Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 04:42

General

  • Target

    94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi

  • Size

    1.5MB

  • MD5

    9c8696dbb48add540a75737327c537d2

  • SHA1

    78b4eb7d363e017eb06e03408d7952bbb843f9a9

  • SHA256

    94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a

  • SHA512

    6ee26ecedd0386eca113e61086f6623b36ca093d24e41d90cf45412072d94d91dddb39c86ce726c3514da3d0221d3cf03455b00cc5d0987ca63d45c12225cf4a

  • SSDEEP

    49152:yErvYpW8zBQSc0ZnSKeZKumZr7Amyq3TGtezO:RYQ0ZncK/AEs

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3028
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5C9F27F35EB203FC29A58C86C1D00FA7 C
      2⤵
      • Loads dropped DLL
      PID:2084
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B16F527471AB4DD03CFC27D4BBDBB6F4
      2⤵
      • Loads dropped DLL
      PID:1292
    • C:\Windows\Installer\MSI3AA3.tmp
      "C:\Windows\Installer\MSI3AA3.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\Putty/setordinal.dll,bhuf
      2⤵
      • Executes dropped EXE
      PID:1436
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2904
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005AC" "0000000000000598"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:2328
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Putty/setordinal.dll,bhuf
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2024

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f7638fd.rbs

      Filesize

      1KB

      MD5

      4869523c0da9594d811e2a0fb4093afd

      SHA1

      d5a0e98bd31dfa8cdef9f14d0e600d6f2bc39a24

      SHA256

      8a4adc7cf17b4753f5bdced28c2b8163d1f8544d3d6ddf3ea7d1e6ed8fc12c33

      SHA512

      78af52a506959143a4fedc55f77048b197880e587a3668a754f005c359cdb7957f722ce15fe82c2ba84aad8735ca7dc589aa65cf7f7df5c48dff953cc501c4f1

    • C:\Users\Admin\AppData\Local\Putty\setordinal.dll

      Filesize

      244KB

      MD5

      0a5f66e19cd3735368fa914c5498f1ea

      SHA1

      ceeff5eb9e659315c9c8836ae6c6c779b0bcdb21

      SHA256

      0aeca3798920903e15ace806dfaa8ce8b82a50e18d52ea8fd6e7db0db9733269

      SHA512

      866014b77003e71fe6436fd086921e341309d29887d8be7ee63b2c933d187941f5343b38e598eb68625ea0c00d24341afa3982bda77f57eef929d4707b25095f

    • C:\Users\Admin\AppData\Local\Temp\MSI1120.tmp

      Filesize

      88KB

      MD5

      c6a81ff3e97ec5ef413dbc32d242907b

      SHA1

      f36f32d70b2bfee273432a05df7af31e02bdea47

      SHA256

      dd076122981532d42f8c4c746979c0f19df40bc7dd745aa1f283bf815121c6d6

      SHA512

      a46dd62c2449e42951f0ef51612d37ccb9c15ef92a0cef4e461cdcc1af288a4793aa15c6b970fa3ac7a8236d305c93ded71f992d0e6cf76e05dbbdbda68a7eaa

    • C:\Users\Admin\AppData\Local\Temp\MSI120B.tmp

      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

    • C:\Windows\Installer\MSI3AA3.tmp

      Filesize

      182KB

      MD5

      803e4e60de0909c55c4b088f3094d837

      SHA1

      4c4c65483b2125c5fa52af897ac926e3889a6459

      SHA256

      2997e36354c884fa6f09245a1d8758eeb8ca00d20197969ff7b90664d4ae9b80

      SHA512

      4fd69bf880ae1f400ee88f758bde2d093d996e920b6c3080c84497afccd3c9a5e6421e729d44384b00f61a4343cf72acf3eade9ed85e2caed2d6266333c0404a

