Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1209s -
max time network
1218s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/03/2024, 18:29
Static task
static1
Behavioral task
behavioral1
Sample
upd.msi
Resource
win10-20240221-en
windows10-1703-x64
15 signatures
1200 seconds
Behavioral task
behavioral2
Sample
upd.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
1200 seconds
Behavioral task
behavioral3
Sample
upd.msi
Resource
win11-20240221-en
windows11-21h2-x64
14 signatures
1200 seconds
General
-
Target
upd.msi
-
Size
1.4MB
-
MD5
a32536810939d2264c9030b8a1b12186
-
SHA1
25b92fa53392d8541c2213769fac25b7ecbc88f1
-
SHA256
d83d5378f1bb37d1423207ad67f2f984f2d46ba9534194c344a051117c1e541f
-
SHA512
681c2c3299252ee34e447733e6fd6a00133ade44acac9a46cd2f188fd9f6ea767a183ffc0855e7effd39e1ac873405f2d22a7c44e3ce8e39441119d71841029e
-
SSDEEP
24576:1hFxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7AJ/MqYzXZ:1h1vYpW8zBQSc0ZnSKeZKumZr7Amqg
Score
10/10
Malware Config
Extracted
Family
latrodectus
C2
https://titnovacrion.top/live/
https://grunzalom.fun/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 2 4 IoCs
resource yara_rule behavioral3/memory/3388-51-0x0000011DA0F90000-0x0000011DA0FA4000-memory.dmp family_latrodectus_v2 behavioral3/memory/3388-55-0x0000011DA0F90000-0x0000011DA0FA4000-memory.dmp family_latrodectus_v2 behavioral3/memory/3920-68-0x000002D63D750000-0x000002D63D764000-memory.dmp family_latrodectus_v2 behavioral3/memory/3920-69-0x000002D63D750000-0x000002D63D764000-memory.dmp family_latrodectus_v2 -
Blocklisted process makes network request 64 IoCs
flow pid Process 11 3920 rundll32.exe 12 3920 rundll32.exe 13 3920 rundll32.exe 14 3920 rundll32.exe 15 3920 rundll32.exe 16 3920 rundll32.exe 17 3920 rundll32.exe 18 3920 rundll32.exe 19 3920 rundll32.exe 20 3920 rundll32.exe 21 3920 rundll32.exe 22 3920 rundll32.exe 23 3920 rundll32.exe 24 3920 rundll32.exe 26 3920 rundll32.exe 27 3920 rundll32.exe 28 3920 rundll32.exe 29 3920 rundll32.exe 30 3920 rundll32.exe 31 3920 rundll32.exe 32 3920 rundll32.exe 33 3920 rundll32.exe 34 3920 rundll32.exe 35 3920 rundll32.exe 36 3920 rundll32.exe 37 3920 rundll32.exe 38 3920 rundll32.exe 39 3920 rundll32.exe 40 3920 rundll32.exe 41 3920 rundll32.exe 42 3920 rundll32.exe 43 3920 rundll32.exe 44 3920 rundll32.exe 45 3920 rundll32.exe 46 3920 rundll32.exe 47 3920 rundll32.exe 48 3920 rundll32.exe 49 3920 rundll32.exe 50 3920 rundll32.exe 51 3920 rundll32.exe 52 3920 rundll32.exe 53 3920 rundll32.exe 54 3920 rundll32.exe 55 3920 rundll32.exe 56 3920 rundll32.exe 57 3920 rundll32.exe 58 3920 rundll32.exe 59 3920 rundll32.exe 60 3920 rundll32.exe 61 3920 rundll32.exe 62 3920 rundll32.exe 63 3920 rundll32.exe 64 3920 rundll32.exe 65 3920 rundll32.exe 66 3920 rundll32.exe 67 3920 rundll32.exe 68 3920 rundll32.exe 69 3920 rundll32.exe 70 3920 rundll32.exe 71 3920 rundll32.exe 72 3920 rundll32.exe 74 3920 rundll32.exe 75 3920 rundll32.exe 76 3920 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICD10.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58cbe6.msi msiexec.exe File created C:\Windows\SystemTemp\~DF705D988C2391BEF2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID1A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC63.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFBC47F10459CB5937.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{EDB05111-9E1F-4247-A9B5-3D72B974D151} msiexec.exe File opened for modification C:\Windows\Installer\MSID08C.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF3346B0036D7A766.TMP msiexec.exe File created C:\Windows\Installer\e58cbe6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD4BADF0805406A4D.TMP msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 5040 MSID1A6.tmp -
