Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe
-
Size
1.6MB
-
MD5
f2fd7dae9e4bc8cbac68a6a5a82edcdf
-
SHA1
f9c5a6d6ea80afbb983da65aa126b4187f2419a0
-
SHA256
3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd
-
SHA512
ce861fc951759881c59a7613cdaeb2436ae25bb14101bbb2ff62f5bbae6504d51ecad7e9d3965d7edfb644e016ada6f275b5e9b4529289f6b5ed37f91c690589
-
SSDEEP
24576:4l83JdN3JxEIGeAteivk4Sz9zIZZV57ql/mwgFJTYFoS0me4Ck/+xH1L01AA8wxy:L39zAZrOlmwwJTdqt+xW/t+sYHtgO
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe -
Loads dropped DLL 3 IoCs
pid Process 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 2496 MsiExec.exe 2496 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1700 MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1700 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1700 MSIEXEC.EXE Token: SeRestorePrivilege 2628 msiexec.exe Token: SeTakeOwnershipPrivilege 2628 msiexec.exe Token: SeSecurityPrivilege 2628 msiexec.exe Token: SeCreateTokenPrivilege 1700 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 1700 MSIEXEC.EXE Token: SeLockMemoryPrivilege 1700 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1700 MSIEXEC.EXE Token: SeMachineAccountPrivilege 1700 MSIEXEC.EXE Token: SeTcbPrivilege 1700 MSIEXEC.EXE Token: SeSecurityPrivilege 1700 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 1700 MSIEXEC.EXE Token: SeLoadDriverPrivilege 1700 MSIEXEC.EXE Token: SeSystemProfilePrivilege 1700 MSIEXEC.EXE Token: SeSystemtimePrivilege 1700 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 1700 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 1700 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 1700 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 1700 MSIEXEC.EXE Token: SeBackupPrivilege 1700 MSIEXEC.EXE Token: SeRestorePrivilege 1700 MSIEXEC.EXE Token: SeShutdownPrivilege 1700 MSIEXEC.EXE Token: SeDebugPrivilege 1700 MSIEXEC.EXE Token: SeAuditPrivilege 1700 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 1700 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 1700 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 1700 MSIEXEC.EXE Token: SeUndockPrivilege 1700 MSIEXEC.EXE Token: SeSyncAgentPrivilege 1700 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 1700 MSIEXEC.EXE Token: SeManageVolumePrivilege 1700 MSIEXEC.EXE Token: SeImpersonatePrivilege 1700 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 1700 MSIEXEC.EXE Token: SeCreateTokenPrivilege 1700 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 1700 MSIEXEC.EXE Token: SeLockMemoryPrivilege 1700 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1700 MSIEXEC.EXE Token: SeMachineAccountPrivilege 1700 MSIEXEC.EXE Token: SeTcbPrivilege 1700 MSIEXEC.EXE Token: SeSecurityPrivilege 1700 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 1700 MSIEXEC.EXE Token: SeLoadDriverPrivilege 1700 MSIEXEC.EXE Token: SeSystemProfilePrivilege 1700 MSIEXEC.EXE Token: SeSystemtimePrivilege 1700 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 1700 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 1700 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 1700 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 1700 MSIEXEC.EXE Token: SeBackupPrivilege 1700 MSIEXEC.EXE Token: SeRestorePrivilege 1700 MSIEXEC.EXE Token: SeShutdownPrivilege 1700 MSIEXEC.EXE Token: SeDebugPrivilege 1700 MSIEXEC.EXE Token: SeAuditPrivilege 1700 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 1700 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 1700 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 1700 MSIEXEC.EXE Token: SeUndockPrivilege 1700 MSIEXEC.EXE Token: SeSyncAgentPrivilege 1700 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 1700 MSIEXEC.EXE Token: