Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
CapTalkSetup.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
CapTalkSetup.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
CapTalkSetup.msi
-
Size
22.0MB
-
MD5
73137946a664fcf4c79a8d4ab7e3e90e
-
SHA1
f9c0dd55ba400af20bab9fd9faf881c361810700
-
SHA256
1ffe8209764db06b2f65a1bf47d208bbd7c08f5b31d5f798ba6b397f04ae421c
-
SHA512
d7e122b43a4d8bc52386a4d2919091a4a3ff4e7900883f5242e6e8b646b6514081d95c9d748947088b8e47b2798709ade3df5c54b0d232a3445b3c9ff66d06af
-
SSDEEP
393216:oRXWmhkB2RevIOXmc87p5jcCknXXnS4BzYRzgG8vccAzT1H//jA44:7mS2GIumc8jjcCmBzQsGt/t4
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 608 MsiExec.exe 608 MsiExec.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 5 4624 msiexec.exe 7 4624 msiexec.exe 9 4624 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcr100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp100.dll msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4624 msiexec.exe Token: SeIncreaseQuotaPrivilege 4624 msiexec.exe Token: SeSecurityPrivilege 1952 msiexec.exe Token: SeCreateTokenPrivilege 4624 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4624 msiexec.exe Token: SeLockMemoryPrivilege 4624 msiexec.exe Token: SeIncreaseQuotaPrivilege 4624 msiexec.exe Token: SeMachineAccountPrivilege 4624 msiexec.exe Token: SeTcbPrivilege 4624 msiexec.exe Token: SeSecurityPrivilege 4624 msiexec.exe Token: SeTakeOwnershipPrivilege 4624 msiexec.exe Token: SeLoadDriverPrivilege 4624 msiexec.exe Token: SeSystemProfilePrivilege 4624 msiexec.exe Token: SeSystemtimePrivilege 4624 msiexec.exe Token: SeProfSingleProcessPrivilege 4624 msiexec.exe Token: SeIncBasePriorityPrivilege 4624 msiexec.exe Token: SeCreatePagefilePrivilege 4624 msiexec.exe Token: SeCreatePermanentPrivilege 4624 msiexec.exe Token: SeBackupPrivilege 4624 msiexec.exe Token: SeRestorePrivilege 4624 msiexec.exe Token: SeShutdownPrivilege 4624 msiexec.exe Token: SeDebugPrivilege 4624 msiexec.exe Token: SeAuditPrivilege 4624 msiexec.exe Token: SeSystemEnvironmentPrivilege 4624 msiexec.exe Token: SeChangeNotifyPrivilege 4624 msiexec.exe Token: SeRemoteShutdownPrivilege 4624 msiexec.exe Token: SeUndockPrivilege 4624 msiexec.exe Token: SeSyncAgentPrivilege 4624 msiexec.exe Token: SeEnableDelegationPrivilege 4624 msiexec.exe Token: SeManageVolumePrivilege 4624 msiexec.exe Token: SeImpersonatePrivilege 4624 msiexec.exe Token: SeCreateGlobalPrivilege 4624 msiexec.exe Token: SeCreateTokenPrivilege 4624 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4624 msiexec.exe Token: SeLockMemoryPrivilege 4624 msiexec.exe Token: SeIncreaseQuotaPrivilege 4624 msiexec.exe Token: SeMachineAccountPrivilege 4624 msiexec.exe Token: SeTcbPrivilege 4624 msiexec.exe Token: SeSecurityPrivilege 4624 msiexec.exe Token: SeTakeOwnershipPrivilege 4624 msiexec.exe Token: SeLoadDriverPrivilege 4624 msiexec.exe Token: SeSystemProfilePrivilege 4624 msiexec.exe Token: SeSystemtimePrivilege 4624 msiexec.exe Token: SeProfSingleProcessPrivilege 4624 msiexec.exe Token: SeIncBasePriorityPrivilege 4624 msiexec.exe Token: SeCreatePagefilePrivilege 4624 msiexec.exe Token: SeCreatePermanentPrivilege 4624 msiexec.exe Token: SeBackupPrivilege 4624 msiexec.exe Token: SeRestorePrivilege 4624 msiexec.exe Token: SeShutdownPrivilege 4624 msiexec.exe Token: SeDebugPrivilege 4624 msiexec.exe Token: SeAuditPrivilege 4624 msiexec.exe Token: SeSystemEnvironmentPrivilege 4624 msiexec.exe Token: SeChangeNotifyPrivilege 4624 msiexec.exe Token: SeRemoteShutdownPrivilege 4624 msiexec.exe Token: SeUndockPrivilege 4624 msiexec.exe Token: SeSyncAgentPrivilege 4624 msiexec.exe Token: SeEnableDelegationPrivilege 4624 msiexec.exe Token: SeManageVolumePrivilege 4624 msiexec.exe Token: SeImpersonatePrivilege 4624 msiexec.exe Token: SeCreateGlobalPrivilege 4624 msiexec.exe Token: SeCreateTokenPrivilege 4624 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4624 msiexec.exe Token: SeLockMemoryPrivilege 4624 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4624 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 608 1952 msiexec.exe 85 PID 1952 wrote to memory of 608 1952 msiexec.exe 85 PID 1952 wrote to memory of 608 1952 msiexec.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CapTalkSetup.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4624
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C1F43CCFA70B502A5B20FB0A1834B597 C2⤵
- Loads dropped DLL
PID:608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613