    • C:\Windows\Installer\MSI3AA3.tmp

      Filesize

      273KB

      MD5

      ad0b98b2709e0bfd99e69503ffeb020d

      SHA1

      08707cf7d84981801a4ee2eac3e1076768a3b3da

      SHA256

      f2a146349698d30bfed801955b194c21e0c8d2d007253f8bcc2d6dc0de091bd0

      SHA512

      df5bbd8613fa1d9749c42ef97b16f8dcc392b4198e5d6f83b03625f8cad4ff2c13e2eccb9e852f375bc84ad497e934cac84aa3f61f661e0bcb542e4d1d8105f3

    • \Users\Admin\AppData\Local\Putty\setordinal.dll

      Filesize

      244KB

      MD5

      8441c0f057354de2d61fd3be7e83f1f7

      SHA1

      4fb0575e5135cdee84755adca876e1564380f832

      SHA256

      0d3f3c66b8c0c17eb418cbbba723e2bedb144f482a54eec8e46eca6ab65d8d3b

      SHA512

      1bca0e058b596fcf083e498ab08aa8acbe702354d56d815e332fc3f7275e72e0aa0b4e352d1e9f4a962bb45bfaf352c6c8a0f7e68e366d26024be70008855a26

    • \Users\Admin\AppData\Local\Putty\setordinal.dll

      Filesize

      215KB

      MD5

      d1a17e143babbfcbf69e4669ced7b7d3

      SHA1

      a2b15e979d9ce313ff91b4711380cdbf1640e06f

      SHA256

      c0e3cdcc04148361641d65271e5365ce445febdd078219db3d9ca8c027406814

      SHA512

      9b4faaf13015e16a9be2c37862f013f34cbcfdad89189f2ca00c290d4dce86be404d5773d3b2a07519762c17ded59e859ebf18df2de531205f7d0110a0375277

    • \Users\Admin\AppData\Local\Putty\setordinal.dll

      Filesize

      262KB

      MD5

      970e0f8d99927b624a8987a3fc2d37b6

      SHA1

      40444ff10b205c3c9e20cdd15afafc64e24ac30f

      SHA256

      683387de5501a7d93c259a0088aaeacfdb8bd0341aed35160f1347085d3eee0a

      SHA512

      55f412d2f44b12065a2e16b99e85ff617faf58cad63eacc89ce2d6878b4c493bcb788d4fead96256b32d809866d92911150078bf9c31902667531393ac1953c0

    • \Users\Admin\AppData\Local\Putty\setordinal.dll

      Filesize

      161KB

      MD5

      1e44fd78f8fdcaf04f45c9f1fbebf9e8

      SHA1

      19398a629a1e3b52f32a9ddfc13ccac6f336072d

      SHA256

      d3a54554e5692c989a8679fdd3598069650b09c994f531382e4989f92ad70def

      SHA512

      54d469355ac1517da22cb1062234837a211153c13a6d15c1fea7deb33c7066345e9c76642e229b0aaab6739c096688d657b692d6a5566465150da33415b2349c

    • \Users\Admin\AppData\Local\Temp\MSI1120.tmp

      Filesize

      51KB

      MD5

      72b139afef0a8136f5cd6d0f202c060e

      SHA1

      7ad5ccbb65807e606b99b742ae7f54b079d25d3c

      SHA256

      1d801f054e8468cb61b6123c2867b71cefc79545b7f2f0e3f7db0ef4e834b4cf

      SHA512

      2e53d6befe5730bb5050a4e46cb771c0b6489acb0cb5c2e8fc0cc222a4c599824030d44f419e32317320195a50faa30b440bddbfb70fef9eb6bcc6e934facbb8

    • memory/1436-50-0x00000000000B0000-0x00000000000B2000-memory.dmp

      Filesize

      8KB

    • memory/2024-60-0x00000000002A0000-0x00000000002B1000-memory.dmp

      Filesize

      68KB

    • memory/2024-61-0x0000000001E20000-0x0000000001E33000-memory.dmp

      Filesize

      76KB

    • memory/2024-56-0x00000000002C0000-0x00000000002D4000-memory.dmp

      Filesize

      80KB