Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    81s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 20:57

Errors

Reason
Machine shutdown

General

  • Target

    e10907688283346891b3a0232545ec3b7cf926c402f5456a6fa1cd849e7e9092_JC.msi

  • Size

    1.2MB

  • MD5

    91ab2c89608fc49633b2474493eea552

  • SHA1

    57149066ebee5648344587be63eb467d3d765e14

  • SHA256

    e10907688283346891b3a0232545ec3b7cf926c402f5456a6fa1cd849e7e9092

  • SHA512

    e67db51fabc2e9ab3601ad48be4cadf48c799cc3164e86b805e118170dd89e4a0bac03dc9690528e3e606dad123526e29abe7e366865fb2e9c3ec3e953c2e90c

  • SSDEEP

    24576:dg+xLNIYVNMvZCFlp8zBQSc0ZoCEqKlqS0Ygll5RRYM/ZXAAZ:dg6IY4W8zBQSc0ZnRKr8RRYGZXAA

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e10907688283346891b3a0232545ec3b7cf926c402f5456a6fa1cd849e7e9092_JC.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2060
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0C92E05F5DB59AEC7031249535EDF52
      2⤵
      • Loads dropped DLL
      PID:2656
    • C:\Windows\Installer\MSIC384.tmp
      "C:\Windows\Installer\MSIC384.tmp" /DontWait /HideWindow "C:\Users\Admin\AppData\Roaming\MicrosoftOfficeW2H9p1T70CVTWPBNWcCjKm9T65bZMmSbsdOjQkkMDMURYAjDxhu5sCEvgGujXa72®rtlkxs\MicrosoftOfficeW2H9p1T70CVTWPBNWcCjKm9T65bZMmSbsdOjQkkMDMURYAjDxhu5sCEvgGujXa72®rtlkxs\fDdpuNcG.cmd"
      2⤵
      • Executes dropped EXE
      PID:1800
  • C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\MicrosoftOfficeW2H9p1T70CVTWPBNWcCjKm9T65bZMmSbsdOjQkkMDMURYAjDxhu5sCEvgGujXa72®rtlkxs\MicrosoftOfficeW2H9p1T70CVTWPBNWcCjKm9T65bZMmSbsdOjQkkMDMURYAjDxhu5sCEvgGujXa72®rtlkxs\fDdpuNcG.cmd" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %fuGR5S?TqAPRkx% "
      2⤵
        PID:2968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        PowerShell -NoProfile -windowstyle hidden -ExecutionPolicy Bypass -nop -NoExit -Command -
        2⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\system32\shutdown.exe
          "C:\Windows\system32\shutdown.exe" -r -f -t 10 -c "Windows Updated Successfully"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1020
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0
      1⤵
        PID:1772
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x1
        1⤵
          PID:1640

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\f762fcb.rbs

          Filesize

          3KB

          MD5

          fedab0e1782c6013b727b7800bbcb72d

          SHA1

          9e5780ba33a2502c5ba7c33ed413ba583ebfab11

          SHA256

          c22810c56eae356b96cbb9feb5a5cddc92362e989f7fd8e9a92258957caf4920

          SHA512

          77696038212806bb644d034a8b7eb0868895e44f719c5cc334201efb2d6a371a70cb44ddeeacfef9727f1de04f8132edd7a30c8fa9eb05312788475e2e760db7

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          1da75b620890231a705c07ba27f54b27

          SHA1

          c99de0ca8457d28559695c1d227c1acf08d8e34b

          SHA256

          39941f45086723b041a35f5472db6247e471569dd73a1144bd3654ac2d89c19e

          SHA512

          df8e549c8e91224dc0c74b035763e6fc7e57a4d1c0753f064e3778d7503372b9ebcfbf442e39755c92e55cb7373b4e8a375a3ca3a2da160f34e12ba5537bd3f2

        • C:\Users\Admin\AppData\Local\Temp\CabDD18.tmp

          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

        • C:\Users\Admin\AppData\Local\Temp\TarDDE6.tmp

          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

        • C:\Users\Admin\AppData\Roaming\MicrosoftOfficeW2H9p1T70CVTWPBNWcCjKm9T65bZMmSbsdOjQkkMDMURYAjDxhu5sCEvgGujXa72®rtlkxs\MicrosoftOfficeW2H9p1T70CVTWPBNWcCjKm9T65bZMmSbsdOjQkkMDMURYAjDxhu5sCEvgGujXa72®rtlkxs\fDdpuNcG.cmd

