Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    305s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2024, 17:34

General

  • Target

    OInstall.exe

  • Size

    30.4MB

  • MD5

    11002d91453bc60e8e581d24a21d0b58

  • SHA1

    33767ec31bc367af24c44c30143f0f4966e1e2b2

  • SHA256

    05a747f54188d9e72c3f582fef65b686885ff7fab849f129e1eadd9526867295

  • SHA512

    0b628e060149b3473f4d9564c3eebbe4af1bd55b634676c9848d8137288f425bc8c856016b9a1cd7d11e8170c6ddcc3c343b33fb1fc2200b8d790a1f8965bbbe

  • SSDEEP

    786432:2vRkdObGXYztqYMa0qGFPt7lgx+SSuiy2Qx7dH//q:gkd4zdMzqGJt7lgLSuiy2Qx7dH//q

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OInstall.exe
    "C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2824
    • C:\Windows\system32\reg.exe
      "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
      2⤵
        PID:1868
      • C:\Windows\system32\cmd.exe
        "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Users\Admin\AppData\Local\Temp\files\files.dat
          files.dat -y -pkmsauto
          3⤵
          • Executes dropped EXE
          PID:5000
      • C:\Windows\system32\cmd.exe
        "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:4468

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zn4braj.45g.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\files\files.dat

      Filesize

      765KB

      MD5

      bb5569b15d68c10b7ff2d96b45825120

      SHA1

      d6d2ed450aae4552f550f59bffe3dd42d8377835

      SHA256

      4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e

      SHA512

      640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957

    • C:\Users\Admin\AppData\Local\Temp\ver.txt

      Filesize

      55KB

      MD5

      83013b9c842c110ffcc3259605d36e29

      SHA1

      4af8ccf2260bd6a7cd27a4489b034bc33a80d09c

      SHA256

      40f8ee2db6c77b62d285ff3b8f5d83c219542b25c066b1b3f4181eb2996645b5

      SHA512

      74f13a3ec2fc2231cf4d756853d849eb9d515cfec9e2b4376777266fe496a5c17c47365e83159f70a7d64aa286f58e6e8cc6c205e147b074d451c45acf438ce8

    • memory/4468-33-0x0000000004E30000-0x0000000005458000-memory.dmp

      Filesize

      6.2MB

    • memory/4468-47-0x0000000005D00000-0x0000000005D1E000-memory.dmp

      Filesize

      120KB

    • memory/4468-34-0x0000000004D70000-0x0000000004D92000-memory.dmp

      Filesize

      136KB

    • memory/4468-35-0x0000000005650000-0x00000000056B6000-memory.dmp

      Filesize

      408KB

    • memory/4468-36-0x00000000056C0000-0x0000000005726000-memory.dmp

      Filesize

      408KB

    • memory/4468-31-0x00000000735D0000-0x0000000073D80000-memory.dmp

      Filesize

      7.7MB

    • memory/4468-46-0x0000000005730000-0x0000000005A84000-memory.dmp

      Filesize

      3.3MB

    • memory/4468-32-0x00000000047F0000-0x0000000004800000-memory.dmp

      Filesize

      64KB

    • memory/4468-48-0x0000000005D40000-0x0000000005D8C000-memory.dmp

      Filesize

      304KB

    • memory/4468-49-0x00000000047F0000-0x0000000004800000-memory.dmp

      Filesize

      64KB

    • memory/4468-50-0x0000000007550000-0x0000000007BCA000-memory.dmp

      Filesize

      6.5MB

    • memory/4468-51-0x0000000006240000-0x000000000625A000-memory.dmp

      Filesize

      104KB

    • memory/4468-55-0x00000000735D0000-0x0000000073D80000-memory.dmp

      Filesize

      7.7MB

    • memory/4468-30-0x0000000004760000-0x0000000004796000-memory.dmp

      Filesize

      216KB