SeManageVolumePrivilege 1700 MSIEXEC.EXE Token: SeImpersonatePrivilege 1700 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 1700 MSIEXEC.EXE Token: SeCreateTokenPrivilege 1700 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2220 wrote to memory of 2548 2220 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 28 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2548 wrote to memory of 1700 2548 3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe 29 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31 PID 2628 wrote to memory of 2496 2628 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe"C:\Users\Admin\AppData\Local\Temp\3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\{B705813C-3411-42D1-ACEE-0E1A9EFD216A}\3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exeC:\Users\Admin\AppData\Local\Temp\{B705813C-3411-42D1-ACEE-0E1A9EFD216A}\3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe /q"C:\Users\Admin\AppData\Local\Temp\3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{B705813C-3411-42D1-ACEE-0E1A9EFD216A}" /IS_temp2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{7C349C85-E355-435F-841B-DD95D51A60F5}\HP_DockAccessoryWMIProvider.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe"3⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1700
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F35227124EDB1C6EF47DA0593C8181F8 C2⤵
- Loads dropped DLL
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Downloaded Installations\{7C349C85-E355-435F-841B-DD95D51A60F5}\HP_DockAccessoryWMIProvider.msi
Filesize1.1MB
MD5078b60501d9916189a2e9e0a34f1ba31
SHA167504dba1ceef484600676bf02a9e7891be25776
SHA25662aca9491484301ade44ce8b6edc04630a2656dffe7e16ce54c4900d75aad53d
SHA512aca537da7796c48cf772360d7d60f1d7aa64247b6fae435dc69ebbc17742425cba9b0788e9f34d5e76c9d657c2cbaebf96ff33b02126b3c5fe846c3da8104a99
-
Filesize
173KB
MD5d07d2c85ea1c0af02a99b6cf78ae79ef
SHA13ac922fc33789b61eb62085f3e49bca6aba4b4a9
SHA2565a36c709648e40ec1224855fb77e7420ee53e267c185f31c2c016115fba4af38
SHA512029bed817c10eebabd39a6c819eda3d76b09c7e34d182ec31c9f7d96fed530cd35feed88891ec61b6fb0d86ba44a07bfe3882e6fb3d9f0e41d48d2a99453789a
-
Filesize
167KB
MD5e80f90724939d4f85fc49de2460b94b5
SHA1512ea4deba1c97cc7ec394bce0e4a32cd497176e
SHA2568041d3ccbafa491d35f70030c3afeba683b0235bed24f242878d04c7e87b8687
SHA5129494f1cd058dc3923e4f562d8ed2edf3d252f519efc6db4f1b5289d8a1b841a6cb927e14d33dab98e0bd4d22a5a473b8cd9424f77213527fbe0c183126356767
-
Filesize
21KB
MD5a108f0030a2cda00405281014f897241
SHA1d112325fa45664272b08ef5e8ff8c85382ebb991
SHA2568b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
SHA512d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298
-
Filesize
828B
MD59a8c4453203d611571c08591e60c046f
SHA16be726670d8e473fa94a1999bbbbdb787fcae18e
SHA256c50697b1cd2d6516d669fd9f68748da4e69b5f693371d8e867f888c2ca1d4ab6
SHA512af5e1a4be90d5988d06057c90063e8875ecd71eebb156952f0ad4ba8d89194ad90d923bda9bb52d0ca0d427e2f586874f9c97a02496c07ea485a98065e32f458
-
Filesize
5KB
MD5da995277cd11cb471f6ad99dfe735eb3
SHA167a7b3f463c0caa4ed889cef6d41390295c5f224
SHA25617ebfb0fbb17c9265d78ff5397683c3331b324177da0a6a9f59b48ba44c90a49
SHA5125a02cc0fec4ddb84dd21d5f0a50b2844633bb03218405165ae012d38e058ad3e80efce616786fac9d5c6c73a71f77b86d022ea8267dd832ce389a2cbb1b62130
-
\Users\Admin\AppData\Local\Temp\{B705813C-3411-42D1-ACEE-0E1A9EFD216A}\3718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd.exe
Filesize1.6MB
MD5f2fd7dae9e4bc8cbac68a6a5a82edcdf
SHA1f9c5a6d6ea80afbb983da65aa126b4187f2419a0
SHA2563718ba20c5c578a8cbfe21d13d383be2822cfd2f346c2e65d817dbfdfea082fd
SHA512ce861fc951759881c59a7613cdaeb2436ae25bb14101bbb2ff62f5bbae6504d51ecad7e9d3965d7edfb644e016ada6f275b5e9b4529289f6b5ed37f91c690589