Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
OInstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OInstall.exe
Resource
win10v2004-20240226-en
General
-
Target
OInstall.exe
-
Size
30.4MB
-
MD5
11002d91453bc60e8e581d24a21d0b58
-
SHA1
33767ec31bc367af24c44c30143f0f4966e1e2b2
-
SHA256
05a747f54188d9e72c3f582fef65b686885ff7fab849f129e1eadd9526867295
-
SHA512
0b628e060149b3473f4d9564c3eebbe4af1bd55b634676c9848d8137288f425bc8c856016b9a1cd7d11e8170c6ddcc3c343b33fb1fc2200b8d790a1f8965bbbe
-
SSDEEP
786432:2vRkdObGXYztqYMa0qGFPt7lgx+SSuiy2Qx7dH//q:gkd4zdMzqGJt7lgLSuiy2Qx7dH//q
Malware Config
Extracted
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 19 4468 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 5000 files.dat -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 powershell.exe 4468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2824 WMIC.exe Token: SeSecurityPrivilege 2824 WMIC.exe Token: SeTakeOwnershipPrivilege 2824 WMIC.exe Token: SeLoadDriverPrivilege 2824 WMIC.exe Token: SeSystemProfilePrivilege 2824 WMIC.exe Token: SeSystemtimePrivilege 2824 WMIC.exe Token: SeProfSingleProcessPrivilege 2824 WMIC.exe Token: SeIncBasePriorityPrivilege 2824 WMIC.exe Token: SeCreatePagefilePrivilege 2824 WMIC.exe Token: SeBackupPrivilege 2824 WMIC.exe Token: SeRestorePrivilege 2824 WMIC.exe Token: SeShutdownPrivilege 2824 WMIC.exe Token: SeDebugPrivilege 2824 WMIC.exe Token: SeSystemEnvironmentPrivilege 2824 WMIC.exe Token: SeRemoteShutdownPrivilege 2824 WMIC.exe Token: SeUndockPrivilege 2824 WMIC.exe Token: SeManageVolumePrivilege 2824 WMIC.exe Token: 33 2824 WMIC.exe Token: 34 2824 WMIC.exe Token: 35 2824 WMIC.exe Token: 36 2824 WMIC.exe Token: SeIncreaseQuotaPrivilege 2824 WMIC.exe Token: SeSecurityPrivilege 2824 WMIC.exe Token: SeTakeOwnershipPrivilege 2824 WMIC.exe Token: SeLoadDriverPrivilege 2824 WMIC.exe Token: SeSystemProfilePrivilege 2824 WMIC.exe Token: SeSystemtimePrivilege 2824 WMIC.exe Token: SeProfSingleProcessPrivilege 2824 WMIC.exe Token: SeIncBasePriorityPrivilege 2824 WMIC.exe Token: SeCreatePagefilePrivilege 2824 WMIC.exe Token: SeBackupPrivilege 2824 WMIC.exe Token: SeRestorePrivilege 2824 WMIC.exe Token: SeShutdownPrivilege 2824 WMIC.exe Token: SeDebugPrivilege 2824 WMIC.exe Token: SeSystemEnvironmentPrivilege 2824 WMIC.exe Token: SeRemoteShutdownPrivilege 2824 WMIC.exe Token: SeUndockPrivilege 2824 WMIC.exe Token: SeManageVolumePrivilege 2824 WMIC.exe Token: 33 2824 WMIC.exe Token: 34 2824 WMIC.exe Token: 35 2824 WMIC.exe Token: 36 2824 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe Token: SeSecurityPrivilege 2240 WMIC.exe Token: SeTakeOwnershipPrivilege 2240 WMIC.exe Token: SeLoadDriverPrivilege 2240 WMIC.exe Token: SeSystemProfilePrivilege 2240 WMIC.exe Token: SeSystemtimePrivilege 2240 WMIC.exe Token: SeProfSingleProcessPrivilege 2240 WMIC.exe Token: SeIncBasePriorityPrivilege 2240 WMIC.exe Token: SeCreatePagefilePrivilege 2240 WMIC.exe Token: SeBackupPrivilege 2240 WMIC.exe Token: SeRestorePrivilege 2240 WMIC.exe Token: SeShutdownPrivilege 2240 WMIC.exe Token: SeDebugPrivilege 2240 WMIC.exe Token: SeSystemEnvironmentPrivilege 2240 WMIC.exe Token: SeRemoteShutdownPrivilege 2240 WMIC.exe Token: SeUndockPrivilege 2240 WMIC.exe Token: SeManageVolumePrivilege 2240 WMIC.exe Token: 33 2240 WMIC.exe Token: 34 2240 WMIC.exe Token: 35 2240 WMIC.exe Token: 36 2240 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1832 wrote to memory of 4264 1832 OInstall.exe 89 PID 1832 wrote to memory of 4264 1832 OInstall.exe 89 PID 1832 wrote to memory of 1868 1832 OInstall.exe 91 PID 1832 wrote to memory of 1868 1832 OInstall.exe 91 PID 4264 wrote to memory of 2824 4264 cmd.exe 93 PID 4264 wrote to memory of 2824 4264 cmd.exe 93 PID 1832 wrote to memory of 4580 1832 OInstall.exe 94 PID 1832 wrote to memory of 4580 1832 OInstall.exe 94 PID 4580 wrote to memory of 5000 4580 cmd.exe 97 PID 4580 wrote to memory of 5000 4580 cmd.exe 97 PID 4580 wrote to memory of 5000 4580 cmd.exe 97 PID 1832 wrote to memory of 1584 1832 OInstall.exe 98 PID 1832 wrote to memory of 1584 1832 OInstall.exe 98 PID 1584 wrote to memory of 2240 1584 cmd.exe 100 PID 1584 wrote to memory of 2240 1584 cmd.exe 100 PID 1832 wrote to memory of 4468 1832 OInstall.exe 101 PID 1832 wrote to memory of 4468 1832 OInstall.exe 101 PID 1832 wrote to memory of 4468 1832 OInstall.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\OInstall.exe"C:\Users\Admin\AppData\Local\Temp\OInstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f2⤵PID:1868
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto2⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\files\files.datfiles.dat -y -pkmsauto3⤵
- Executes dropped EXE
PID:5000
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
765KB
MD5bb5569b15d68c10b7ff2d96b45825120
SHA1d6d2ed450aae4552f550f59bffe3dd42d8377835
SHA2564e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
SHA512640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
-
Filesize
55KB
MD583013b9c842c110ffcc3259605d36e29
SHA14af8ccf2260bd6a7cd27a4489b034bc33a80d09c
SHA25640f8ee2db6c77b62d285ff3b8f5d83c219542b25c066b1b3f4181eb2996645b5
SHA51274f13a3ec2fc2231cf4d756853d849eb9d515cfec9e2b4376777266fe496a5c17c47365e83159f70a7d64aa286f58e6e8cc6c205e147b074d451c45acf438ce8