Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
SpyBossProDemo.msi
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SpyBossProDemo.msi
Resource
win10v2004-20240221-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
SpyBossProDemo.msi
-
Size
4.9MB
-
MD5
cf943448079d0e2ba5e6e688901341bd
-
SHA1
7e3d81367183b50f92b03bb98fd5f48387766ec0
-
SHA256
6d508d1f6468c5efd283f0c699d8c845c84648a7d35291b724387ac0a85e9dd0
-
SHA512
1e8933121bba983af6e484e0a83797893ef2a79fd9b738b4e7515e831f620cefbc590a84a581003df5b3512c671059632ca879dd01fbcf6b808dab7ae9abc17e
-
SSDEEP
98304:Y7rFzR0ZUUA/upvvNdlbTpTzZwFFeYb7zDZ:Y7BR0ZLAur9TzqFXXZ
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2508 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2340 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2340 msiexec.exe Token: SeIncreaseQuotaPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2844 msiexec.exe Token: SeTakeOwnershipPrivilege 2844 msiexec.exe Token: SeSecurityPrivilege 2844 msiexec.exe Token: SeCreateTokenPrivilege 2340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2340 msiexec.exe Token: SeLockMemoryPrivilege 2340 msiexec.exe Token: SeIncreaseQuotaPrivilege 2340 msiexec.exe Token: SeMachineAccountPrivilege 2340 msiexec.exe Token: SeTcbPrivilege 2340 msiexec.exe Token: SeSecurityPrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeLoadDriverPrivilege 2340 msiexec.exe Token: SeSystemProfilePrivilege 2340 msiexec.exe Token: SeSystemtimePrivilege 2340 msiexec.exe Token: SeProfSingleProcessPrivilege 2340 msiexec.exe Token: SeIncBasePriorityPrivilege 2340 msiexec.exe Token: SeCreatePagefilePrivilege 2340 msiexec.exe Token: SeCreatePermanentPrivilege 2340 msiexec.exe Token: SeBackupPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeShutdownPrivilege 2340 msiexec.exe Token: SeDebugPrivilege 2340 msiexec.exe Token: SeAuditPrivilege 2340 msiexec.exe Token: SeSystemEnvironmentPrivilege 2340 msiexec.exe Token: SeChangeNotifyPrivilege 2340 msiexec.exe Token: SeRemoteShutdownPrivilege 2340 msiexec.exe Token: SeUndockPrivilege 2340 msiexec.exe Token: SeSyncAgentPrivilege 2340 msiexec.exe Token: SeEnableDelegationPrivilege 2340 msiexec.exe Token: SeManageVolumePrivilege 2340 msiexec.exe Token: SeImpersonatePrivilege 2340 msiexec.exe Token: SeCreateGlobalPrivilege 2340 msiexec.exe Token: SeCreateTokenPrivilege 2340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2340 msiexec.exe Token: SeLockMemoryPrivilege 2340 msiexec.exe Token: SeIncreaseQuotaPrivilege 2340 msiexec.exe Token: SeMachineAccountPrivilege 2340 msiexec.exe Token: SeTcbPrivilege 2340 msiexec.exe Token: SeSecurityPrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeLoadDriverPrivilege 2340 msiexec.exe Token: SeSystemProfilePrivilege 2340 msiexec.exe Token: SeSystemtimePrivilege 2340 msiexec.exe Token: SeProfSingleProcessPrivilege 2340 msiexec.exe Token: SeIncBasePriorityPrivilege 2340 msiexec.exe Token: SeCreatePagefilePrivilege 2340 msiexec.exe Token: SeCreatePermanentPrivilege 2340 msiexec.exe Token: SeBackupPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeShutdownPrivilege 2340 msiexec.exe Token: SeDebugPrivilege 2340 msiexec.exe Token: SeAuditPrivilege 2340 msiexec.exe Token: SeSystemEnvironmentPrivilege 2340 msiexec.exe Token: SeChangeNotifyPrivilege 2340 msiexec.exe Token: SeRemoteShutdownPrivilege 2340 msiexec.exe Token: SeUndockPrivilege 2340 msiexec.exe Token: SeSyncAgentPrivilege 2340 msiexec.exe Token: SeEnableDelegationPrivilege 2340 msiexec.exe Token: SeManageVolumePrivilege 2340 msiexec.exe Token: SeImpersonatePrivilege 2340 msiexec.exe Token: SeCreateGlobalPrivilege 2340 msiexec.exe Token: SeCreateTokenPrivilege 2340 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2508 2844 msiexec.exe 29 PID 2844 wrote to memory of 2508 2844 msiexec.exe 29 PID 2844 wrote to memory of 2508 2844 msiexec.exe 29 PID 2844 wrote to memory of 2508 2844 msiexec.exe 29 PID 2844 wrote to memory of 2508 2844 msiexec.exe 29 PID 2844 wrote to memory of 2508 2844 msiexec.exe 29 PID 2844 wrote to memory of 2508 2844 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SpyBossProDemo.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2340
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 96527117CFE934C027221C5EF481D024 C2⤵
- Loads dropped DLL
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD55e0489d87816caabf2ff6644e64498f8
SHA198763541ab9b96aefc795f46ec9e6dc3809ed08e
SHA25697a54996d2c8cee8db48ac4818f0471fef4acf6088665dfa6c64c17135ebe609
SHA512da198aa0203887afcfbe1b2e376d4e5bd0e1b3952baf9100564849e4e2fb4d2e266a662bb200c4b3d41f343d4514043fcc7c76615c95f37e81e4537ed99f442b