Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1SETUP.bat
windows7-x64
7SETUP.bat
windows10-2004-x64
6UPGRADE.bat
windows7-x64
1UPGRADE.bat
windows10-2004-x64
1postgresql...nt.msi
windows7-x64
7postgresql...nt.msi
windows10-2004-x64
7postgresql-8.3.msi
windows7-x64
7postgresql-8.3.msi
windows10-2004-x64
7vcredist_x86.exe
windows7-x64
7vcredist_x86.exe
windows10-2004-x64
6Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
SETUP.bat
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
SETUP.bat
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
UPGRADE.bat
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral4
Sample
UPGRADE.bat
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
postgresql-8.3-int.msi
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral6
Sample
postgresql-8.3-int.msi
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
postgresql-8.3.msi
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral8
Sample
postgresql-8.3.msi
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
vcredist_x86.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral10
Sample
vcredist_x86.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
postgresql-8.3.msi
-
Size
157KB
-
MD5
1e6553f86dde0f12b7f9981afc5054ea
-
SHA1
e1b66fd97c564b0bd775f378250ff3405b34c522
-
SHA256
045778cd90249429c57e07bce0da08ceabe6bd8ebeee0e64e56084d021c93892
-
SHA512
e401893437a08213aca5f5f26300513e7afd606b4b538e80732b1a12fe36ff77cb02d1ff7b9c1f788923e855069d592adbfcea6b836b713811aa71133304ea0a
-
SSDEEP
768:G/oTHgCmVMdtCSucz/ZslMb+iV0Tta0fYn/lTR/BxY/xP4eOncCzLS8WoPb86p:iIDmDC/ZxbrItasa/lTREfOcqDp
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2580 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2024 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2732 msiexec.exe Token: SeTakeOwnershipPrivilege 2732 msiexec.exe Token: SeSecurityPrivilege 2732 msiexec.exe Token: SeCreateTokenPrivilege 2024 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2024 msiexec.exe Token: SeLockMemoryPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeMachineAccountPrivilege 2024 msiexec.exe Token: SeTcbPrivilege 2024 msiexec.exe Token: SeSecurityPrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeLoadDriverPrivilege 2024 msiexec.exe Token: SeSystemProfilePrivilege 2024 msiexec.exe Token: SeSystemtimePrivilege 2024 msiexec.exe Token: SeProfSingleProcessPrivilege 2024 msiexec.exe Token: SeIncBasePriorityPrivilege 2024 msiexec.exe Token: SeCreatePagefilePrivilege 2024 msiexec.exe Token: SeCreatePermanentPrivilege 2024 msiexec.exe Token: SeBackupPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeDebugPrivilege 2024 msiexec.exe Token: SeAuditPrivilege 2024 msiexec.exe Token: SeSystemEnvironmentPrivilege 2024 msiexec.exe Token: SeChangeNotifyPrivilege 2024 msiexec.exe Token: SeRemoteShutdownPrivilege 2024 msiexec.exe Token: SeUndockPrivilege 2024 msiexec.exe Token: SeSyncAgentPrivilege 2024 msiexec.exe Token: SeEnableDelegationPrivilege 2024 msiexec.exe Token: SeManageVolumePrivilege 2024 msiexec.exe Token: SeImpersonatePrivilege 2024 msiexec.exe Token: SeCreateGlobalPrivilege 2024 msiexec.exe Token: SeCreateTokenPrivilege 2024 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2024 msiexec.exe Token: SeLockMemoryPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeMachineAccountPrivilege 2024 msiexec.exe Token: SeTcbPrivilege 2024 msiexec.exe Token: SeSecurityPrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeLoadDriverPrivilege 2024 msiexec.exe Token: SeSystemProfilePrivilege 2024 msiexec.exe Token: SeSystemtimePrivilege 2024 msiexec.exe Token: SeProfSingleProcessPrivilege 2024 msiexec.exe Token: SeIncBasePriorityPrivilege 2024 msiexec.exe Token: SeCreatePagefilePrivilege 2024 msiexec.exe Token: SeCreatePermanentPrivilege 2024 msiexec.exe Token: SeBackupPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeDebugPrivilege 2024 msiexec.exe Token: SeAuditPrivilege 2024 msiexec.exe Token: SeSystemEnvironmentPrivilege 2024 msiexec.exe Token: SeChangeNotifyPrivilege 2024 msiexec.exe Token: SeRemoteShutdownPrivilege 2024 msiexec.exe Token: SeUndockPrivilege 2024 msiexec.exe Token: SeSyncAgentPrivilege 2024 msiexec.exe Token: SeEnableDelegationPrivilege 2024 msiexec.exe Token: SeManageVolumePrivilege 2024 msiexec.exe Token: SeImpersonatePrivilege 2024 msiexec.exe Token: SeCreateGlobalPrivilege 2024 msiexec.exe Token: SeCreateTokenPrivilege 2024 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2580 2732 msiexec.exe 28 PID 2732 wrote to memory of 2580 2732 msiexec.exe 28 PID 2732 wrote to memory of 2580 2732 msiexec.exe 28 PID 2732 wrote to memory of 2580 2732 msiexec.exe 28 PID 2732 wrote to memory of 2580 2732 msiexec.exe 28 PID 2732 wrote to memory of 2580 2732 msiexec.exe 28 PID 2732 wrote to memory of 2580 2732 msiexec.exe 28
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\postgresql-8.3.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2024
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1C1B4D29337686A191B642CC0E297BB2 C2⤵
- Loads dropped DLL
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD564f789def050b343a101e830414a47dd
SHA118d19b115a0aa5cf833f9ae2ffbb8c268b2f4c2d
SHA256054659ac09113ff34b36883f895d73c4d2890b07e7c74fce803da763061a8c1c
SHA51285ff5816bd1274529cf935ab211f8eb8431ecba18675a8a88ea8ccf051797ed2c3e6ea26650742eb5adb14b74f98e02a8bbcdc20eb413891d7a82a4517fd59e9
-
Filesize
48KB
MD564f789def050b343a101e830414a47dd
SHA118d19b115a0aa5cf833f9ae2ffbb8c268b2f4c2d
SHA256054659ac09113ff34b36883f895d73c4d2890b07e7c74fce803da763061a8c1c
SHA51285ff5816bd1274529cf935ab211f8eb8431ecba18675a8a88ea8ccf051797ed2c3e6ea26650742eb5adb14b74f98e02a8bbcdc20eb413891d7a82a4517fd59e9