Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/06/2023, 17:49

230630-wd8g5seb76 8

30/06/2023, 17:45

230630-wbqvbaeb69 8

29/06/2023, 17:53

230629-wgaqaaed89 8

Analysis

  • max time kernel
    56s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230621-es
  • resource tags

    arch:x64arch:x86image:win7-20230621-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    29/06/2023, 17:53

General

  • Target

    formularioimprimibleCLE.msi

  • Size

    6.3MB

  • MD5

    043dfa1567871c033c9514b544c7fef2

  • SHA1

    97c9f86276885dcecc0e8108ebe4feef0a231518

  • SHA256

    55ec807f6f52f3145fc046e64bcf4fa42ed595f10214f22025c07f7c900f3e4b

  • SHA512

    a86ec480977715b8969d0b11c354acb7694526615006af9e5b1946997905464f0657cca614698cebcc6d7f5b866d6cb1c2220c2385c1bbbd9284f92c9c03d72e

  • SSDEEP

    196608:u29Ik7oVQ2CAmYcA13ikoGhE4qLSupNxfTC:u2SMJ25mVA1xvzuLM

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\formularioimprimibleCLE.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:884
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A8815763A785856E9159154DC251E129
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1068

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6295c2b023efa2c10e288880b04b9bfd

    SHA1

    d938276ca10f28c1744beeebc4d8637d1dc30004

    SHA256

    121e442289a95fa331c9c9df140107853e448487920562ed5b6952cbbcf58db2

    SHA512

    87d4b44386f9df43ad82c89a49f1def0473a1fffdcc2b21f31bcb29e0c96269f84dc7524e2ee21146d77cb39a5cfe7ff6b61cac0f36b8be7b843b3e014d4fe8d

  • C:\Users\Admin\AppData\Local\Temp\CabFF68.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\TarFFB9.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Windows\Installer\MSIAE4A.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSIB444.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSIB510.tmp

    Filesize

    860KB

    MD5

    71b541254864bd52f85e932e2040cbe8

    SHA1

    713766e1818f8d7ca814c86109c9cdd5d57914ef

    SHA256

    b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538

    SHA512

    4d2e0a30fd6729eb40fad358795db152327b0441da574052a371762f33c9f9e7b9a77c4a4762207bcb401a2d3ef6438730c245916f4a81cd20f748857d5170d2

  • C:\Windows\Installer\MSIB81D.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSIB81D.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSIBD3D.tmp

    Filesize

    4.9MB

    MD5

    092eca934d678084a26cd40a4d3c820e

    SHA1

    a3a3f338429b2621bf02dde24f931925b522cc9d

    SHA256

    d35e11b78d14db8c976c7a800f4c2caf092f63b1ea0c29742564317c28701cbf

    SHA512

    98002b475a798883263b0c2ae81cd893d77c8272dd16a9ecda99bd8d68f221a77950bf65e1322c665bbec6ed035639c2365f943d5f918a62c5ef7664ae1d70ba

  • \Windows\Installer\MSIAE4A.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • \Windows\Installer\MSIB444.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • \Windows\Installer\MSIB510.tmp

    Filesize

    860KB

    MD5

    71b541254864bd52f85e932e2040cbe8

    SHA1

    713766e1818f8d7ca814c86109c9cdd5d57914ef

    SHA256

    b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538

    SHA512

    4d2e0a30fd6729eb40fad358795db152327b0441da574052a371762f33c9f9e7b9a77c4a4762207bcb401a2d3ef6438730c245916f4a81cd20f748857d5170d2

  • \Windows\Installer\MSIB81D.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • \Windows\Installer\MSIBD3D.tmp

    Filesize

    4.9MB

    MD5

    092eca934d678084a26cd40a4d3c820e

    SHA1

    a3a3f338429b2621bf02dde24f931925b522cc9d

    SHA256

    d35e11b78d14db8c976c7a800f4c2caf092f63b1ea0c29742564317c28701cbf

    SHA512

    98002b475a798883263b0c2ae81cd893d77c8272dd16a9ecda99bd8d68f221a77950bf65e1322c665bbec6ed035639c2365f943d5f918a62c5ef7664ae1d70ba

  • memory/1068-80-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1068-92-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1068-78-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/1068-81-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1068-82-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1068-83-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1068-84-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1068-86-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1068-87-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1068-89-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1068-90-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1068-79-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1068-93-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1068-95-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/1068-96-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/1068-97-0x0000000002760000-0x00000000032EE000-memory.dmp

    Filesize

    11.6MB

  • memory/1068-99-0x0000000000350000-0x0000000000351000-memory.dmp

    Filesize

    4KB

  • memory/1068-77-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/1068-76-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/1068-75-0x0000000002760000-0x00000000032EE000-memory.dmp

    Filesize

    11.6MB

  • memory/1068-178-0x0000000000350000-0x0000000000351000-memory.dmp

    Filesize

    4KB