Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
SpyBossProDemo.msi
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SpyBossProDemo.msi
Resource
win10v2004-20240221-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
SpyBossProDemo.msi
-
Size
4.9MB
-
MD5
cf943448079d0e2ba5e6e688901341bd
-
SHA1
7e3d81367183b50f92b03bb98fd5f48387766ec0
-
SHA256
6d508d1f6468c5efd283f0c699d8c845c84648a7d35291b724387ac0a85e9dd0
-
SHA512
1e8933121bba983af6e484e0a83797893ef2a79fd9b738b4e7515e831f620cefbc590a84a581003df5b3512c671059632ca879dd01fbcf6b808dab7ae9abc17e
-
SSDEEP
98304:Y7rFzR0ZUUA/upvvNdlbTpTzZwFFeYb7zDZ:Y7BR0ZLAur9TzqFXXZ
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 456 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4476 msiexec.exe Token: SeIncreaseQuotaPrivilege 4476 msiexec.exe Token: SeSecurityPrivilege 4916 msiexec.exe Token: SeCreateTokenPrivilege 4476 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4476 msiexec.exe Token: SeLockMemoryPrivilege 4476 msiexec.exe Token: SeIncreaseQuotaPrivilege 4476 msiexec.exe Token: SeMachineAccountPrivilege 4476 msiexec.exe Token: SeTcbPrivilege 4476 msiexec.exe Token: SeSecurityPrivilege 4476 msiexec.exe Token: SeTakeOwnershipPrivilege 4476 msiexec.exe Token: SeLoadDriverPrivilege 4476 msiexec.exe Token: SeSystemProfilePrivilege 4476 msiexec.exe Token: SeSystemtimePrivilege 4476 msiexec.exe Token: SeProfSingleProcessPrivilege 4476 msiexec.exe Token: SeIncBasePriorityPrivilege 4476 msiexec.exe Token: SeCreatePagefilePrivilege 4476 msiexec.exe Token: SeCreatePermanentPrivilege 4476 msiexec.exe Token: SeBackupPrivilege 4476 msiexec.exe Token: SeRestorePrivilege 4476 msiexec.exe Token: SeShutdownPrivilege 4476 msiexec.exe Token: SeDebugPrivilege 4476 msiexec.exe Token: SeAuditPrivilege 4476 msiexec.exe Token: SeSystemEnvironmentPrivilege 4476 msiexec.exe Token: SeChangeNotifyPrivilege 4476 msiexec.exe Token: SeRemoteShutdownPrivilege 4476 msiexec.exe Token: SeUndockPrivilege 4476 msiexec.exe Token: SeSyncAgentPrivilege 4476 msiexec.exe Token: SeEnableDelegationPrivilege 4476 msiexec.exe Token: SeManageVolumePrivilege 4476 msiexec.exe Token: SeImpersonatePrivilege 4476 msiexec.exe Token: SeCreateGlobalPrivilege 4476 msiexec.exe Token: SeCreateTokenPrivilege 4476 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4476 msiexec.exe Token: SeLockMemoryPrivilege 4476 msiexec.exe Token: SeIncreaseQuotaPrivilege 4476 msiexec.exe Token: SeMachineAccountPrivilege 4476 msiexec.exe Token: SeTcbPrivilege 4476 msiexec.exe Token: SeSecurityPrivilege 4476 msiexec.exe Token: SeTakeOwnershipPrivilege 4476 msiexec.exe Token: SeLoadDriverPrivilege 4476 msiexec.exe Token: SeSystemProfilePrivilege 4476 msiexec.exe Token: SeSystemtimePrivilege 4476 msiexec.exe Token: SeProfSingleProcessPrivilege 4476 msiexec.exe Token: SeIncBasePriorityPrivilege 4476 msiexec.exe Token: SeCreatePagefilePrivilege 4476 msiexec.exe Token: SeCreatePermanentPrivilege 4476 msiexec.exe Token: SeBackupPrivilege 4476 msiexec.exe Token: SeRestorePrivilege 4476 msiexec.exe Token: SeShutdownPrivilege 4476 msiexec.exe Token: SeDebugPrivilege 4476 msiexec.exe Token: SeAuditPrivilege 4476 msiexec.exe Token: SeSystemEnvironmentPrivilege 4476 msiexec.exe Token: SeChangeNotifyPrivilege 4476 msiexec.exe Token: SeRemoteShutdownPrivilege 4476 msiexec.exe Token: SeUndockPrivilege 4476 msiexec.exe Token: SeSyncAgentPrivilege 4476 msiexec.exe Token: SeEnableDelegationPrivilege 4476 msiexec.exe Token: SeManageVolumePrivilege 4476 msiexec.exe Token: SeImpersonatePrivilege 4476 msiexec.exe Token: SeCreateGlobalPrivilege 4476 msiexec.exe Token: SeCreateTokenPrivilege 4476 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4476 msiexec.exe Token: SeLockMemoryPrivilege 4476 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4476 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4916 wrote to memory of 456 4916 msiexec.exe 89 PID 4916 wrote to memory of 456 4916 msiexec.exe 89 PID 4916 wrote to memory of 456 4916 msiexec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SpyBossProDemo.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4476
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CCA3FD1717590F74473731162F405770 C2⤵
- Loads dropped DLL
PID:456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD55e0489d87816caabf2ff6644e64498f8
SHA198763541ab9b96aefc795f46ec9e6dc3809ed08e
SHA25697a54996d2c8cee8db48ac4818f0471fef4acf6088665dfa6c64c17135ebe609
SHA512da198aa0203887afcfbe1b2e376d4e5bd0e1b3952baf9100564849e4e2fb4d2e266a662bb200c4b3d41f343d4514043fcc7c76615c95f37e81e4537ed99f442b