncreaseQuotaPrivilege 4408 msiexec.exe Token: SeMachineAccountPrivilege 4408 msiexec.exe Token: SeTcbPrivilege 4408 msiexec.exe Token: SeSecurityPrivilege 4408 msiexec.exe Token: SeTakeOwnershipPrivilege 4408 msiexec.exe Token: SeLoadDriverPrivilege 4408 msiexec.exe Token: SeSystemProfilePrivilege 4408 msiexec.exe Token: SeSystemtimePrivilege 4408 msiexec.exe Token: SeProfSingleProcessPrivilege 4408 msiexec.exe Token: SeIncBasePriorityPrivilege 4408 msiexec.exe Token: SeCreatePagefilePrivilege 4408 msiexec.exe Token: SeCreatePermanentPrivilege 4408 msiexec.exe Token: SeBackupPrivilege 4408 msiexec.exe Token: SeRestorePrivilege 4408 msiexec.exe Token: SeShutdownPrivilege 4408 msiexec.exe Token: SeDebugPrivilege 4408 msiexec.exe Token: SeAuditPrivilege 4408 msiexec.exe Token: SeSystemEnvironmentPrivilege 4408 msiexec.exe Token: SeChangeNotifyPrivilege 4408 msiexec.exe Token: SeRemoteShutdownPrivilege 4408 msiexec.exe Token: SeUndockPrivilege 4408 msiexec.exe Token: SeSyncAgentPrivilege 4408 msiexec.exe Token: SeEnableDelegationPrivilege 4408 msiexec.exe Token: SeManageVolumePrivilege 4408 msiexec.exe Token: SeImpersonatePrivilege 4408 msiexec.exe Token: SeCreateGlobalPrivilege 4408 msiexec.exe Token: SeCreateTokenPrivilege 4408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4408 msiexec.exe Token: SeLockMemoryPrivilege 4408 msiexec.exe Token: SeIncreaseQuotaPrivilege 4408 msiexec.exe Token: SeMachineAccountPrivilege 4408 msiexec.exe Token: SeTcbPrivilege 4408 msiexec.exe Token: SeSecurityPrivilege 4408 msiexec.exe Token: SeTakeOwnershipPrivilege 4408 msiexec.exe Token: SeLoadDriverPrivilege 4408 msiexec.exe Token: SeSystemProfilePrivilege 4408 msiexec.exe Token: SeSystemtimePrivilege 4408 msiexec.exe Token: SeProfSingleProcessPrivilege 4408 msiexec.exe Token: SeIncBasePriorityPrivilege 4408 msiexec.exe Token: SeCreatePagefilePrivilege 4408 msiexec.exe Token: SeCreatePermanentPrivilege 4408 msiexec.exe Token: SeBackupPrivilege 4408 msiexec.exe Token: SeRestorePrivilege 4408 msiexec.exe Token: SeShutdownPrivilege 4408 msiexec.exe Token: SeDebugPrivilege 4408 msiexec.exe Token: SeAuditPrivilege 4408 msiexec.exe Token: SeSystemEnvironmentPrivilege 4408 msiexec.exe Token: SeChangeNotifyPrivilege 4408 msiexec.exe Token: SeRemoteShutdownPrivilege 4408 msiexec.exe Token: SeUndockPrivilege 4408 msiexec.exe Token: SeSyncAgentPrivilege 4408 msiexec.exe Token: SeEnableDelegationPrivilege 4408 msiexec.exe Token: SeManageVolumePrivilege 4408 msiexec.exe Token: SeImpersonatePrivilege 4408 msiexec.exe Token: SeCreateGlobalPrivilege 4408 msiexec.exe Token: SeCreateTokenPrivilege 4408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4408 msiexec.exe Token: SeLockMemoryPrivilege 4408 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4408 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4664 wrote to memory of 4408 4664 AgentRansack_867.exe 84 PID 4664 wrote to memory of 4408 4664 AgentRansack_867.exe 84 PID 4664 wrote to memory of 4408 4664 AgentRansack_867.exe 84 PID 3660 wrote to memory of 2768 3660 msiexec.exe 93 PID 3660 wrote to memory of 2768 3660 msiexec.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\AgentRansack_867.exe"C:\Users\Admin\AppData\Local\Temp\AgentRansack_867.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\Mythicsoft\AgentRansack_8.0.867.1\install64.msi" REG_DETAILS="TRIAL" WixComponentInstaller="3537D0AD-610D-4F0F-A9EA-428EC46C2121"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4408
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 30A05F92C1350372E4C8FEE177E63616 C2⤵
- Loads dropped DLL
PID:2768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5a39c970952f0135eebb686a9e186ed16
SHA1286417153c3a6be222ce8b157e2377f3fe1caad0
SHA2560c6da3d456bd374d20b92b267adac25ca2bb6a36b2c7af101ef6e251931b6ea2
SHA512867d8f3c9a53a45a1c146e353660212f2f29f9e5d59b810eafb619e42c09d794420a4fca1966ec4160abb3ed2c764ee8a0c11797508dd9127486414f763aaa4f
-
Filesize
209KB
MD5a39c970952f0135eebb686a9e186ed16
SHA1286417153c3a6be222ce8b157e2377f3fe1caad0
SHA2560c6da3d456bd374d20b92b267adac25ca2bb6a36b2c7af101ef6e251931b6ea2
SHA512867d8f3c9a53a45a1c146e353660212f2f29f9e5d59b810eafb619e42c09d794420a4fca1966ec4160abb3ed2c764ee8a0c11797508dd9127486414f763aaa4f
-
Filesize
695KB
MD58967de8eb874da91ac1c9d316365a19c
SHA129534abd76437c8d7e1682ab3135f99eea70fff9
SHA256a021e2c26e7ca2a702df0d38febce1cafecc6f25cc25d973a40a53bbbc970151
SHA5123eb7a6f810a31f373bf3153257a5f474261605324ae4ff5fe2df826a4b3bb681cd5af7cab0f652195bf0bd800ecfcf9c6e64fe15416b05170215e805317f71b8
-
Filesize
695KB
MD58967de8eb874da91ac1c9d316365a19c
SHA129534abd76437c8d7e1682ab3135f99eea70fff9
SHA256a021e2c26e7ca2a702df0d38febce1cafecc6f25cc25d973a40a53bbbc970151
SHA5123eb7a6f810a31f373bf3153257a5f474261605324ae4ff5fe2df826a4b3bb681cd5af7cab0f652195bf0bd800ecfcf9c6e64fe15416b05170215e805317f71b8
-
Filesize
31.9MB
MD5b263a8130dc149814dd2d6c50b482ce4
SHA1e243c3c82e6acbe05d23752315d5783aa90bd04c
SHA256804ed479b2fefaec17a5d4a6196fcbf64e663aa84d3273fac13f2922e42dd08f
SHA51222dc4242d127b7add3eed603c1c6b22d880199c169576ab41362ad512f231c02799194cda77f867e7e9e924580446288ae572cffc253a8243fe416feae9ef593
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9