Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/08/2023, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
09d89325fea203e24ccfe7a1e4673b28.msi
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
09d89325fea203e24ccfe7a1e4673b28.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
09d89325fea203e24ccfe7a1e4673b28.msi
-
Size
4.6MB
-
MD5
09d89325fea203e24ccfe7a1e4673b28
-
SHA1
e1c9506ab408d8382d6a492674407e1cb83fc3d1
-
SHA256
95e44a84cfd99fb8ed47f7920c3ee26255fd22ce68193564e269c45685a0175e
-
SHA512
8dcc9beef4ae9d1353fda3b245583097768b42ecb6241fd6a9a1fedb7c0829bdcdd3a401c0fc04fc567ea766143edac49e7b02dce08eae0070a63f409be2ea5e
-
SSDEEP
98304:3Yyhdw1kVyTO9kVcE6ZtzETU94run89FA5eRg2RCia/SxDWfTl:/6qVTyaE6ZtATUyIcweRg2RCi2SxDgTl
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 1700 msiexec.exe 5 1700 msiexec.exe 7 1700 msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 3052 MsiExec.exe 3052 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1700 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1700 msiexec.exe Token: SeIncreaseQuotaPrivilege 1700 msiexec.exe Token: SeRestorePrivilege 2696 msiexec.exe Token: SeTakeOwnershipPrivilege 2696 msiexec.exe Token: SeSecurityPrivilege 2696 msiexec.exe Token: SeCreateTokenPrivilege 1700 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1700 msiexec.exe Token: SeLockMemoryPrivilege 1700 msiexec.exe Token: SeIncreaseQuotaPrivilege 1700 msiexec.exe Token: SeMachineAccountPrivilege 1700 msiexec.exe Token: SeTcbPrivilege 1700 msiexec.exe Token: SeSecurityPrivilege 1700 msiexec.exe Token: SeTakeOwnershipPrivilege 1700 msiexec.exe Token: SeLoadDriverPrivilege 1700 msiexec.exe Token: SeSystemProfilePrivilege 1700 msiexec.exe Token: SeSystemtimePrivilege 1700 msiexec.exe Token: SeProfSingleProcessPrivilege 1700 msiexec.exe Token: SeIncBasePriorityPrivilege 1700 msiexec.exe Token: SeCreatePagefilePrivilege 1700 msiexec.exe Token: SeCreatePermanentPrivilege 1700 msiexec.exe Token: SeBackupPrivilege 1700 msiexec.exe Token: SeRestorePrivilege 1700 msiexec.exe Token: SeShutdownPrivilege 1700 msiexec.exe Token: SeDebugPrivilege 1700 msiexec.exe Token: SeAuditPrivilege 1700 msiexec.exe Token: SeSystemEnvironmentPrivilege 1700 msiexec.exe Token: SeChangeNotifyPrivilege 1700 msiexec.exe Token: SeRemoteShutdownPrivilege 1700 msiexec.exe Token: SeUndockPrivilege 1700 msiexec.exe Token: SeSyncAgentPrivilege 1700 msiexec.exe Token: SeEnableDelegationPrivilege 1700 msiexec.exe Token: SeManageVolumePrivilege 1700 msiexec.exe Token: SeImpersonatePrivilege 1700 msiexec.exe Token: SeCreateGlobalPrivilege 1700 msiexec.exe Token: SeCreateTokenPrivilege 1700 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1700 msiexec.exe Token: SeLockMemoryPrivilege 1700 msiexec.exe Token: SeIncreaseQuotaPrivilege 1700 msiexec.exe Token: SeMachineAccountPrivilege 1700 msiexec.exe Token: SeTcbPrivilege 1700 msiexec.exe Token: SeSecurityPrivilege 1700 msiexec.exe Token: SeTakeOwnershipPrivilege 1700 