Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3QtCore4.dll
windows7-x64
3QtCore4.dll
windows10-2004-x64
3QtGui4.dll
windows7-x64
3QtGui4.dll
windows10-2004-x64
3QtNetwork4.dll
windows7-x64
3QtNetwork4.dll
windows10-2004-x64
3libeay32.dll
windows7-x64
1libeay32.dll
windows10-2004-x64
1nksl3_logger.exe
windows7-x64
9nksl3_logger.exe
windows10-2004-x64
9runtime/No..._0.msi
windows7-x64
6runtime/No..._0.msi
windows10-2004-x64
6runtime/handle.exe
windows7-x64
7runtime/handle.exe
windows10-2004-x64
7runtime/vc...08.exe
windows7-x64
7runtime/vc...08.exe
windows10-2004-x64
7ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
QtCore4.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
QtCore4.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
QtGui4.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
QtGui4.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
QtNetwork4.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
QtNetwork4.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
libeay32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
libeay32.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
nksl3_logger.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
nksl3_logger.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
runtime/Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
runtime/Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
runtime/handle.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
runtime/handle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
runtime/vcredist_x86_2008.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
runtime/vcredist_x86_2008.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ssleay32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
ssleay32.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
runtime/Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi
-
Size
7.7MB
-
MD5
80bb7bb30e33ac2b7bea51e6681b56bc
-
SHA1
9def00a0f350f845e27c421dbac170ca29e5f5ce
-
SHA256
876a015fc3380cab42b31e09a193990d93f2441b7066aec7b99b8b88b8d9e2c7
-
SHA512
b52346fb3e2516643e412275406cda7a19e8a2be31e15c486c94743e6b3b5e58591158468450f09845ba3770819186cb3645e7f19f5a78210c1320d3d0382e8a
-
SSDEEP
98304:VAXDF1NUnLjzytCVZWqiIaniHQnN0fuZb9VBeCs4:WXNUnLjGyZBiIaniwWGGCp
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 1220 msiexec.exe 5 1220 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2536 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1220 msiexec.exe Token: SeIncreaseQuotaPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 2532 msiexec.exe Token: SeTakeOwnershipPrivilege 2532 msiexec.exe Token: SeSecurityPrivilege 2532 msiexec.exe Token: SeCreateTokenPrivilege 1220 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1220 msiexec.exe Token: SeLockMemoryPrivilege 1220 msiexec.exe Token: SeIncreaseQuotaPrivilege 1220 msiexec.exe Token: SeMachineAccountPrivilege 1220 msiexec.exe Token: SeTcbPrivilege 1220 msiexec.exe Token: SeSecurityPrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeLoadDriverPrivilege 1220 msiexec.exe Token: SeSystemProfilePrivilege 1220 msiexec.exe Token: SeSystemtimePrivilege 1220 msiexec.exe Token: SeProfSingleProcessPrivilege 1220 msiexec.exe Token: SeIncBasePriorityPrivilege 1220 msiexec.exe Token: SeCreatePagefilePrivilege 1220 msiexec.exe Token: SeCreatePermanentPrivilege 1220 msiexec.exe Token: SeBackupPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeShutdownPrivilege 1220 msiexec.exe Token: SeDebugPrivilege 1220 msiexec.exe Token: SeAuditPrivilege 1220 msiexec.exe Token: SeSystemEnvironmentPrivilege 1220 msiexec.exe Token: SeChangeNotifyPrivilege 1220 msiexec.exe Token: SeRemoteShutdownPrivilege 1220 msiexec.exe Token: SeUndockPrivilege 1220 msiexec.exe Token: SeSyncAgentPrivilege 1220 msiexec.exe Token: SeEnableDelegationPrivilege 1220 msiexec.exe Token: SeManageVolumePrivilege 1220 msiexec.exe Token: SeImpersonatePrivilege 1220 msiexec.exe Token: SeCreateGlobalPrivilege 1220 msiexec.exe Token: SeCreateTokenPrivilege 1220 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1220 msiexec.exe Token: SeLockMemoryPrivilege 1220 msiexec.exe Token: SeIncreaseQuotaPrivilege 1220 msiexec.exe Token: SeMachineAccountPrivilege 1220 msiexec.exe Token: SeTcbPrivilege 1220 msiexec.exe Token: SeSecurityPrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeLoadDriverPrivilege 1220 msiexec.exe Token: SeSystemProfilePrivilege 1220 msiexec.exe Token: SeSystemtimePrivilege 1220 msiexec.exe Token: SeProfSingleProcessPrivilege 1220 msiexec.exe Token: SeIncBasePriorityPrivilege 1220 msiexec.exe Token: SeCreatePagefilePrivilege 1220 msiexec.exe Token: SeCreatePermanentPrivilege 1220 msiexec.exe Token: SeBackupPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeShutdownPrivilege 1220 msiexec.exe Token: SeDebugPrivilege 1220 msiexec.exe Token: SeAuditPrivilege 1220 msiexec.exe Token: SeSystemEnvironmentPrivilege 1220 msiexec.exe Token: SeChangeNotifyPrivilege 1220 msiexec.exe Token: SeRemoteShutdownPrivilege 1220 msiexec.exe Token: SeUndockPrivilege 1220 msiexec.exe Token: SeSyncAgentPrivilege 1220 msiexec.exe Token: SeEnableDelegationPrivilege 1220 msiexec.exe Token: SeManageVolumePrivilege 1220 msiexec.exe Token: SeImpersonatePrivilege 1220 msiexec.exe Token: SeCreateGlobalPrivilege 1220 msiexec.exe Token: SeCreateTokenPrivilege 1220 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1220 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2536 2532 msiexec.exe 29 PID 2532 wrote to memory of 2536 2532 msiexec.exe 29 PID 2532 wrote to memory of 2536 2532 msiexec.exe 29 PID 2532 wrote to memory of 2536 2532 msiexec.exe 29 PID 2532 wrote to memory of 2536 2532 msiexec.exe 29 PID 2532 wrote to memory of 2536 2532 msiexec.exe 29 PID 2532 wrote to memory of 2536 2532 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\runtime\Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1220
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CA0516E85D091A7514EAA38DFADBAA4 C2⤵
- Loads dropped DLL
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5f4198aee41463e310904dd04482cf602
SHA1b1678e2201ce9c807aa5b3530de9ca20031f4abd
SHA256bcd450a344a65872c9e28e7d9222d26b4e5e28c668a7c6ee98f358c3e39bda24
SHA5120fcf06f6d64828e86bc11c34e9bb80b22a269e26f2f079bf297d8240bf539062a045fe7c17b981e0828e8b14706cf8a76adc275cf364b2e5aa52339b3453cfad