Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2023, 22:21

General

  • Target

    1.msi

  • Size

    680KB

  • MD5

    3035101d044a4425dbd5a523ace428c3

  • SHA1

    f08ecf54bb93077fc32cef5f6915ce569e38bed1

  • SHA256

    f4de4f89d51790fbcc5e69d1daec304ac0433179973bfcb1828c8691a0dc5e84

  • SHA512

    d60db29c92f219c9f69debc1ad1c50cf74b858c2e9e2bd4ed00f2bb6e1e9c8bbf7e9240ec11cc7e46cafc2a0651a462f2c6c1c42824b913bedf747a1b1dae9d0

  • SSDEEP

    12288:z6hgTBOyy3AhX+JP4OduQDNZ4hxUxBjcyHnUaK6BpefgRY1bHzv7F/EfO:W+dIu+zduQDD4hxUYy0Z6B4flbHLtEW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1520
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Software Installer\Setup.exe
      "C:\Users\Admin\AppData\Local\Software Installer\Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:2532
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2112
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004B4" "0000000000000554"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f77315f.rbs

    Filesize

    7KB

    MD5

    9334f526426dcca215f2cc315c60cd61

    SHA1

    0f7304543c5b93c1f17040d59154c3112b17e2b6

    SHA256

    02d24bda8b0a4a63426bf4f8ace688b32757ea879a15a6fd3fd325add4268f46

    SHA512

    b54dcd794745fadf359722944c8b8cc3eaf7a97a820bdca435d884efba67abbb756b519d69f7b409c5ae5ba8e20e3a35b20a6d42ce85009c4d1edcb4ce8a8453

  • C:\Users\Admin\AppData\Local\Software Installer\Setup.exe

    Filesize

    371KB

    MD5

    2cfed8e9b117e80c7645c40e6dc0abc9

    SHA1

    cea302664bdd9f01473ca25d0863f926a74bca42

    SHA256

    260bac5419a77db5138a3da5140e86c679d001baccbcde4b626c139ee2c4e0ee

    SHA512

    88a21294d04284bd09a0237edc1df95c086dc5c19bcbfe0e4c4ebce030634ee0946f41eeb3e6a7ab7caf07eb863aff5b61de5440c1ab512a36ecf85323b302d1

  • C:\Users\Admin\AppData\Local\Software Installer\Setup.exe

    Filesize

    371KB

    MD5

    2cfed8e9b117e80c7645c40e6dc0abc9

    SHA1

    cea302664bdd9f01473ca25d0863f926a74bca42

    SHA256

    260bac5419a77db5138a3da5140e86c679d001baccbcde4b626c139ee2c4e0ee

    SHA512

    88a21294d04284bd09a0237edc1df95c086dc5c19bcbfe0e4c4ebce030634ee0946f41eeb3e6a7ab7caf07eb863aff5b61de5440c1ab512a36ecf85323b302d1

  • C:\Windows\Installer\f77315d.msi

    Filesize

    680KB

    MD5

    3035101d044a4425dbd5a523ace428c3

    SHA1

    f08ecf54bb93077fc32cef5f6915ce569e38bed1

    SHA256

    f4de4f89d51790fbcc5e69d1daec304ac0433179973bfcb1828c8691a0dc5e84

    SHA512

    d60db29c92f219c9f69debc1ad1c50cf74b858c2e9e2bd4ed00f2bb6e1e9c8bbf7e9240ec11cc7e46cafc2a0651a462f2c6c1c42824b913bedf747a1b1dae9d0