Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
x64-china.msi
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
x64-china.msi
Resource
win10v2004-20230915-en
General
-
Target
x64-china.msi
-
Size
52.8MB
-
MD5
bd2649a3bedac83d1bb0e21dcbe66e3f
-
SHA1
b6f936667736b93240ac1a2a25252db0493f5122
-
SHA256
227c9bf784fd57c95dd3e4fb1f3b41d63275671a0b416a7fd947e4ad0b1e4f28
-
SHA512
02958f7dac9957ecb98bb5297b483cabfe37ad17ef98307b033815f44239bc69bfdddeb8fac0500025bfa68afaf1f916cd498ce3ad398ee3179fba86eec20439
-
SSDEEP
1572864:I+rGQOAA7UfaG+/Ygdmn+UBZbCCMTVx1b3NHM:SNIfhOK+6MZx1b36
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2672 MsiExec.exe 2672 MsiExec.exe 2672 MsiExec.exe 2672 MsiExec.exe 2672 MsiExec.exe 2672 MsiExec.exe 2672 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2072 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2072 msiexec.exe Token: SeIncreaseQuotaPrivilege 2072 msiexec.exe Token: SeRestorePrivilege 2372 msiexec.exe Token: SeTakeOwnershipPrivilege 2372 msiexec.exe Token: SeSecurityPrivilege 2372 msiexec.exe Token: SeCreateTokenPrivilege 2072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2072 msiexec.exe Token: SeLockMemoryPrivilege 2072 msiexec.exe Token: SeIncreaseQuotaPrivilege 2072 msiexec.exe Token: SeMachineAccountPrivilege 2072 msiexec.exe Token: SeTcbPrivilege 2072 msiexec.exe Token: SeSecurityPrivilege 2072 msiexec.exe Token: SeTakeOwnershipPrivilege 2072 msiexec.exe Token: SeLoadDriverPrivilege 2072 msiexec.exe Token: SeSystemProfilePrivilege 2072 msiexec.exe Token: SeSystemtimePrivilege 2072 msiexec.exe Token: SeProfSingleProcessPrivilege 2072 msiexec.exe Token: SeIncBasePriorityPrivilege 2072 msiexec.exe Token: SeCreatePagefilePrivilege 2072 msiexec.exe Token: SeCreatePermanentPrivilege 2072 msiexec.exe Token: SeBackupPrivilege 2072 msiexec.exe Token: SeRestorePrivilege 2072 msiexec.exe Token: SeShutdownPrivilege 2072 msiexec.exe Token: SeDebugPrivilege 2072 msiexec.exe Token: SeAuditPrivilege 2072 msiexec.exe Token: SeSystemEnvironmentPrivilege 2072 msiexec.exe Token: SeChangeNotifyPrivilege 2072 msiexec.exe Token: SeRemoteShutdownPrivilege 2072 msiexec.exe Token: SeUndockPrivilege 2072 msiexec.exe Token: SeSyncAgentPrivilege 2072 msiexec.exe Token: SeEnableDelegationPrivilege 2072 msiexec.exe Token: SeManageVolumePrivilege 2072 msiexec.exe Token: SeImpersonatePrivilege 2072 msiexec.exe Token: SeCreateGlobalPrivilege 2072 msiexec.exe Token: SeCreateTokenPrivilege 2072 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2072 msiexec.exe Token: SeLockMemoryPrivilege 2072 msiexec.exe Token: SeIncreaseQuotaPrivilege 2072 msiexec.exe Token: SeMachineAccountPrivilege 2072 msiexec.exe Token: SeTcbPrivilege 2072 msiexec.exe Token: SeSecurityPrivilege 2072 msiexec.exe Token: SeTakeOwnershipPrivilege 2072 msiexec.exe Token: SeLoadDriverPrivilege 2072 msiexec.exe Token: SeSystemProfilePrivilege 2072 msiexec.exe Token: SeSystemtimePrivilege 2072 msiexec.exe Token: SeProfSingleProcessPrivilege 2072 msiexec.exe Token: SeIncBasePriorityPrivilege 2072 msiexec.exe Token: SeCreatePagefilePrivilege 2072 msiexec.exe Token: SeCreatePermanentPrivilege 2072 msiexec.exe Token: SeBackupPrivilege 2072 msiexec.exe Token: SeRestorePrivilege 2072 msiexec.exe Token: SeShutdownPrivilege 2072 msiexec.exe Token: SeDebugPrivilege 2072 msiexec.exe Token: SeAuditPrivilege 2072 msiexec.exe Token: SeSystemEnvironmentPrivilege 2072 msiexec.exe Token: SeChangeNotifyPrivilege 2072 msiexec.exe Token: SeRemoteShutdownPrivilege 2072 msiexec.exe Token: SeUndockPrivilege 2072 msiexec.exe Token: SeSyncAgentPrivilege 2072 msiexec.exe Token: SeEnableDelegationPrivilege 2072 msiexec.exe Token: SeManageVolumePrivilege 2072 msiexec.exe Token: SeImpersonatePrivilege 2072 msiexec.exe Token: SeCreateGlobalPrivilege 2072 msiexec.exe Token: SeCreateTokenPrivilege 2072 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2672 2372 msiexec.exe 29 PID 2372 wrote to memory of 2672 2372 msiexec.exe 29 PID 2372 wrote to memory of 2672 2372 msiexec.exe 29 PID 2372 wrote to memory of 2672 2372 msiexec.exe 29 PID 2372 wrote to memory of 2672 2372 msiexec.exe 29 PID 2372 wrote to memory of 2672 2372 msiexec.exe 29 PID 2372 wrote to memory of 2672 2372 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\x64-china.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2072
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71AA1517A4B181B256F4172EE9BA2987 C2⤵
- Loads dropped DLL
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
705KB
MD5f7b1ddc86cd51e3391aa8bf4be48d994
SHA1a0c0a4a77991d7f8df722acdd782310a6da2a904
SHA256ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f
SHA512f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6
-
Filesize
1.1MB
MD548c25fba873a341b914652763cbc4f7b
SHA198b51420e26829bb96a963e4fb897db733c76fc0
SHA2564595c98e419d911b31eedfc342384e78024f5e23ccfdcfde4d2d304241e7c6cd
SHA512c8931846db2b75860104d0dbf1cac5220fc2f3464cc83536b189c9bb8ccd4b1ddc490a7e7cf2f711bea086c29bf3948bd96ba81def63b752688277f0e96dbf68
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
705KB
MD5f7b1ddc86cd51e3391aa8bf4be48d994
SHA1a0c0a4a77991d7f8df722acdd782310a6da2a904
SHA256ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f
SHA512f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6
-
Filesize
1.1MB
MD548c25fba873a341b914652763cbc4f7b
SHA198b51420e26829bb96a963e4fb897db733c76fc0
SHA2564595c98e419d911b31eedfc342384e78024f5e23ccfdcfde4d2d304241e7c6cd
SHA512c8931846db2b75860104d0dbf1cac5220fc2f3464cc83536b189c9bb8ccd4b1ddc490a7e7cf2f711bea086c29bf3948bd96ba81def63b752688277f0e96dbf68
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9