Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3SETUP.bat
windows7-x64
7SETUP.bat
windows10-2004-x64
6UPGRADE.bat
windows7-x64
1UPGRADE.bat
windows10-2004-x64
1postgresql...nt.msi
windows7-x64
7postgresql...nt.msi
windows10-2004-x64
7postgresql-8.3.msi
windows7-x64
7postgresql-8.3.msi
windows10-2004-x64
7vcredist_x86.exe
windows7-x64
6vcredist_x86.exe
windows10-2004-x64
6Analysis
-
max time kernel
161s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
SETUP.bat
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
SETUP.bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
UPGRADE.bat
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
UPGRADE.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
postgresql-8.3-int.msi
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
postgresql-8.3-int.msi
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
postgresql-8.3.msi
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
postgresql-8.3.msi
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
vcredist_x86.exe
Resource
win7-20231025-en
Behavioral task
behavioral10
Sample
vcredist_x86.exe
Resource
win10v2004-20231025-en
General
-
Target
SETUP.bat
-
Size
192B
-
MD5
4200cecaf0d0d6838e48b87f78c90c19
-
SHA1
9ac646870d4047e34d72ea244d003397bb4e54be
-
SHA256
1c684469f8230b75ca0c8e6d1ed39bfdbe22d7259e7c992986f9f3897bf91c05
-
SHA512
1f363479d82e6d9f1f8e068aff25043f8af44027a49c337f788ead27329e510c9e8bed755d5a7cb484be3fcfcfeb986481e82d68cc4689fd92f79c7df22169e0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist_x86.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000004e6fa88768ff2e40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000004e6fa880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090004e6fa88000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d04e6fa88000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000004e6fa8800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4984 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeMachineAccountPrivilege 4316 msiexec.exe Token: SeTcbPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeLoadDriverPrivilege 4316 msiexec.exe Token: SeSystemProfilePrivilege 4316 msiexec.exe Token: SeSystemtimePrivilege 4316 msiexec.exe Token: SeProfSingleProcessPrivilege 4316 msiexec.exe Token: SeIncBasePriorityPrivilege 4316 msiexec.exe Token: SeCreatePagefilePrivilege 4316 msiexec.exe Token: SeCreatePermanentPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4316 msiexec.exe Token: SeAuditPrivilege 4316 msiexec.exe Token: SeSystemEnvironmentPrivilege 4316 msiexec.exe Token: SeChangeNotifyPrivilege 4316 msiexec.exe Token: SeRemoteShutdownPrivilege 4316 msiexec.exe Token: SeUndockPrivilege 4316 msiexec.exe Token: SeSyncAgentPrivilege 4316 msiexec.exe Token: SeEnableDelegationPrivilege 4316 msiexec.exe Token: SeManageVolumePrivilege 4316 msiexec.exe Token: SeImpersonatePrivilege 4316 msiexec.exe Token: SeCreateGlobalPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 3492 vssvc.exe Token: SeRestorePrivilege 3492 vssvc.exe Token: SeAuditPrivilege 3492 vssvc.exe Token: SeBackupPrivilege 4984 msiexec.exe Token: SeRestorePrivilege 4984 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4316 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4904 wrote to memory of 1516 4904 cmd.exe 89 PID 4904 wrote to memory of 1516 4904 cmd.exe 89 PID 4904 wrote to memory of 1516 4904 cmd.exe 89 PID 1516 wrote to memory of 4316 1516 vcredist_x86.exe 91 PID 1516 wrote to memory of 4316 1516 vcredist_x86.exe 91 PID 1516 wrote to memory of 4316 1516 vcredist_x86.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SETUP.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exevcredist_x86.exe /q:a /c:"msiexec /i vcredist.msi /qb!"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi /qb!3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4316
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5dc1ab7ce3b89fc7cac369d8b246cdafe
SHA1c9a2d5a312f770189c4b65cb500905e4773c14ad
SHA256dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560
SHA512e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe