Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi
-
Size
1.5MB
-
MD5
9c8696dbb48add540a75737327c537d2
-
SHA1
78b4eb7d363e017eb06e03408d7952bbb843f9a9
-
SHA256
94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a
-
SHA512
6ee26ecedd0386eca113e61086f6623b36ca093d24e41d90cf45412072d94d91dddb39c86ce726c3514da3d0221d3cf03455b00cc5d0987ca63d45c12225cf4a
-
SSDEEP
49152:yErvYpW8zBQSc0ZnSKeZKumZr7Amyq3TGtezO:RYQ0ZncK/AEs
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIE80F.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{875666CF-F53F-4ED6-B062-37C9D770DE93} msiexec.exe File opened for modification C:\Windows\Installer\MSIE9B7.tmp msiexec.exe File created C:\Windows\Installer\e57e6d6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE791.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE977.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57e6d6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1864 MSIE9B7.tmp -
Loads dropped DLL 10 IoCs
pid Process 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3476 MsiExec.exe 3476 MsiExec.exe 436 rundll32.exe 4456 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006c2b12180e4adb550000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006c2b12180000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006c2b1218000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6c2b1218000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006c2b121800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4808 msiexec.exe 4808 msiexec.exe 436 rundll32.exe 436 rundll32.exe 436 rundll32.exe 436 rundll32.exe 4456 rundll32.exe 4456 rundll32.exe 4456 rundll32.exe 4456 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 4808 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2820 msiexec.exe 2820 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4808 wrote to memory of 3068 4808 msiexec.exe 85 PID 4808 wrote to memory of 3068 4808 msiexec.exe 85 PID 4808 wrote to memory of 3068 4808 msiexec.exe 85 PID 4808 wrote to memory of 2136 4808 msiexec.exe 96 PID 4808 wrote to memory of 2136 4808 msiexec.exe 96 PID 4808 wrote to memory of 3476 4808 msiexec.exe 98 PID 4808 wrote to memory of 3476 4808 msiexec.exe 98 PID 4808 wrote to memory of 3476 4808 msiexec.exe 98 PID 4808 wrote to memory of 1864 4808 msiexec.exe 99 PID 4808 wrote to memory of 1864 4808 msiexec.exe 99 PID 4808 wrote to memory of 1864 4808 msiexec.exe 99 PID 436 wrote to memory of 4456 436 rundll32.exe 101 PID 436 wrote to memory of 4456 436 rundll32.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2820
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28C3501FCB42345605B7FD1A46C71958 C2⤵
- Loads dropped DLL
PID:3068
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2136
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53E181F1795F2F2B3395CC83F7255B262⤵
- Loads dropped DLL
PID:3476
-
-
C:\Windows\Installer\MSIE9B7.tmp"C:\Windows\Installer\MSIE9B7.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\Putty/setordinal.dll,bhuf2⤵
- Executes dropped EXE
PID:1864
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2792
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Putty/setordinal.dll,bhuf1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_1daae95d.dll", bhuf2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58051d286e8155689569dd3ee743e361a
SHA1e71be2501e58d58d24476f0335316a01b1beb7a8
SHA25604ddc2f6effa4b7eccd38f10962d5de3d8cfd04718550e4d8e906bdb56ad7cc5
SHA5124c088a2164a71c5fa04208e0b578ddf7dd57b2362c0ee1ba6ba37ae3b0729ed4b5c47ec372f1c5451c6b6066ac1e1f900b9658cfaefdfae272198756777c01a1
-
Filesize
809KB
MD54b8ecaac3e8a17382932e3daa29dc688
SHA13ed854b6fda284fdad105cb158949edd9276cd67
SHA25661925bfd71b4d2be670b0bd373b33645d6af062e5d41cb2b6f6c984acbd69de3
SHA512de0459c85786c97ff1b5b0051139fb30fb56cfba45b56384adf8d813faadda0fde80fe9c5fb99aba356d8f0e43f61a8b1bdc232cf12d5f3ba4c99403d9c7a8e1
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5878734ecdf395ec53cfcd372d4cad0fe
SHA1ef9b76102848c83a5ac6d3001db78317ac5e1b80
SHA256057ef4498b53d426eb6f510a81161c35994028742291fdcf47ac172c3ee7ba3d
SHA512c58a773922eca503310c340370b6d57e2f8177cad02dbe680d7db3d334373ac6963481b2cd0564bccc0d0e7730192d99120faeec2db462892244d1434c1bac6d
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
23.0MB
MD50b6c2c0573c7d33314415c560b2d998a
SHA1bdcd07af6dfb199021466bdc17390c0eb2c3a632
SHA2569f451c13d30907320e6e30d0b5c648f94a90bd209163b0a03dfeaee39f949bf6
SHA512be40bddc872ea82e18a4e18d2b7ec1734767765eddb41523fcf055e18a487a77a3596291abadfc838508e3a6e9502e04f853bede05b2e201c458bbbc26a1e621
-
\??\Volume{18122b6c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a450339d-942c-4f21-809d-756cf414064a}_OnDiskSnapshotProp
Filesize6KB
MD5174ab9326afe0eab4c2426e6cef9b343
SHA1cf43935413e1f21d7cf79a7741d281205606408b
SHA256e65787b94c55931a864d5fe3493b47be986317ca476952f6f370f3b13c125da5
SHA5127ea7684dadcef68919fe58b9cb39e0c4f8856339ac669e9a6ed1b2507a18e1895709b893dd312506b10f9d83d07eb016733c5d765d038f3aae1fcec450caa810