Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    279s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 15:12

General

  • Target

    $PLUGINSDIR/TwingateWindowsInstaller.msi

  • Size

    27.0MB

  • MD5

    3974c25fcade33b85f27d2770ed5ff87

  • SHA1

    13a04128d62654e53e6d2b29c6ff3205c717f189

  • SHA256

    5c0292d6ae44e7fe2949a12170d820f7ee8fb091f508717a7c9bbddf876e97ab

  • SHA512

    018a49d3183a43a54f185b0de55aefe8cccacf17fd5d7ddc65e937945c25cc9741e8c62177c2187002b58c8875d945093e1cd2859667efa50af46dbdb94065ca

  • SSDEEP

    786432:KPZj+TaQhNxLjbKSEEXK+KbOejfWquBxqHf4lWsayGs:KV++QhLj2SRXKZiejHuBxqQlWvs

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TwingateWindowsInstaller.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2196
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding AF72BACD5108E4D1C03A446C52955941 C
      2⤵
      • Loads dropped DLL
      PID:4760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSIB4F8.tmp

    Filesize

    143KB

    MD5

    9bfd64145dd0d1ddb2ca2ad9fdafb284

    SHA1

    52a6bb2fd4bc52d6362392125427ada2df84bfd5

    SHA256

    40556d398d350df55db2015fe539dd976ceb735fc9d19cd460565c678114ec69

    SHA512

    f858a7b61b5c98ccf134d4a33b93027928afd322828b222f4d48c1948b9f5a7ab1b8532db56490dc54e9c97d64bdb679b3a1dc1304ce7ebcce608647ac901b88