Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
ed531801b5b3b9d9acf36c8a26b184cea8d6eb639efb7b8d95a4c3c15bef0f02.msi
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
ed531801b5b3b9d9acf36c8a26b184cea8d6eb639efb7b8d95a4c3c15bef0f02.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
ed531801b5b3b9d9acf36c8a26b184cea8d6eb639efb7b8d95a4c3c15bef0f02.msi
-
Size
5.9MB
-
MD5
0d447d480c60b9a215a27274452e0cef
-
SHA1
a8b374a55c3733a18208df26fb084ae7ca578337
-
SHA256
ed531801b5b3b9d9acf36c8a26b184cea8d6eb639efb7b8d95a4c3c15bef0f02
-
SHA512
91a9d640a68dcf210682011d5dba3fd948670577bce50eb1502819e2115d6a74475ce671c3c56bce74be1eab7860989c3d135dd9a73b962c6b544b434fa5cf41
-
SSDEEP
49152:azwWZizIP+y0IZJSKcrEu/RUoVX8noNWzbh5mCv9UyrlYSlZAvmKnoX8r6F5mCmR:ddk+OoVX8noWdv3dAvko6cYvA
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 928 MsiExec.exe 928 MsiExec.exe 928 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA90D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e583321.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI43DA.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{771819A7-1CFB-4868-B552-AFB790161ED4} msiexec.exe File opened for modification C:\Windows\Installer\MSID186.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD1F.tmp msiexec.exe File created C:\Windows\Installer\e583321.msi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1132 msiexec.exe 1132 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 3648 msiexec.exe Token: SeIncreaseQuotaPrivilege 3648 msiexec.exe Token: SeSecurityPrivilege 1132 msiexec.exe Token: SeCreateTokenPrivilege 3648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3648 msiexec.exe Token: SeLockMemoryPrivilege 3648 msiexec.exe Token: SeIncreaseQuotaPrivilege 3648 msiexec.exe Token: SeMachineAccountPrivilege 3648 msiexec.exe Token: SeTcbPrivilege 3648 msiexec.exe Token: SeSecurityPrivilege 3648 msiexec.exe Token: SeTakeOwnershipPrivilege 3648 msiexec.exe Token: SeLoadDriverPrivilege 3648 msiexec.exe Token: SeSystemProfilePrivilege 3648 msiexec.exe Token: SeSystemtimePrivilege 3648 msiexec.exe Token: SeProfSingleProcessPrivilege 3648 msiexec.exe Token: SeIncBasePriorityPrivilege 3648 msiexec.exe Token: SeCreatePagefilePrivilege 3648 msiexec.exe Token: SeCreatePermanentPrivilege 3648 msiexec.exe Token: SeBackupPrivilege 3648 msiexec.exe Token: SeRestorePrivilege 3648 msiexec.exe Token: SeShutdownPrivilege 3648 msiexec.exe Token: SeDebugPrivilege 3648 msiexec.exe Token: SeAuditPrivilege 3648 msiexec.exe Token: SeSystemEnvironmentPrivilege 3648 msiexec.exe Token: SeChangeNotifyPrivilege 3648 msiexec.exe Token: SeRemoteShutdownPrivilege 3648 msiexec.exe Token: SeUndockPrivilege 3648 msiexec.exe Token: SeSyncAgentPrivilege 3648 msiexec.exe Token: SeEnableDelegationPrivilege 3648 msiexec.exe Token: SeManageVolumePrivilege 3648 msiexec.exe Token: SeImpersonatePrivilege 3648 msiexec.exe Token: SeCreateGlobalPrivilege 3648 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe Token: SeRestorePrivilege 1132 msiexec.exe Token: SeTakeOwnershipPrivilege 1132 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3648 msiexec.exe 3648 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1132 wrote to memory of 928 1132 msiexec.exe 88 PID 1132 wrote to memory of 928 1132 msiexec.exe 88 PID 1132 wrote to memory of 928 1132 msiexec.exe 88
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ed531801b5b3b9d9acf36c8a26b184cea8d6eb639efb7b8d95a4c3c15bef0f02.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3648
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C049C3C84CEC8C6D17F8C334229BFC442⤵
- Loads dropped DLL
PID:928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852B
MD5bf0564d98c75e61c43c0371819d50ce3
SHA1ee3e56ec0c811259e0a153eb09bbd32184a8e3f2
SHA25681627ca9a0665ba85d7f3c18f3094e1f126b2f220412a421323c392911d7dd98
SHA51255825840d6c5e1530b581bf3c4a66f7bb4560e22966a011424893e3a3445339079a1a14a7f819ebf647afdc8600edc20a8a6a35cfbf1f2157da353d34ac4a3b3
-
Filesize
557KB
MD52c9c51ac508570303c6d46c0571ea3a1
SHA1e3e0fe08fa11a43c8bca533f212bdf0704c726d5
SHA256ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
SHA512df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127
-
Filesize
5.1MB
MD54e8fd39447ba08a6d52191044f67925b
SHA1ca6cdc51b8c13c6bcc284481aa6fabbcb04ef6f2
SHA2564b9ae60ef6307880eded379b7a0fa3051fd5bfceb03b50598cb8e34330140a95
SHA512b059cf50c19e2a3124c16eb71dc5ff8ecb2396cea1d4be7f2f017a7f7917072780ab05aad732c72b7901a2fa7e8ced8718796152f0f7b9a11d6b7dab04e30b56