Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3QtCore4.dll
windows7-x64
3QtCore4.dll
windows10-2004-x64
3QtGui4.dll
windows7-x64
3QtGui4.dll
windows10-2004-x64
3QtNetwork4.dll
windows7-x64
3QtNetwork4.dll
windows10-2004-x64
3libeay32.dll
windows7-x64
1libeay32.dll
windows10-2004-x64
1nksl3_logger.exe
windows7-x64
9nksl3_logger.exe
windows10-2004-x64
9runtime/No..._0.msi
windows7-x64
6runtime/No..._0.msi
windows10-2004-x64
6runtime/handle.exe
windows7-x64
7runtime/handle.exe
windows10-2004-x64
7runtime/vc...08.exe
windows7-x64
7runtime/vc...08.exe
windows10-2004-x64
7ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
QtCore4.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
QtCore4.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
QtGui4.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
QtGui4.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
QtNetwork4.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
QtNetwork4.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
libeay32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
libeay32.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
nksl3_logger.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
nksl3_logger.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
runtime/Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
runtime/Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
runtime/handle.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
runtime/handle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
runtime/vcredist_x86_2008.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
runtime/vcredist_x86_2008.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ssleay32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
ssleay32.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
runtime/Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi
-
Size
7.7MB
-
MD5
80bb7bb30e33ac2b7bea51e6681b56bc
-
SHA1
9def00a0f350f845e27c421dbac170ca29e5f5ce
-
SHA256
876a015fc3380cab42b31e09a193990d93f2441b7066aec7b99b8b88b8d9e2c7
-
SHA512
b52346fb3e2516643e412275406cda7a19e8a2be31e15c486c94743e6b3b5e58591158468450f09845ba3770819186cb3645e7f19f5a78210c1320d3d0382e8a
-
SSDEEP
98304:VAXDF1NUnLjzytCVZWqiIaniHQnN0fuZb9VBeCs4:WXNUnLjGyZBiIaniwWGGCp
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 5 2868 msiexec.exe 12 2868 msiexec.exe 15 2868 msiexec.exe 17 2868 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 876 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 5000 msiexec.exe Token: SeCreateTokenPrivilege 2868 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2868 msiexec.exe Token: SeLockMemoryPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeMachineAccountPrivilege 2868 msiexec.exe Token: SeTcbPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 2868 msiexec.exe Token: SeTakeOwnershipPrivilege 2868 msiexec.exe Token: SeLoadDriverPrivilege 2868 msiexec.exe Token: SeSystemProfilePrivilege 2868 msiexec.exe Token: SeSystemtimePrivilege 2868 msiexec.exe Token: SeProfSingleProcessPrivilege 2868 msiexec.exe Token: SeIncBasePriorityPrivilege 2868 msiexec.exe Token: SeCreatePagefilePrivilege 2868 msiexec.exe Token: SeCreatePermanentPrivilege 2868 msiexec.exe Token: SeBackupPrivilege 2868 msiexec.exe Token: SeRestorePrivilege 2868 msiexec.exe Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeDebugPrivilege 2868 msiexec.exe Token: SeAuditPrivilege 2868 msiexec.exe Token: SeSystemEnvironmentPrivilege 2868 msiexec.exe Token: SeChangeNotifyPrivilege 2868 msiexec.exe Token: SeRemoteShutdownPrivilege 2868 msiexec.exe Token: SeUndockPrivilege 2868 msiexec.exe Token: SeSyncAgentPrivilege 2868 msiexec.exe Token: SeEnableDelegationPrivilege 2868 msiexec.exe Token: SeManageVolumePrivilege 2868 msiexec.exe Token: SeImpersonatePrivilege 2868 msiexec.exe Token: SeCreateGlobalPrivilege 2868 msiexec.exe Token: SeCreateTokenPrivilege 2868 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2868 msiexec.exe Token: SeLockMemoryPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeMachineAccountPrivilege 2868 msiexec.exe Token: SeTcbPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 2868 msiexec.exe Token: SeTakeOwnershipPrivilege 2868 msiexec.exe Token: SeLoadDriverPrivilege 2868 msiexec.exe Token: SeSystemProfilePrivilege 2868 msiexec.exe Token: SeSystemtimePrivilege 2868 msiexec.exe Token: SeProfSingleProcessPrivilege 2868 msiexec.exe Token: SeIncBasePriorityPrivilege 2868 msiexec.exe Token: SeCreatePagefilePrivilege 2868 msiexec.exe Token: SeCreatePermanentPrivilege 2868 msiexec.exe Token: SeBackupPrivilege 2868 msiexec.exe Token: SeRestorePrivilege 2868 msiexec.exe Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeDebugPrivilege 2868 msiexec.exe Token: SeAuditPrivilege 2868 msiexec.exe Token: SeSystemEnvironmentPrivilege 2868 msiexec.exe Token: SeChangeNotifyPrivilege 2868 msiexec.exe Token: SeRemoteShutdownPrivilege 2868 msiexec.exe Token: SeUndockPrivilege 2868 msiexec.exe Token: SeSyncAgentPrivilege 2868 msiexec.exe Token: SeEnableDelegationPrivilege 2868 msiexec.exe Token: SeManageVolumePrivilege 2868 msiexec.exe Token: SeImpersonatePrivilege 2868 msiexec.exe Token: SeCreateGlobalPrivilege 2868 msiexec.exe Token: SeCreateTokenPrivilege 2868 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2868 msiexec.exe Token: SeLockMemoryPrivilege 2868 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5000 wrote to memory of 876 5000 msiexec.exe 94 PID 5000 wrote to memory of 876 5000 msiexec.exe 94 PID 5000 wrote to memory of 876 5000 msiexec.exe 94
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\runtime\Nokia_Connectivity_Cable_Driver_Version 7_1_69_0.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2868
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D9A9F26F4C95773E97912032CCAE8A1D C2⤵
- Loads dropped DLL
PID:876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5f4198aee41463e310904dd04482cf602
SHA1b1678e2201ce9c807aa5b3530de9ca20031f4abd
SHA256bcd450a344a65872c9e28e7d9222d26b4e5e28c668a7c6ee98f358c3e39bda24
SHA5120fcf06f6d64828e86bc11c34e9bb80b22a269e26f2f079bf297d8240bf539062a045fe7c17b981e0828e8b14706cf8a76adc275cf364b2e5aa52339b3453cfad