Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    03/11/2023, 23:11

General

  • Target

    F91ANFac_turaMTHEIARMRSqoxgxRefXNVZZQGJEUukoan.msi

  • Size

    8.6MB

  • MD5

    899f664925a69b957335b4bb00ff9142

  • SHA1

    1dd30f02ff61904bcfea931f21f8b008d21da670

  • SHA256

    c3c9bfb8cb54c481641c9be79295e19912c78b5025a451df9e34b4fbd0e8e0f4

  • SHA512

    4b3bf0fddec240bcbff0c3663f4fc3fcac352317613cb224a0f9a0bac0357c1c4f875b45352eb522ea9d8cea4d6fc720b009e3760a94fe722d229d6563fd1000

  • SSDEEP

    49152:6cfofeSXa3HBb8IFnfGXK+ihN9SWF3i7q7tWp2yosVSYtCTpIec6zyxww1nx3VWC:NSX8ppvDKy547IA0

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\F91ANFac_turaMTHEIARMRSqoxgxRefXNVZZQGJEUukoan.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:868
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D5113933B22DCED1F7CCF0B88274F850
      2⤵
      • Loads dropped DLL
      PID:2596
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 7A8463D402AE70AE7CD92E0F26B4C578
      2⤵
      • Loads dropped DLL
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      PID:1200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e5791c3.rbs

    Filesize

    588B

    MD5

    ffb97f28511cfd743541d55a785bfaa1

    SHA1

    30712cc9b5bbf9f9071767958b3723433464433e

    SHA256

    22adf25b05ede77955c6facc6820780995d3881c218825305a7604deb7198ca4

    SHA512

    6cab9e17bb329a90a854deed57b70865e32fe1b694ddebda21e0e458d4d4e7c639e8afa407abc160bdb4d548b14ea8f58895e1f7b2ce3cc373cdbf9b599739b0

  • C:\Windows\Installer\MSI929B.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI929B.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI99FF.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI99FF.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI9A8C.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI9A8C.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI9A8C.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI9B2A.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI9B2A.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI9D2F.tmp

    Filesize

    7.5MB

    MD5

    e63b31964f925614e621ca1095463581

    SHA1

    efaec2440c5ff244e6eb9ff268608e7d1c342d59

    SHA256

    e92d30d3265f414ce0a6768b7ce1a9b853bb00be0f9d8f107bbf770809625a92

    SHA512

    88c23d705019cc6c37c3bd51e60408be7e09f2222567e4eeb65e1587190eaa5643db3873aa381a8b3e10d37975504dba2300400341d694bde813d4a340023d3d

  • C:\Windows\Installer\MSI9D2F.tmp

    Filesize

    7.5MB

    MD5

    e63b31964f925614e621ca1095463581

    SHA1

    efaec2440c5ff244e6eb9ff268608e7d1c342d59

    SHA256

    e92d30d3265f414ce0a6768b7ce1a9b853bb00be0f9d8f107bbf770809625a92

    SHA512

    88c23d705019cc6c37c3bd51e60408be7e09f2222567e4eeb65e1587190eaa5643db3873aa381a8b3e10d37975504dba2300400341d694bde813d4a340023d3d

  • memory/1200-26-0x00000000773C0000-0x0000000077B5F000-memory.dmp

    Filesize

    7.6MB

  • memory/1200-28-0x00000000773C0000-0x0000000077B5F000-memory.dmp

    Filesize

    7.6MB

  • memory/1200-29-0x000002839E100000-0x000002839E101000-memory.dmp

    Filesize

    4KB