Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

7z2201-x64.msi

windows11-21h2-x64

6

Analysis

  • max time kernel
    209s
  • max time network
    203s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24/02/2024, 14:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7z2201-x64.msi

  • Size

    1.8MB

  • MD5

    50515f156ae516461e28dd453230d448

  • SHA1

    3209574e09ec235b2613570e6d7d8d5058a64971

  • SHA256

    f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

  • SHA512

    14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

  • SSDEEP

    49152:ynV9R5GSuwYgV4mN4eOYq4Z0APsx/Eho:ynV9Ro/mTlbqC04s/

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7z2201-x64.msi
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4404
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3408
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57ba96.rbs
      Filesize

      28KB

      MD5

      894704b758dbcbdc03d5bfb5d106a9e3

      SHA1

      534799331adad46904595cad0b91d5271e9d4cbf

      SHA256

      34a4f1d2ef4ace51f765e78876f6c6b06c2ee7dd441b9c1f9c88bf36e8735344

      SHA512

      fa1c996b93b4d671536f76c8356ca8de26987b97598850105337ea9b1629ece9057c06452a63f82c4fff5de2cb47016217bc4e656b421c746b4a47403567ae4a

      Download Submit

    • C:\Windows\Installer\e57bae3.msi
      Filesize

      1.8MB

      MD5

      50515f156ae516461e28dd453230d448

      SHA1

      3209574e09ec235b2613570e6d7d8d5058a64971

      SHA256

      f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

      SHA512

      14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      12.0MB

      MD5

      3b4b43baa75804e6ded6f48b360666d4

      SHA1

      c10c6e65c87f4767104119abbea8c6855c525070

      SHA256

      2a1e4d5f7c0501167006200964b8e442d74b2721c24f7d8ff1f30b0e7a1c6de3

      SHA512

      dfd32c5c41b24211250f09eda4fd3b9419425a59c28d0fb4ffbf39a29a9fbe33fa53c6fce82c31375bf3432c658084c102f4d051cd946d196cfb2dcd27da1f0b

      Download Submit

    • \??\Volume{5b6aa2a0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{56adbb62-e4b1-4334-af3c-83713e608179}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      4b823aee3a99017d9099a972751f6015

      SHA1

      fad18881036866069562e33b37f3353bba1e92ef

      SHA256

      fc5a9721d9f15dcec1c5c83f488e48fe26bff1d430a75de9aa3e5d7fed3b9871

      SHA512

      5422e450775c9a3668809eae9ec63e945c1ab4633de353c9f1a5c89e5b60af1eb53e7d9cc207c7bccf779134f13bda9e69c9952b2db66b2f6da89c7a9665dc40

      Download Submit