Loads dropped DLL 10 IoCs
pid Process 748 MsiExec.exe 748 MsiExec.exe 748 MsiExec.exe 748 MsiExec.exe 748 MsiExec.exe 748 MsiExec.exe 3704 MsiExec.exe 3704 MsiExec.exe 3388 rundll32.exe 3920 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004875715832007c150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000487571580000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090048757158000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d48757158000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004875715800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2848 msiexec.exe 2848 msiexec.exe 5040 MSID1A6.tmp 5040 MSID1A6.tmp 3388 rundll32.exe 3388 rundll32.exe 3388 rundll32.exe 3388 rundll32.exe 3920 rundll32.exe 3920 rundll32.exe 3920 rundll32.exe 3920 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5008 msiexec.exe Token: SeIncreaseQuotaPrivilege 5008 msiexec.exe Token: SeSecurityPrivilege 2848 msiexec.exe Token: SeCreateTokenPrivilege 5008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5008 msiexec.exe Token: SeLockMemoryPrivilege 5008 msiexec.exe Token: SeIncreaseQuotaPrivilege 5008 msiexec.exe Token: SeMachineAccountPrivilege 5008 msiexec.exe Token: SeTcbPrivilege 5008 msiexec.exe Token: SeSecurityPrivilege 5008 msiexec.exe Token: SeTakeOwnershipPrivilege 5008 msiexec.exe Token: SeLoadDriverPrivilege 5008 msiexec.exe Token: SeSystemProfilePrivilege 5008 msiexec.exe Token: SeSystemtimePrivilege 5008 msiexec.exe Token: SeProfSingleProcessPrivilege 5008 msiexec.exe Token: SeIncBasePriorityPrivilege 5008 msiexec.exe Token: SeCreatePagefilePrivilege 5008 msiexec.exe Token: SeCreatePermanentPrivilege 5008 msiexec.exe Token: SeBackupPrivilege 5008 msiexec.exe Token: SeRestorePrivilege 5008 msiexec.exe Token: SeShutdownPrivilege 5008 msiexec.exe Token: SeDebugPrivilege 5008 msiexec.exe Token: SeAuditPrivilege 5008 msiexec.exe Token: SeSystemEnvironmentPrivilege 5008 msiexec.exe Token: SeChangeNotifyPrivilege 5008 msiexec.exe Token: SeRemoteShutdownPrivilege 5008 msiexec.exe Token: SeUndockPrivilege 5008 msiexec.exe Token: SeSyncAgentPrivilege 5008 msiexec.exe Token: SeEnableDelegationPrivilege 5008 msiexec.exe Token: SeManageVolumePrivilege 5008 msiexec.exe Token: SeImpersonatePrivilege 5008 msiexec.exe Token: SeCreateGlobalPrivilege 5008 msiexec.exe Token: SeCreateTokenPrivilege 5008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5008 msiexec.exe Token: SeLockMemoryPrivilege 5008 msiexec.exe Token: SeIncreaseQuotaPrivilege 5008 msiexec.exe Token: SeMachineAccountPrivilege 5008 msiexec.exe Token: SeTcbPrivilege 5008 msiexec.exe Token: SeSecurityPrivilege 5008 msiexec.exe Token: SeTakeOwnershipPrivilege 5008 msiexec.exe Token: SeLoadDriverPrivilege 5008 msiexec.exe Token: SeSystemProfilePrivilege 5008 msiexec.exe Token: SeSystemtimePrivilege 5008 msiexec.exe Token: SeProfSingleProcessPrivilege 5008 msiexec.exe Token: SeIncBasePriorityPrivilege 5008 msiexec.exe Token: SeCreatePagefilePrivilege 5008 msiexec.exe Token: SeCreatePermanentPrivilege 5008 msiexec.exe Token: SeBackupPrivilege 5008 msiexec.exe Token: SeRestorePrivilege 5008 msiexec.exe Token: SeShutdownPrivilege 5008 msiexec.exe Token: SeDebugPrivilege 5008 msiexec.exe Token: SeAuditPrivilege 5008 msiexec.exe Token: SeSystemEnvironmentPrivilege 5008 msiexec.exe