Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
sharepoint.msi
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
sharepoint.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
sharepoint.msi
-
Size
1.6MB
-
MD5
8894b952d2c41177d2c14c64695bdce9
-
SHA1
e70e0056f72dbfe7a3fcadc2d80fe843c5c73681
-
SHA256
90f1511223698f33a086337a6875db3b5d6fbcce06f3195cdd6a8efa90091750
-
SHA512
ae5152ce094df963b15fe88bc6bae525ff43cbe9f290af083620fb17e40ca6ca1cf54104922c4b5bd537258356a06660769a87b123b04b942f1fd485280222fd
-
SSDEEP
49152:PS8vYpW8zBQSc0ZnSKeZKumZr7AIq4SM/uWW:HYQ0ZncK/ACL
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 63 api.ipify.org 64 api.ipify.org -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e590749.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB90.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID95.tmp msiexec.exe File created C:\Windows\Installer\e590749.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA85.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{8697E00C-1D60-44AD-B568-3BD073E5E14D} msiexec.exe File opened for modification C:\Windows\Installer\MSIECE.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 4064 MSIECE.tmp -
Loads dropped DLL 9 IoCs
pid Process 656 MsiExec.exe 656 MsiExec.exe 656 MsiExec.exe 656 MsiExec.exe 656 MsiExec.exe 656 MsiExec.exe 4016 MsiExec.exe 4016 MsiExec.exe 2316 regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2152 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1868 msiexec.exe 1868 msiexec.exe 4064 MSIECE.tmp 4064 MSIECE.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5088 msiexec.exe Token: SeIncreaseQuotaPrivilege 5088 msiexec.exe Token: SeSecurityPrivilege 1868 msiexec.exe Token: SeCreateTokenPrivilege 5088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5088 msiexec.exe Token: SeLockMemoryPrivilege 5088 msiexec.exe Token: SeIncreaseQuotaPrivilege 5088 msiexec.exe Token: SeMachineAccountPrivilege 5088 msiexec.exe Token: SeTcbPrivilege 5088 msiexec.exe Token: SeSecurityPrivilege 5088 msiexec.exe Token: SeTakeOwnershipPrivilege 5088 msiexec.exe Token: SeLoadDriverPrivilege 5088 msiexec.exe Token: SeSystemProfilePrivilege 5088 msiexec.exe Token: SeSystemtimePrivilege 5088 msiexec.exe Token: SeProfSingleProcessPrivilege 5088 msiexec.exe Token: SeIncBasePriorityPrivilege 5088 msiexec.exe Token: SeCreatePagefilePrivilege 5088 msiexec.exe Token: SeCreatePermanentPrivilege 5088 msiexec.exe Token: SeBackupPrivilege 5088 msiexec.exe Token: SeRestorePrivilege 5088 msiexec.exe Token: SeShutdownPrivilege 5088 msiexec.exe Token: SeDebugPrivilege 5088 msiexec.exe Token: SeAuditPrivilege 5088 msiexec.exe Token: SeSystemEnvironmentPrivilege 5088 msiexec.exe Token: SeChangeNotifyPrivilege 5088 msiexec.exe Token: SeRemoteShutdownPrivilege 5088 msiexec.exe Token: SeUndockPrivilege 5088 msiexec.exe Token: SeSyncAgentPrivilege 5088 msiexec.exe Token: SeEnableDelegationPrivilege 5088 msiexec.exe Token: SeManageVolumePrivilege 5088 msiexec.exe Token: SeImpersonatePrivilege 5088 msiexec.exe Token: SeCreateGlobalPrivilege 5088 msiexec.exe Token: SeCreateTokenPrivilege 5088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5088 msiexec.exe Token: SeLockMemoryPrivilege 5088 msiexec.exe Token: SeIncreaseQuotaPrivilege 5088 msiexec.exe Token: SeMachineAccountPrivilege 5088 msiexec.exe Token: SeTcbPrivilege 5088 msiexec.exe Token: SeSecurityPrivilege 5088 msiexec.exe Token: SeTakeOwnershipPrivilege 