Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

9c110c0426...61.exe

windows7-x64

7

9c110c0426...61.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2023, 11:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe

  • Size

    2.6MB

  • MD5

    1f8e9fec647700b21d45e6cda97c39b7

  • SHA1

    037288ee51553f84498ae4873c357d367d1a3667

  • SHA256

    9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161

  • SHA512

    42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad

  • SSDEEP

    49152:IJFEcHcHfnIpvSUxuB4vkjfCSfil3ObWcrJhxSkm6Fo4Ea0g/I2Pz7citcU7tmLq:S2c8gfd87CQgu9xNpW4t/Ic7csd7t0q

Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 57 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe
    "C:\Users\Admin\AppData\Local\Temp\9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec /i vcredist.msi
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4300
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3732
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EC574FAE399F1FDC6D11DB83791102C2
      2⤵
      • Loads dropped DLL
      PID:4560
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e5815d8.rbs
    Filesize

    50KB

    MD5

    7f78358d8fe3bc0bedec7dd53ba7e031

    SHA1

    f027781d758211936189d49f259a03c446686a1a

    SHA256

    ab666eade3874f255a1317cac36aaee312d9e0acfcb2e8bf66ea63a80ef01037

    SHA512

    0f622df89059bca984f8e1761e9ffc9739dfeb5cb2c530f56126a8238e64c92528defe1227517d2b487a3c6b2d829858881c4f5145655801e84eb3ec416daaf2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
    Filesize

    247KB

    MD5

    aa85aa3738acfe30e197d9dfd5c3428d

    SHA1

    7f3ee53bd967265afe32b31d75b4f6c47363654a

    SHA256

    af3560ef0c55c7e4eff2170c63e7860498b5830e405a3841f96c91601e62e108

    SHA512

    e1bf248d6425f6ba91bf0a1f3d364321b09477af9be2f31f8bf6d92defbaddfbab8f3e6284262742378f1f87d60d06eee3b98fb081e60f9fb6f19c1797489861

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
    Filesize

    2.7MB

    MD5

    dc1ab7ce3b89fc7cac369d8b246cdafe

    SHA1

    c9a2d5a312f770189c4b65cb500905e4773c14ad

    SHA256

    dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560

    SHA512

    e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe

    Download Submit

  • C:\Windows\Installer\MSI1827.tmp
    Filesize

    28KB

    MD5

    85221b3bcba8dbe4b4a46581aa49f760

    SHA1

    746645c92594bfc739f77812d67cfd85f4b92474

    SHA256

    f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

    SHA512

    060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

    Download Submit

  • C:\Windows\Installer\MSI1827.tmp
    Filesize

    28KB

    MD5

    85221b3bcba8dbe4b4a46581aa49f760

    SHA1

    746645c92594bfc739f77812d67cfd85f4b92474

    SHA256

    f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

    SHA512

    060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

    Download Submit

  • C:\Windows\Installer\e5815d5.msi
    Filesize

    2.7MB

    MD5

    dc1ab7ce3b89fc7cac369d8b246cdafe

    SHA1

    c9a2d5a312f770189c4b65cb500905e4773c14ad

    SHA256

    dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560

    SHA512

    e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.0MB

    MD5

    267e616b1b3d29035d5c9c3aaf4f1a5c

    SHA1

    e787c0b1d251623cdc87ba262b939fa2f3de1986

    SHA256

    15f94e83b908b1d039560fd86fd8553be433dcdf6fe182a03f6c874f7206d791

    SHA512

    2f0ee82dc3bb0cb4066cd1812fac5abf0db9f7147d9abbec0975daaa55a953d4e4a106d46c6a370944f5557644ddc6cf85654ce2f6e48dde8580e4c76c699cbd

    Download Submit

  • \??\Volume{6ada6bfc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a02cb0aa-571a-4a6a-847f-cc4b12106fff}_OnDiskSnapshotProp
    Filesize

    5KB

    MD5

    3ee67bc881bc96f8e6195b2d34801da2

    SHA1

    219f03380c4affc22dc8947090b81df44cf0b4df

    SHA256

    9992a407af732913878a79ab43a7a2b168d9dc902b7b6458e9fdfced4b5a40ec

    SHA512

    b10a673503051a6507364f56de288398f133dc9ab2261d97335151fba0fd087c76618d1a01c74a1a30c35bbf9ea250347b3fa8091d33c27e0ef2cd8deb355581

    Download Submit