msiexec.exe Token: SeLoadDriverPrivilege 1700 msiexec.exe Token: SeSystemProfilePrivilege 1700 msiexec.exe Token: SeSystemtimePrivilege 1700 msiexec.exe Token: SeProfSingleProcessPrivilege 1700 msiexec.exe Token: SeIncBasePriorityPrivilege 1700 msiexec.exe Token: SeCreatePagefilePrivilege 1700 msiexec.exe Token: SeCreatePermanentPrivilege 1700 msiexec.exe Token: SeBackupPrivilege 1700 msiexec.exe Token: SeRestorePrivilege 1700 msiexec.exe Token: SeShutdownPrivilege 1700 msiexec.exe Token: SeDebugPrivilege 1700 msiexec.exe Token: SeAuditPrivilege 1700 msiexec.exe Token: SeSystemEnvironmentPrivilege 1700 msiexec.exe Token: SeChangeNotifyPrivilege 1700 msiexec.exe Token: SeRemoteShutdownPrivilege 1700 msiexec.exe Token: SeUndockPrivilege 1700 msiexec.exe Token: SeSyncAgentPrivilege 1700 msiexec.exe Token: SeEnableDelegationPrivilege 1700 msiexec.exe Token: SeManageVolumePrivilege 1700 msiexec.exe Token: SeImpersonatePrivilege 1700 msiexec.exe Token: SeCreateGlobalPrivilege 1700 msiexec.exe Token: SeCreateTokenPrivilege 1700 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3052 2696 msiexec.exe 29 PID 2696 wrote to memory of 3052 2696 msiexec.exe 29 PID 2696 wrote to memory of 3052 2696 msiexec.exe 29 PID 2696 wrote to memory of 3052 2696 msiexec.exe 29 PID 2696 wrote to memory of 3052 2696 msiexec.exe 29 PID 2696 wrote to memory of 3052 2696 msiexec.exe 29 PID 2696 wrote to memory of 3052 2696 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\09d89325fea203e24ccfe7a1e4673b28.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1700
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71A8BB0542CF89817D33A7991CD759F3 C2⤵
- Loads dropped DLL
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
52KB
MD54a908ee9c6f2f4aad63382cccee731e4
SHA1e572580949f277987fe232757ce88c2ac35e0223
SHA256459f503fb8b4fc4a600261430ac77bf70118d41fa19f7b2620d43ba6e9c8fa5e
SHA51275ba5856df7ed1457b6192e3b12c5dbb9cd0c6860d787357b37d5e2aabdd1dddb1fd6195064cad1b166431a71dee233b76cb6304d8e868050d79c731ef6e567f
-
Filesize
84KB
MD5abb81f7897bb48a036686ccf840287ae
SHA1d6d648782584340bfa56c8e6d34fd70707af5d36
SHA2569dc871199cc9e96067a32401d225af50683ac14efaf35edc61aa45f346374494
SHA5124769d555b95ad593eae41e1cb91a9c7539b1c115b9b19a4954dec791f4d662388b459e3b7ad2964d5e0db4270406816582986d5a184bf55fd6c067906c2e0b25
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
52KB
MD54a908ee9c6f2f4aad63382cccee731e4
SHA1e572580949f277987fe232757ce88c2ac35e0223
SHA256459f503fb8b4fc4a600261430ac77bf70118d41fa19f7b2620d43ba6e9c8fa5e
SHA51275ba5856df7ed1457b6192e3b12c5dbb9cd0c6860d787357b37d5e2aabdd1dddb1fd6195064cad1b166431a71dee233b76cb6304d8e868050d79c731ef6e567f
-
Filesize
84KB
MD5abb81f7897bb48a036686ccf840287ae
SHA1d6d648782584340bfa56c8e6d34fd70707af5d36
SHA2569dc871199cc9e96067a32401d225af50683ac14efaf35edc61aa45f346374494
SHA5124769d555b95ad593eae41e1cb91a9c7539b1c115b9b19a4954dec791f4d662388b459e3b7ad2964d5e0db4270406816582986d5a184bf55fd6c067906c2e0b25