Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

vcredist2005_x64.exe

windows7-x64

7

vcredist2005_x64.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    157s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 19:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vcredist2005_x64.exe

  • Size

    3.0MB

  • MD5

    56eaf4e1237c974f6984edc93972c123

  • SHA1

    ee916012783024dac67fc606457377932c826f05

  • SHA256

    0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0

  • SHA512

    f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736

  • SSDEEP

    49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN

Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 59 IoCs
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec /i vcredist.msi
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2512
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0AD058EAA8924A481E1201C380315DD
      2⤵
      • Loads dropped DLL
      PID:1080
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2788
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:2388
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C0" "0000000000000274"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2060
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:608
    • C:\Windows\System32\control.exe
      "C:\Windows\System32\control.exe" SYSTEM
      1⤵
        PID:2068
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:992

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          ec77844790b3db9d1b0c6b65c6d1a111

          SHA1

          20a3fe7541d804b768041b51dc9b1c572a0e782e

          SHA256

          e4f714fbb236c3bb0efd3c177a137887ac960e9da94d333bfd538d41fcec8363

          SHA512

          991bb6a8b05cc558d9e9beb3e7c8edc520a78b14a5ac471adcf10712a5975a095c9296640f8656363728ea979c4a3f1569c1974856b0c90bb84edeffe38340f6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\CabF122.tmp
          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
          Filesize

          312KB

          MD5

          77a9bff5af149160775741e204734d47

          SHA1

          7b5126af69b5a79593f39db94180f1ff11b0e39d

          SHA256

          20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038

          SHA512

          bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
          Filesize

          3.0MB

          MD5

          6dbdf338a0a25cdb236d43ea3ca2395e

          SHA1

          685b6ea61e574e628392eaac8b10aff4309f1081

          SHA256

          200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb

          SHA512

          6b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a

          Download Submit

        • C:\Windows\Installer\MSIF807.tmp
          Filesize

          28KB

          MD5

          85221b3bcba8dbe4b4a46581aa49f760

          SHA1

          746645c92594bfc739f77812d67cfd85f4b92474

          SHA256

          f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

          SHA512

          060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

          Download Submit

        • memory/608-137-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

          Download

        • memory/608-138-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.