Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1500s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/03/2024, 16:12

General

  • Target

    9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi

  • Size

    2.0MB

  • MD5

    ebae9b70769458cf723022ec89b95c32

  • SHA1

    3d3135b87fe274988b86f50d24bde82cc08556bf

  • SHA256

    9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0

  • SHA512

    3550c281fc8dcd8078caf6c0cef847280d6ec78216b0e018b01942e82c79499538f3a0553409e3c716edf584ff5c359ce991440bab14d4794f6ae3393788a102

  • SSDEEP

    49152:J3osY5A6b4ms+4UhbrMizYiRpb2mN3rm999OhjY:hY5A6bDhbrfzYiRNdm+

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4620
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2392
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 84CD298F8C1F82BD67342631C10F79D0
      2⤵
      • Adds Run key to start application
      • Blocklisted process makes network request
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\ProgramData\Druh5z1l.UsU\Druh5z1l.UsU.exe
        "C:\ProgramData\Druh5z1l.UsU\Druh5z1l.UsU.exe"
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4756
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e575288.rbs

    Filesize

    1KB

    MD5

    bf5c7d41ab446900a19e87c25398809f

    SHA1

    7ff214d800c637bd94106697096be8eda62de1d3

    SHA256

    0d0592c1eaac41a06c8566662331e010befb6dbbeb7bc57174c9f3d55e76efae

    SHA512

    33e2f04af2550583f19b340ca6ca65d8d8e74e9ea4eee17c88a3175dee31fa42edc1ed90546830f11918a42f519c048c72660191765f7ef56568de6dc86f16ca

  • C:\ProgramData\Druh5z1l.UsU\Druh5z1l.UsU.exe

    Filesize

    97KB

    MD5

    a61faca7411cebd947b4f1e00dba6d08

    SHA1

    fc1b4587990a792c32b113451197354f942b82d5

    SHA256

    db57fbf86c8306809673be5850779b2dcda94bd8c36047840e27175cd30c257a

    SHA512

    463e7da3b042adfcc4fc7bd5a8bf8df44375ec8adc4320dbfffeeb98e6a33c2337991d8e644eabb98c5a87a1e13a3636e9f03e4cad2b72ef23d7c0f5676bcc2b

  • C:\ProgramData\Druh5z1l.UsU\LOG\Druh5z1l.UsU.exe.DEBUG.log

    Filesize

    451B

    MD5

    e0a01cf03a7168462c3b75993726ab3a

    SHA1

    a8dd5cf248fd5b217180de9c845c85e12b83bdfc

    SHA256

    0ea8e727a9dd9cea240167652a33135503b429a140bbdec7511b80300b5b45c6

    SHA512

    22abe63670459f5090e0d4d09863d532445db7d436de32b6db322e5b032c959e33ce3ed3f71091a70cf781338b39cfaa27e6cda572dda95c6114b81feaae0e65

  • C:\ProgramData\Druh5z1l.UsU\VCRUNTIME140.dll

    Filesize

    88KB

    MD5

    17f01742d17d9ffa7d8b3500978fc842

    SHA1

    2da2ff031da84ac8c2d063a964450642e849144d

    SHA256

    70dd90f6ee01854cecf18b1b6d1dfbf30d33c5170ba07ad8b64721f0bdcc235e

    SHA512

    c4e617cd808e48cc803343616853adf32b7f2e694b5827392219c69145a43969384d2fc67fa6fa0f5af1ca449eb4932004fbcdd394a5ba092212412b347586f0

  • C:\ProgramData\Druh5z1l.UsU\python311.dll

    Filesize

    1.2MB

    MD5

    76eade2701004cb0b8b46828e0b87103

    SHA1

    6f65e940b4f7bf0bc82cda6143ac5980c4d4a261

    SHA256

    440c44c95cb45c13179b69496177f83bc4b45f5130761f614f6b549d95d63180

    SHA512

    6a82cf42f968d49125e9d0c09a47d43cb45e07184375052d3299e05320b1097c121042b64b1857250b12740458ec999f9edd36b41a7b9a4c34bf0569a3236a67

  • C:\ProgramData\Druh5z1l.UsU\python311.dll

    Filesize

    979KB

    MD5

    88b3bd5a8cbff497d69b520c976778d3

    SHA1

    f3aef785f9a4e89589a99ba6ebc99f9fb2fddf90

    SHA256

    f4fd5592dfbc638faeaf7c5201dcbcb395e1f0cabb79c753d4024cf04340abd7

    SHA512

    872fc635a49cf5ed61aca51410c5d22aa5dd494c0ddd42e9e8b4adff8f23418852316378b36abedac8a7519d8e9a7575894cc528460c927ac8ff850f224528df

  • C:\ProgramData\Druh5z1l.UsU\python311.dll

    Filesize

    1.1MB

    MD5

    d5a600324f15d7b7ec36e293b1abb16c

    SHA1

    89564411aa6838eeaff6e6e7577d54541a549c06

    SHA256

    2412d48ccb7b0a99808ddddf4aa7cf07a7dd6bf1e78df4999ae7453ab90a2f95

    SHA512

    e5c30de373a089039d7728220926d549071d0c29d029d5dd28455088089410ca98bd6953967e2329ba47c86a3f8213a89e45458f8a1255a8d13ab91ec5833692

