Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 03:45

General

  • Target

    ee1e5b80a1d3d47c7703ea2b6b64ee96283ab3628ee4fa1fef6d35d1d9051e9f.msi

  • Size

    1.4MB

  • MD5

    ec183d55d6c11480bc167da468a526fa

  • SHA1

    e4315009a338b527d7b65bd557be404b9f55d284

  • SHA256

    ee1e5b80a1d3d47c7703ea2b6b64ee96283ab3628ee4fa1fef6d35d1d9051e9f

  • SHA512

    03d6fa94994b642ed753827d13aafa4bc61580102c4fa1fb8861d391f8b3b62e0d90a1328b9f10af1c00a443f43a69a3085068356906e46bb53d70df30e29cf3

  • SSDEEP

    24576:gfPxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7AgrukBho6l:gf/vYpW8zBQSc0ZnSKeZKumZr7AZqhDl

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ee1e5b80a1d3d47c7703ea2b6b64ee96283ab3628ee4fa1fef6d35d1d9051e9f.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2244
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C152001C5999E16E5EFCA54ED942A1B6 C
      2⤵
      • Loads dropped DLL
      PID:1284
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F34EDE56717417F824B5AAE9CE9F1381
      2⤵
      • Loads dropped DLL
      PID:764
    • C:\Windows\Installer\MSI3E4B.tmp
      "C:\Windows\Installer\MSI3E4B.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1956
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2560
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000394" "00000000000004A0"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:1980
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f763c47.rbs

      Filesize

      1KB

      MD5

      174eecbf69c594a90a07fb7e8c3c8e3a

      SHA1

      671b2597fa82cec633143289b56e743a24788087

      SHA256

      e67adc98ae646ca23812c6a043762a4bc56ecc51f42f57d03a798f6537de8b95

      SHA512

      1b0e8d1b32964fbfb0c15b08eae6a16499aebab090ad59a99482fdb7c1b73afa67a44f3c662341189e447a574a5e9cfb2eafb2dda8e958dc63140824bffef2f6

    • C:\Users\Admin\AppData\Local\Temp\MSI20AA.tmp

      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

    • C:\Users\Admin\AppData\Local\stat\falcon.dll

      Filesize

      469KB

      MD5

      e27c6586dba78d5d302589f3b231be40

      SHA1

      305031a6d93a744cf61552ab673ddb27843ee845

      SHA256

      3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567

      SHA512

      1f0c126e38eed21ee51e04ebe4717fcbb3545d9ccdcc24ba0125f82c5f9b94d1406cbf3ba9f58958e4f180bdd6931bc3a3cb5390de990f8265baabfd414f89c2

    • C:\Windows\Installer\MSI3E4B.tmp

      Filesize

      389KB

      MD5

      b9545ed17695a32face8c3408a6a3553

      SHA1

      f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

      SHA256

      1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

      SHA512

      f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

    • memory/1940-43-0x0000000001D20000-0x0000000001D34000-memory.dmp

      Filesize

      80KB

    • memory/1940-44-0x0000000001D20000-0x0000000001D34000-memory.dmp

      Filesize

      80KB

    • memory/1956-37-0x0000000000120000-0x0000000000122000-memory.dmp

      Filesize

      8KB