Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 07:33

General

  • Target

    x64-china.msi

  • Size

    52.8MB

  • MD5

    bd2649a3bedac83d1bb0e21dcbe66e3f

  • SHA1

    b6f936667736b93240ac1a2a25252db0493f5122

  • SHA256

    227c9bf784fd57c95dd3e4fb1f3b41d63275671a0b416a7fd947e4ad0b1e4f28

  • SHA512

    02958f7dac9957ecb98bb5297b483cabfe37ad17ef98307b033815f44239bc69bfdddeb8fac0500025bfa68afaf1f916cd498ce3ad398ee3179fba86eec20439

  • SSDEEP

    1572864:I+rGQOAA7UfaG+/Ygdmn+UBZbCCMTVx1b3NHM:SNIfhOK+6MZx1b36

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\x64-china.msi
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2072
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 71AA1517A4B181B256F4172EE9BA2987 C
      2⤵
      • Loads dropped DLL
      PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI4827.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • C:\Users\Admin\AppData\Local\Temp\MSI4AA8.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • C:\Users\Admin\AppData\Local\Temp\MSI4B16.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • C:\Users\Admin\AppData\Local\Temp\MSI4B16.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • C:\Users\Admin\AppData\Local\Temp\MSI4C3F.tmp

    Filesize

    705KB

    MD5

    f7b1ddc86cd51e3391aa8bf4be48d994

    SHA1

    a0c0a4a77991d7f8df722acdd782310a6da2a904

    SHA256

    ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

    SHA512

    f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

  • C:\Users\Admin\AppData\Local\Temp\MSI4CDC.tmp

    Filesize

    1.1MB

    MD5

    48c25fba873a341b914652763cbc4f7b

    SHA1

    98b51420e26829bb96a963e4fb897db733c76fc0

    SHA256

    4595c98e419d911b31eedfc342384e78024f5e23ccfdcfde4d2d304241e7c6cd

    SHA512

    c8931846db2b75860104d0dbf1cac5220fc2f3464cc83536b189c9bb8ccd4b1ddc490a7e7cf2f711bea086c29bf3948bd96ba81def63b752688277f0e96dbf68

  • C:\Users\Admin\AppData\Local\Temp\MSI4D6A.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • C:\Users\Admin\AppData\Local\Temp\MSI4E16.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • \Users\Admin\AppData\Local\Temp\MSI4827.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • \Users\Admin\AppData\Local\Temp\MSI4AA8.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • \Users\Admin\AppData\Local\Temp\MSI4B16.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • \Users\Admin\AppData\Local\Temp\MSI4C3F.tmp

    Filesize

    705KB

    MD5

    f7b1ddc86cd51e3391aa8bf4be48d994

    SHA1

    a0c0a4a77991d7f8df722acdd782310a6da2a904

    SHA256

    ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

    SHA512

    f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

  • \Users\Admin\AppData\Local\Temp\MSI4CDC.tmp

    Filesize

    1.1MB

    MD5

    48c25fba873a341b914652763cbc4f7b

    SHA1

    98b51420e26829bb96a963e4fb897db733c76fc0

    SHA256

    4595c98e419d911b31eedfc342384e78024f5e23ccfdcfde4d2d304241e7c6cd

    SHA512

    c8931846db2b75860104d0dbf1cac5220fc2f3464cc83536b189c9bb8ccd4b1ddc490a7e7cf2f711bea086c29bf3948bd96ba81def63b752688277f0e96dbf68

  • \Users\Admin\AppData\Local\Temp\MSI4D6A.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

  • \Users\Admin\AppData\Local\Temp\MSI4E16.tmp

    Filesize

    557KB

    MD5

    db7612f0fd6408d664185cfc81bef0cb

    SHA1

    19a6334ec00365b4f4e57d387ed885b32aa7c9aa

    SHA256

    e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

    SHA512

    25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9