  • C:\Users\Admin\AppData\Local\Temp\MSI73921.LOG

    Filesize

    21KB

    MD5

    a60fd38203d1ee422bdc260919c6fc7f

    SHA1

    9c45ff5dcd469b10ecc7c413943442fb57f7584b

    SHA256

    5d7c06c978794a139eec9f46488c50de8eb6be458967e5c1815617cdc9138f2f

    SHA512

    e60c0b09cc07552c8695d1e2e96c08894097544b9097b5a2887383f9ebdadc193ef33b566dea97c02f1fa4fdd21b381789f87392726f4faeff9f565121addeae

  • C:\Users\Admin\Pictures\msedge_elf.dll

    Filesize

    1.3MB

    MD5

    8ae4a2d24f53985e238309b0fa081449

    SHA1

    42bde0530c733c8a5d162249c18388a404c7e6df

    SHA256

    2de3942e7690adafe16c6ae5692d9793466d50a4a41ccc66acdaf51573584357

    SHA512

    124f3242539d0bfbfae6e8ebcfc409bbc0f55e88756813ab858ad807a8aec3383ead7e30559a76973cf008dbc59a594b8712a56dcbc5716eb013bb125b3d427b

  • C:\Windows\Installer\MSI52D3.tmp

    Filesize

    91KB

    MD5

    5c5bef05b6f3806106f8f3ce13401cc1

    SHA1

    6005fbe17f6e917ac45317552409d7a60976db14

    SHA256

    f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

    SHA512

    97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

    Filesize

    12.8MB

    MD5

    e49d061567f5ec7a23737f13fcbfefae

    SHA1

    9c590be8b4e78e5d0d608b6b7cd33844061f9ded

    SHA256

    e84cd239e834ae50bb0e2f058ffde4331e2dc49fe2f652964e440287fe97ef98

    SHA512

    17eba4d4acfbe307a1927e997e28e9710e798a0402a547b81da07025042f3d7475fdc0a47e16d47c69b8109c6b420f89e76884fcd29527040cd507a0b500312d

  • \??\Volume{8465b6cf-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b1b7ff1f-f3a0-4756-997c-fcd3defe89ef}_OnDiskSnapshotProp

    Filesize

    6KB

    MD5

    4bc4804238cb286aa636ae71153b7a27

    SHA1

    bc3e01b45b153f429a63117bad01627a7047725b

    SHA256

    0f9338a0326733d2d2c878a2613b723db78bc116d9093e41c44cf02e01f2f782

    SHA512

    76ac92788c6568eadab8fba59ec296beb081a1caab7856bd285e8940889844d64e9462c92222ec5af27db1d7de6f2a86c84056555b45c238d7225a49cee2a8a8

  • memory/2752-32-0x00000000746C0000-0x000000007499E000-memory.dmp

    Filesize

    2.9MB

  • memory/2752-34-0x00000000746C0000-0x000000007499E000-memory.dmp

    Filesize

    2.9MB

  • memory/2752-33-0x0000000003790000-0x0000000003795000-memory.dmp

    Filesize

    20KB

  • memory/2752-31-0x0000000003700000-0x000000000377F000-memory.dmp

    Filesize

    508KB

  • memory/2752-26-0x00000000746C0000-0x000000007499E000-memory.dmp

    Filesize

    2.9MB

  • memory/2752-30-0x0000000003780000-0x0000000003784000-memory.dmp

    Filesize

    16KB

  • memory/2752-69-0x0000000003700000-0x000000000377F000-memory.dmp

    Filesize

    508KB

  • memory/2752-29-0x00000000746C0000-0x000000007499E000-memory.dmp

    Filesize

    2.9MB

  • memory/2752-27-0x00000000746C0000-0x000000007499E000-memory.dmp

    Filesize

    2.9MB

  • memory/4756-85-0x00000000059C0000-0x00000000059C1000-memory.dmp

    Filesize

    4KB

  • memory/4756-83-0x0000000005990000-0x0000000005991000-memory.dmp

    Filesize

    4KB

  • memory/4756-82-0x0000000005980000-0x0000000005981000-memory.dmp

    Filesize

    4KB

  • memory/4756-87-0x00000000059E0000-0x00000000059E1000-memory.dmp

    Filesize

    4KB

  • memory/4756-88-0x00000000059F0000-0x00000000059F1000-memory.dmp

    Filesize

    4KB

  • memory/4756-86-0x00000000059D0000-0x00000000059D1000-memory.dmp

    Filesize

    4KB

  • memory/4756-84-0x0000000001BF0000-0x000000000419E000-memory.dmp

    Filesize

    37.7MB

  • memory/4756-89-0x0000000001BF0000-0x000000000419E000-memory.dmp

    Filesize

    37.7MB

  • memory/4756-81-0x0000000005960000-0x0000000005961000-memory.dmp

    Filesize

    4KB

  • memory/4756-113-0x0000000005A30000-0x0000000005A31000-memory.dmp

    Filesize

    4KB

  • memory/4756-114-0x0000000001BF0000-0x000000000419E000-memory.dmp

    Filesize

    37.7MB

  • memory/4756-115-0x0000000005A30000-0x0000000005A31000-memory.dmp

    Filesize

    4KB