Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
6vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
4vc-redist_...64.exe
windows10-2004-x64
4Analysis
-
max time kernel
198s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
vc-redist_2005-x64.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
vc-redist_2005-x64.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
vc-redist_2008-x64.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
vc-redist_2008-x64.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
vc-redist_2010-x64.exe
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral6
Sample
vc-redist_2010-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
vc-redist_2012-x64.exe
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral8
Sample
vc-redist_2012-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
vc-redist_2013-x64.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral10
Sample
vc-redist_2013-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
vc-redist_2015-2022-x64.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral12
Sample
vc-redist_2015-2022-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
vc-redist_2005-x64.exe
-
Size
3.0MB
-
MD5
e231fbcce2c2cb16dcc299d36c734df3
-
SHA1
f4d74643a0e117ea80b2c7ebcd908a6dd26aa9ea
-
SHA256
4487570bd86e2e1aac29db2a1d0a91eb63361fcaac570808eb327cd4e0e2240d
-
SHA512
4a3d27791f72d6feb38e55fe06b8a08f99bac315415d11e32cb6895cdd6f7145d46d070cd94ac879c4b87ff2a025b3781e662b32848ff2dbdd350cb46fe9177a
-
SSDEEP
49152:or67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRT:eM9l8pUr9m30L5grOQXZKAsErkbQRT
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vc-redist_2005-x64.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000299f28d78dcfadf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000299f28d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000299f28d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0299f28d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000299f28d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeShutdownPrivilege 1996 msiexec.exe Token: SeIncreaseQuotaPrivilege 1996 msiexec.exe Token: SeSecurityPrivilege 4556 msiexec.exe Token: SeCreateTokenPrivilege 1996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1996 msiexec.exe Token: SeLockMemoryPrivilege 1996 msiexec.exe Token: SeIncreaseQuotaPrivilege 1996 msiexec.exe Token: SeMachineAccountPrivilege 1996 msiexec.exe Token: SeTcbPrivilege 1996 msiexec.exe Token: SeSecurityPrivilege 1996 msiexec.exe Token: SeTakeOwnershipPrivilege 1996 msiexec.exe Token: SeLoadDriverPrivilege 1996 msiexec.exe Token: SeSystemProfilePrivilege 1996 msiexec.exe Token: SeSystemtimePrivilege 1996 msiexec.exe Token: SeProfSingleProcessPrivilege 1996 msiexec.exe Token: SeIncBasePriorityPrivilege 1996 msiexec.exe Token: SeCreatePagefilePrivilege 1996 msiexec.exe Token: SeCreatePermanentPrivilege 1996 msiexec.exe Token: SeBackupPrivilege 1996 msiexec.exe Token: SeRestorePrivilege 1996 msiexec.exe Token: SeShutdownPrivilege 1996 msiexec.exe Token: SeDebugPrivilege 1996 msiexec.exe Token: SeAuditPrivilege 1996 msiexec.exe Token: SeSystemEnvironmentPrivilege 1996 msiexec.exe Token: SeChangeNotifyPrivilege 1996 msiexec.exe Token: SeRemoteShutdownPrivilege 1996 msiexec.exe Token: SeUndockPrivilege 1996 msiexec.exe Token: SeSyncAgentPrivilege 1996 msiexec.exe Token: SeEnableDelegationPrivilege 1996 msiexec.exe Token: SeManageVolumePrivilege 1996 msiexec.exe Token: SeImpersonatePrivilege 1996 msiexec.exe Token: SeCreateGlobalPrivilege 1996 msiexec.exe Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe Token: SeBackupPrivilege 4556 msiexec.exe Token: SeRestorePrivilege 4556 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4464 wrote to memory of 1996 4464 vc-redist_2005-x64.exe 93 PID 4464 wrote to memory of 1996 4464 vc-redist_2005-x64.exe 93 PID 4464 wrote to memory of 1996 4464 vc-redist_2005-x64.exe 93 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vc-redist_2005-x64.exe"C:\Users\Admin\AppData\Local\Temp\vc-redist_2005-x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1996
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a