          Filesize

          30KB

          MD5

          5e94ca7417e9100775e8fa6c0f6cfb6a

          SHA1

          43680c9ba06b820eace8b04f5f99df0cc0524a41

          SHA256

          885ce089e82cee4e52a00f065268d33435a6f6a97a9c0a3e93f98e3e11cccfce

          SHA512

          f3252662116f8a675ab9c36e0b3327a9ced68568b6ad9308f48317359ff74578ac3da70d4b80240bf92d466b5cb4304c225211ccd2db159dacc8f3939c221007

        • C:\Users\Admin\DOCUME~1\AMD64_\MYDOCT~1\965F41~1.ZIP

          Filesize

          10.9MB

          MD5

          e78c0fd9d5c689d61c691fbfb517ed96

          SHA1

          1e1a04bf53cad5d618ac13cbeee6799d7421da4c

          SHA256

          2ab006744dd9bd94662fb16dd769a1d91a0204afde1d38e8af4d852338f7eeb3

          SHA512

          e3f5cd34e125b3283faab822da06b4c02e106ee56bbd6092d452b7bed5dbae89c710ac27a2b253c0dd4a03934a824445b27efd1261121fa82e70d0d1b4c20c63

        • C:\Users\Admin\Documents\AMD64_\MyDoct63D68FD®\SearchFilterHostgistrat3d02©.exe

          Filesize

          21KB

          MD5

          cc09bb7fdefc5763ccb3cf7dae2d76cf

          SHA1

          8610d07f27a961066134d728c82eb8e5f22e7e8f

          SHA256

          f8f00900edba2f64bf136dd0b6c83caf07c72f24f3d49c78b7ea24757fdbc6d0

          SHA512

          0c518487aa5bad357bd19ad09c6cfe0b8bb522d74a916d36cf01f1bd194b59cd8457784b199dc953570ad7ef8ce67464d066bda51e31b055c9d4d5ca060d45c5

        • C:\Windows\Installer\MSI3025.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • C:\Windows\Installer\MSI31DB.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • C:\Windows\Installer\MSI3249.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • C:\Windows\Installer\MSI3249.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • C:\Windows\Installer\MSIC384.tmp

          Filesize

          389KB

          MD5

          377c83c6f0f37653ff911dc06e6c4274

          SHA1

          ce1e53b5bf0a220346ab7379b93c4341c24fdd8a

          SHA256

          c290a133b60220479acf0469781de847eb7e4a6b0c92de45ee9223be5e0ca769

          SHA512

          47bed026ef3d3e1a88a8cec3e0e2904029ec6f2e0ed9bb8d8836564fa713e882cf9bbf0d1e1dc7887072804578edd6af21b047d579f85f27bba733a20125fdd8

        • C:\Windows\Installer\MSIC384.tmp

          Filesize

          389KB

          MD5

          377c83c6f0f37653ff911dc06e6c4274

          SHA1

          ce1e53b5bf0a220346ab7379b93c4341c24fdd8a

          SHA256

          c290a133b60220479acf0469781de847eb7e4a6b0c92de45ee9223be5e0ca769

          SHA512

          47bed026ef3d3e1a88a8cec3e0e2904029ec6f2e0ed9bb8d8836564fa713e882cf9bbf0d1e1dc7887072804578edd6af21b047d579f85f27bba733a20125fdd8

        • \Windows\Installer\MSI3025.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • \Windows\Installer\MSI31DB.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • \Windows\Installer\MSI3249.tmp

          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

        • memory/1640-170-0x00000000026E0000-0x00000000026E1000-memory.dmp

          Filesize

          4KB

        • memory/1772-169-0x00000000029B0000-0x00000000029B1000-memory.dmp

          Filesize

          4KB

        • memory/1800-34-0x0000000000160000-0x0000000000162000-memory.dmp

          Filesize

          8KB

        • memory/3036-44-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-46-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-45-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-119-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

          Filesize

          9.6MB

        • memory/3036-120-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

          Filesize

          9.6MB

        • memory/3036-121-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-122-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-123-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-43-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

          Filesize

          9.6MB

        • memory/3036-133-0x0000000002550000-0x00000000025D0000-memory.dmp

          Filesize

          512KB

        • memory/3036-134-0x000000001C5B0000-0x000000001C5B1000-memory.dmp

          Filesize

          4KB

        • memory/3036-162-0x000000001C5B0000-0x000000001C5B1000-memory.dmp

          Filesize

          4KB

        • memory/3036-42-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

          Filesize

          9.6MB

        • memory/3036-168-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp

          Filesize

          9.6MB

        • memory/3036-41-0x0000000002510000-0x0000000002518000-memory.dmp

          Filesize

          32KB

        • memory/3036-40-0x000000001B190000-0x000000001B472000-memory.dmp

          Filesize

          2.9MB