Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
29/08/2023, 03:24
General
-
Target
VMware-workstation-full-16.0.0-16894299.exe
-
Size
619.3MB
-
MD5
fcec2125fbaa98f51e17baa3fddb0be0
-
SHA1
29f7e060ed8bff4015ed137374734531d8fb2670
-
SHA256
be5c389c3907fbd2c8c29b38bd03d805d3bf8d486bc4711aef83e654a6a130c0
-
SHA512
da0fe098c37d75b71b516d31940600afc11b9757fd9cafed5ba79847037520dc0461e026d4bced5dbe277bbd6e1204e406b138425a198b13e90c7e272b78dbc2
-
SSDEEP
12582912:lHe+Il4ah7xm+vfi8UmkCvMDdITMD+mSbB1HZuOL+De04De0SUC:Ne+Il4E8mfi8LvMD8MD+mSbB1HcOiDeG
Malware Config
Signatures
-
Detect jar appended to MSI 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VMware-workstation-full-16.0.0-16894299.exe"C:\Users\Admin\AppData\Local\Temp\VMware-workstation-full-16.0.0-16894299.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{D51F496C-D02A-4AFA-AB43-F61B94462C9E}~setup\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\{D51F496C-D02A-4AFA-AB43-F61B94462C9E}~setup\vcredist_x86.exe" /Q /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{B2536206-8C95-4D5C-922C-74DEE2CB830F}\.cr\vcredist_x86.exe"C:\Windows\Temp\{B2536206-8C95-4D5C-922C-74DEE2CB830F}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{D51F496C-D02A-4AFA-AB43-F61B94462C9E}~setup\vcredist_x86.exe" -burn.filehandle.attached=536 -burn.filehandle.self=688 /Q /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\{D51F496C-D02A-4AFA-AB43-F61B94462C9E}~setup\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\{D51F496C-D02A-4AFA-AB43-F61B94462C9E}~setup\vcredist_x64.exe" /Q /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{740704B1-0299-47DA-A875-91A65348DD5D}\.cr\vcredist_x64.exe"C:\Windows\Temp\{740704B1-0299-47DA-A875-91A65348DD5D}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{D51F496C-D02A-4AFA-AB43-F61B94462C9E}~setup\vcredist_x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /Q /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F626B9F7A4C74AD4BAFE68C6DCF4F729 C2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD5d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
Filesize
202KB
MD5d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
Filesize
589.5MB
MD583e3911420ded145af6ea1422b3297e4
SHA15d2045f3872397e58d03c9ddf0e7ef582735503b
SHA256219e0ede979589664d1bdff2ec1d781fd6cee674c7033d5ba0a3b7844512ad6d
SHA512c24911bdd8dab06d2a44d3b996f3baca75d426998c3f289a1000f7c17d01f85651ddd206c380b20b114fd7e2ed7873343293114f78f34955c73775e7d057e664
-
Filesize
14.4MB
MD5be433764fa9bbe0f2f9c654f6512c9e0
SHA1b87c38d093872d7be7e191f01107b39c87888a5a
SHA25640ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
SHA5128a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191
-
Filesize
14.4MB
MD5be433764fa9bbe0f2f9c654f6512c9e0
SHA1b87c38d093872d7be7e191f01107b39c87888a5a
SHA25640ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
SHA5128a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191
-
Filesize
13.7MB
MD524e8177b25c072f4fb0d37496ccdbb34
SHA1afa5badce64ee67290add24e0dc3d8210954ac6c
SHA256e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
SHA5122fda8abc77b6ed9e98a2b120628e4e3b9458f2b18998c836eec1de82642244fe55234c7e52d6036d8b75c4b707a24f12fa639cc92d4234e94ed604a259d651e4
-
Filesize
13.7MB
MD524e8177b25c072f4fb0d37496ccdbb34
SHA1afa5badce64ee67290add24e0dc3d8210954ac6c
SHA256e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
SHA5122fda8abc77b6ed9e98a2b120628e4e3b9458f2b18998c836eec1de82642244fe55234c7e52d6036d8b75c4b707a24f12fa639cc92d4234e94ed604a259d651e4
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
632KB
MD594970fc3a8ed7b9de44f4117419ce829
SHA1aa1292f049c4173e2ab60b59b62f267fd884d21a
SHA256de1acbb1df68a39a5b966303ac1b609dde2688b28ebf3eba8d2adeeb3d90bf5e
SHA512b17bd215b83bfa46512b73c3d9f430806ca3bea13bebde971e8edd972614e54a7ba3d6fc3439078cdfdaa7eeb1f3f9054bf03ed5c45b622b691b968d4ec0566f
-
Filesize
632KB
MD594970fc3a8ed7b9de44f4117419ce829
SHA1aa1292f049c4173e2ab60b59b62f267fd884d21a
SHA256de1acbb1df68a39a5b966303ac1b609dde2688b28ebf3eba8d2adeeb3d90bf5e
SHA512b17bd215b83bfa46512b73c3d9f430806ca3bea13bebde971e8edd972614e54a7ba3d6fc3439078cdfdaa7eeb1f3f9054bf03ed5c45b622b691b968d4ec0566f
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
632KB
MD5c9d95472a5627c6c455e74c8b8fef5be
SHA134cb7f8f8b8dede7be6fd99e2b4bddaa37e5db82
SHA2564b1bf90a0e4e3a628613c2fe42ddba589ee6303e37ccc70cf99ddc92dde03b0b
SHA512989caff542f310972c15364925af542984ca73c1c1eec82fcbd1ea4bf9186487fd8349989afc95db4e761ebcbb8b14ce49482bc61d51b3259d134c571f4fab31
-
Filesize
632KB
MD5c9d95472a5627c6c455e74c8b8fef5be
SHA134cb7f8f8b8dede7be6fd99e2b4bddaa37e5db82
SHA2564b1bf90a0e4e3a628613c2fe42ddba589ee6303e37ccc70cf99ddc92dde03b0b
SHA512989caff542f310972c15364925af542984ca73c1c1eec82fcbd1ea4bf9186487fd8349989afc95db4e761ebcbb8b14ce49482bc61d51b3259d134c571f4fab31