Token: SeChangeNotifyPrivilege 5008 msiexec.exe Token: SeRemoteShutdownPrivilege 5008 msiexec.exe Token: SeUndockPrivilege 5008 msiexec.exe Token: SeSyncAgentPrivilege 5008 msiexec.exe Token: SeEnableDelegationPrivilege 5008 msiexec.exe Token: SeManageVolumePrivilege 5008 msiexec.exe Token: SeImpersonatePrivilege 5008 msiexec.exe Token: SeCreateGlobalPrivilege 5008 msiexec.exe Token: SeCreateTokenPrivilege 5008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5008 msiexec.exe Token: SeLockMemoryPrivilege 5008 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5008 msiexec.exe 5008 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2848 wrote to memory of 748 2848 msiexec.exe 82 PID 2848 wrote to memory of 748 2848 msiexec.exe 82 PID 2848 wrote to memory of 748 2848 msiexec.exe 82 PID 2848 wrote to memory of 1524 2848 msiexec.exe 86 PID 2848 wrote to memory of 1524 2848 msiexec.exe 86 PID 2848 wrote to memory of 3704 2848 msiexec.exe 88 PID 2848 wrote to memory of 3704 2848 msiexec.exe 88 PID 2848 wrote to memory of 3704 2848 msiexec.exe 88 PID 2848 wrote to memory of 5040 2848 msiexec.exe 89 PID 2848 wrote to memory of 5040 2848 msiexec.exe 89 PID 2848 wrote to memory of 5040 2848 msiexec.exe 89 PID 3388 wrote to memory of 3920 3388 rundll32.exe 91 PID 3388 wrote to memory of 3920 3388 rundll32.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\upd.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5008
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8881DE08A7EF45749B07E385110F8C95 C2⤵
- Loads dropped DLL
PID:748
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1524
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A193A60CB9B91985976D81338073F5732⤵
- Loads dropped DLL
PID:3704
-
-
C:\Windows\Installer\MSID1A6.tmp"C:\Windows\Installer\MSID1A6.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\besr\cr2.dll, vgml2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4376
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\besr\cr2.dll, vgml1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_6e6a321.dll", vgml2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50fe6328cc9048f6d7058f1c34873617a
SHA18b357465ce571a2e3c88e753d979330750a854d1
SHA256fad4164dfcc00f8db753646710b79437ca9ef69d988a2560e14dd62daea9ce34
SHA512f2f58996a2aa8b0081b3ab2090a681fe827b70c6a9cf3daf652ac7545577ff97562f0d2c1fef07ed4775d2509415c306c2e09802b6270d54e0bd92ac4eb52f50
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
277KB
MD5f9425561701935d358f4f5b7fc2e5502
SHA1f00b5a6bbd7f500c439bfa4e4dedc79850732597
SHA25671fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9
SHA5128faa2b11ca95eed4b7d5aa7dcc36669d929e7d2c503714d7d220c660e9dad8aa92697f57080fa7589875fe36e3fa9b507e96970d9647373c82969c7972774bcb
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
12.8MB
MD5993bc09fdd3ff400f11da261ea76030f
SHA12a7e9dadd116486db7c90df44c2b66f8ce0c3a3b
SHA25641e13bed1a381f39ffe103860f56575031e713809c95e0aa3aa2566ebbbd7f0a
SHA512e12b4fe4808d29d12e4f68aa7450f1fffe8cc953f8539b54129073597dc8f79dc3d5abb185bc1db1db9316cf65d3fe7bf26451d7778643f9ba3049ee7b172992
-
\??\Volume{58717548-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6ea2e525-a365-4b47-8435-5441dbcf1044}_OnDiskSnapshotProp
Filesize6KB
MD58202757e8040dbacfab2c88e0a9ce0e8
SHA1b561595750688ae4fa3a9db8e91f27ea79d9b6a7
SHA256b74272d1ba56dd1d1f760afacbb20cba242879d336b365910849374bcc2fa812
SHA512975976318b8aaab058b785c0c1ca92046bee06d75c6aa545d536b39a6e86a12acc736b6b48ea3e40c4ac31abb75c0b87a3f5f203e758f12a9ee894478515a5c8