Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/06/2023, 17:49

230630-wd8g5seb76 8

30/06/2023, 17:45

230630-wbqvbaeb69 8

29/06/2023, 17:53

230629-wgaqaaed89 8

Analysis

  • max time kernel
    113s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    30/06/2023, 17:45

General

  • Target

    formularioimprimibleCLE.msi

  • Size

    6.3MB

  • MD5

    043dfa1567871c033c9514b544c7fef2

  • SHA1

    97c9f86276885dcecc0e8108ebe4feef0a231518

  • SHA256

    55ec807f6f52f3145fc046e64bcf4fa42ed595f10214f22025c07f7c900f3e4b

  • SHA512

    a86ec480977715b8969d0b11c354acb7694526615006af9e5b1946997905464f0657cca614698cebcc6d7f5b866d6cb1c2220c2385c1bbbd9284f92c9c03d72e

  • SSDEEP

    196608:u29Ik7oVQ2CAmYcA13ikoGhE4qLSupNxfTC:u2SMJ25mVA1xvzuLM

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\formularioimprimibleCLE.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4880
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4317B232CED637B432A3B15978B740B6
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1080
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    PID:3416

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI7592.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI7592.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI77F5.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI77F5.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI7892.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI7892.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI7892.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI78E1.tmp

    Filesize

    860KB

    MD5

    71b541254864bd52f85e932e2040cbe8

    SHA1

    713766e1818f8d7ca814c86109c9cdd5d57914ef

    SHA256

    b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538

    SHA512

    4d2e0a30fd6729eb40fad358795db152327b0441da574052a371762f33c9f9e7b9a77c4a4762207bcb401a2d3ef6438730c245916f4a81cd20f748857d5170d2

  • C:\Windows\Installer\MSI78E1.tmp

    Filesize

    860KB

    MD5

    71b541254864bd52f85e932e2040cbe8

    SHA1

    713766e1818f8d7ca814c86109c9cdd5d57914ef

    SHA256

    b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538

    SHA512

    4d2e0a30fd6729eb40fad358795db152327b0441da574052a371762f33c9f9e7b9a77c4a4762207bcb401a2d3ef6438730c245916f4a81cd20f748857d5170d2

  • C:\Windows\Installer\MSI7F7A.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI7F7A.tmp

    Filesize

    376KB

    MD5

    e12c5bcc254c953b1a46d1434804f4d2

    SHA1

    99f67acf34af1294f3c6e5eb521c862e1c772397

    SHA256

    5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

    SHA512

    9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

  • C:\Windows\Installer\MSI80C4.tmp

    Filesize

    4.9MB

    MD5

    092eca934d678084a26cd40a4d3c820e

    SHA1

    a3a3f338429b2621bf02dde24f931925b522cc9d

    SHA256

    d35e11b78d14db8c976c7a800f4c2caf092f63b1ea0c29742564317c28701cbf

    SHA512

    98002b475a798883263b0c2ae81cd893d77c8272dd16a9ecda99bd8d68f221a77950bf65e1322c665bbec6ed035639c2365f943d5f918a62c5ef7664ae1d70ba

  • C:\Windows\Installer\MSI80C4.tmp

    Filesize

    4.9MB

    MD5

    092eca934d678084a26cd40a4d3c820e

    SHA1

    a3a3f338429b2621bf02dde24f931925b522cc9d

    SHA256

    d35e11b78d14db8c976c7a800f4c2caf092f63b1ea0c29742564317c28701cbf

    SHA512

    98002b475a798883263b0c2ae81cd893d77c8272dd16a9ecda99bd8d68f221a77950bf65e1322c665bbec6ed035639c2365f943d5f918a62c5ef7664ae1d70ba

  • C:\Windows\Installer\MSI80C4.tmp

    Filesize

    4.9MB

    MD5

    092eca934d678084a26cd40a4d3c820e

    SHA1

    a3a3f338429b2621bf02dde24f931925b522cc9d

    SHA256

    d35e11b78d14db8c976c7a800f4c2caf092f63b1ea0c29742564317c28701cbf

    SHA512

    98002b475a798883263b0c2ae81cd893d77c8272dd16a9ecda99bd8d68f221a77950bf65e1322c665bbec6ed035639c2365f943d5f918a62c5ef7664ae1d70ba

  • memory/1080-160-0x00000000033B0000-0x0000000003F3E000-memory.dmp

    Filesize

    11.6MB

  • memory/1080-161-0x0000000003380000-0x0000000003381000-memory.dmp

    Filesize

    4KB

  • memory/1080-162-0x0000000003F40000-0x0000000003F41000-memory.dmp

    Filesize

    4KB

  • memory/1080-163-0x0000000003F50000-0x0000000003F51000-memory.dmp

    Filesize

    4KB

  • memory/1080-164-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/1080-165-0x0000000004090000-0x0000000004091000-memory.dmp

    Filesize

    4KB

  • memory/1080-166-0x00000000040A0000-0x00000000040A1000-memory.dmp

    Filesize

    4KB

  • memory/1080-167-0x00000000040B0000-0x00000000040B1000-memory.dmp

    Filesize

    4KB

  • memory/1080-168-0x00000000033B0000-0x0000000003F3E000-memory.dmp

    Filesize

    11.6MB

  • memory/1080-170-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB

  • memory/1080-178-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB