Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
311s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/01/2024, 18:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Crack/Final Draft.exe
Resource
win11-20231222-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
FinalDraftSetup.msi
Resource
win11-20231215-en
windows11-21h2-x64
7 signatures
300 seconds
General
-
Target
FinalDraftSetup.msi
-
Size
87.8MB
-
MD5
7ad2261a79a24a4ef1eb973e6e6b6623
-
SHA1
83d180f985f58c7e26cdbf0bcc85e225f2e48f47
-
SHA256
8db2143b8dde15df29e01b2a850225a1e4d6fd9d1a10fee34464833e7259fbfe
-
SHA512
779bcb29c7185b9a05fd6bd4436eb4ad675cb71a0bab839f278e3f92afae8eba4477f958bb6fd6b0c2443e05d5300983b04f4c094357a03d8d53d7862d6b5cf3
-
SSDEEP
1572864:t5gU7tnhUDIP5XbidxCuD8uh7//40U3NSSpWql46Qds9e7YVmw3l3YH2vf16lUKS:h7th+qbyQmhjXU3NSOWq12s91Vmw3yH2
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2260 MsiExec.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 9 4812 msiexec.exe 18 4812 msiexec.exe 21 4812 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\2ADAFA22284C4E4FBD2FB92F78DFDA0D.TMP\WiseCustomCalla.dll MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 6116 msiexec.exe Token: SeCreateTokenPrivilege 4812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4812 msiexec.exe Token: SeLockMemoryPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeMachineAccountPrivilege 4812 msiexec.exe Token: SeTcbPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeLoadDriverPrivilege 4812 msiexec.exe Token: SeSystemProfilePrivilege 4812 msiexec.exe Token: SeSystemtimePrivilege 4812 msiexec.exe Token: SeProfSingleProcessPrivilege 4812 msiexec.exe Token: SeIncBasePriorityPrivilege 4812 msiexec.exe Token: SeCreatePagefilePrivilege 4812 msiexec.exe Token: SeCreatePermanentPrivilege 4812 msiexec.exe Token: SeBackupPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeDebugPrivilege 4812 msiexec.exe Token: SeAuditPrivilege 4812 msiexec.exe Token: SeSystemEnvironmentPrivilege 4812 msiexec.exe Token: SeChangeNotifyPrivilege 4812 msiexec.exe Token: SeRemoteShutdownPrivilege 4812 msiexec.exe Token: SeUndockPrivilege 4812 msiexec.exe Token: SeSyncAgentPrivilege 4812 msiexec.exe Token: SeEnableDelegationPrivilege 4812 msiexec.exe Token: SeManageVolumePrivilege 4812 msiexec.exe Token: SeImpersonatePrivilege 4812 msiexec.exe Token: SeCreateGlobalPrivilege 4812 msiexec.exe Token: SeCreateTokenPrivilege 4812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4812 msiexec.exe Token: SeLockMemoryPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeMachineAccountPrivilege 4812 msiexec.exe Token: SeTcbPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeLoadDriverPrivilege 4812 msiexec.exe Token: SeSystemProfilePrivilege 4812 msiexec.exe Token: SeSystemtimePrivilege 4812 msiexec.exe Token: SeProfSingleProcessPrivilege 4812 msiexec.exe Token: SeIncBasePriorityPrivilege 4812 msiexec.exe Token: SeCreatePagefilePrivilege 4812 msiexec.exe Token: SeCreatePermanentPrivilege 4812 msiexec.exe Token: SeBackupPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeDebugPrivilege 4812 msiexec.exe Token: SeAuditPrivilege 4812 msiexec.exe Token: SeSystemEnvironmentPrivilege 4812 msiexec.exe Token: SeChangeNotifyPrivilege 4812 msiexec.exe Token: SeRemoteShutdownPrivilege 4812 msiexec.exe Token: SeUndockPrivilege 4812 msiexec.exe Token: SeSyncAgentPrivilege 4812 msiexec.exe Token: SeEnableDelegationPrivilege 4812 msiexec.exe Token: SeManageVolumePrivilege 4812 msiexec.exe Token: SeImpersonatePrivilege 4812 msiexec.exe Token: SeCreateGlobalPrivilege 4812 msiexec.exe Token: SeCreateTokenPrivilege 4812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4812 msiexec.exe Token: SeLockMemoryPrivilege 4812 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4812 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 6116 wrote to memory of 2260 6116 msiexec.exe 83 PID 6116 wrote to memory of 2260 6116 msiexec.exe 83 PID 6116 wrote to memory of 2260 6116 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FinalDraftSetup.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 13F3427C06E42DB6CF5E979BDFA3AB94 C2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD52a7a294b93e5ece144b049fa9d4dd0c2
SHA1356d46b2e28db0da79fbc3c8659506f535d065f9
SHA256e8de00b8005898b808f511537dc3c0c66f65a47ea9c4a14aa9fb59e8f30ac880
SHA5121ca5a665de38a8714f68cf6c7527fdc7560515e55f98c3367c31b7e4891bb06167d0649cb3226e369faa3bd36872d14af04524639d47a9d512bb552933661152