5088 msiexec.exe Token: SeLoadDriverPrivilege 5088 msiexec.exe Token: SeSystemProfilePrivilege 5088 msiexec.exe Token: SeSystemtimePrivilege 5088 msiexec.exe Token: SeProfSingleProcessPrivilege 5088 msiexec.exe Token: SeIncBasePriorityPrivilege 5088 msiexec.exe Token: SeCreatePagefilePrivilege 5088 msiexec.exe Token: SeCreatePermanentPrivilege 5088 msiexec.exe Token: SeBackupPrivilege 5088 msiexec.exe Token: SeRestorePrivilege 5088 msiexec.exe Token: SeShutdownPrivilege 5088 msiexec.exe Token: SeDebugPrivilege 5088 msiexec.exe Token: SeAuditPrivilege 5088 msiexec.exe Token: SeSystemEnvironmentPrivilege 5088 msiexec.exe Token: SeChangeNotifyPrivilege 5088 msiexec.exe Token: SeRemoteShutdownPrivilege 5088 msiexec.exe Token: SeUndockPrivilege 5088 msiexec.exe Token: SeSyncAgentPrivilege 5088 msiexec.exe Token: SeEnableDelegationPrivilege 5088 msiexec.exe Token: SeManageVolumePrivilege 5088 msiexec.exe Token: SeImpersonatePrivilege 5088 msiexec.exe Token: SeCreateGlobalPrivilege 5088 msiexec.exe Token: SeCreateTokenPrivilege 5088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5088 msiexec.exe Token: SeLockMemoryPrivilege 5088 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5088 msiexec.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1868 wrote to memory of 656 1868 msiexec.exe 94 PID 1868 wrote to memory of 656 1868 msiexec.exe 94 PID 1868 wrote to memory of 656 1868 msiexec.exe 94 PID 1868 wrote to memory of 2464 1868 msiexec.exe 106 PID 1868 wrote to memory of 2464 1868 msiexec.exe 106 PID 1868 wrote to memory of 4016 1868 msiexec.exe 108 PID 1868 wrote to memory of 4016 1868 msiexec.exe 108 PID 1868 wrote to memory of 4016 1868 msiexec.exe 108 PID 1868 wrote to memory of 4064 1868 msiexec.exe 109 PID 1868 wrote to memory of 4064 1868 msiexec.exe 109 PID 1868 wrote to memory of 4064 1868 msiexec.exe 109 PID 1608 wrote to memory of 2316 1608 regsvr32.exe 111 PID 1608 wrote to memory of 2316 1608 regsvr32.exe 111 PID 1608 wrote to memory of 2316 1608 regsvr32.exe 111 PID 2316 wrote to memory of 2152 2316 regsvr32.exe 112 PID 2316 wrote to memory of 2152 2316 regsvr32.exe 112 PID 2316 wrote to memory of 2152 2316 regsvr32.exe 112 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sharepoint.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5088
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 151C58416D9C3766FB26B1CAC54A79C2 C2⤵
- Loads dropped DLL
PID:656
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2464
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8AD69FE3796F3C43BD59D23317377FF92⤵
- Loads dropped DLL
PID:4016
-
-
C:\Windows\Installer\MSIECE.tmp"C:\Windows\Installer\MSIECE.tmp" C:\Windows\System32\regsvr32.exe /S C:\Users\Admin\AppData\Local\sharepoint\MenuEx.dll2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:4912
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /S C:\Users\Admin\AppData\Local\sharepoint\MenuEx.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\regsvr32.exe/S C:\Users\Admin\AppData\Local\sharepoint\MenuEx.dll2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /sc minute /mo 10 /tn "EdgeUpdate" /tr "regsvr32.exe /s C:\Users\Admin\AppData\Local\sharepoint\MenuEx.dll" /f3⤵
- Creates scheduled task(s)
PID:2152
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
702KB
MD51d8d71b4a0870c0dfa3468470fb28a28
SHA18edb7b339d957a4a1f1070a082ee8b06353e4df0
SHA25609ffc4188bf11bf059b616491fcb8a09a474901581f46ec7f2c350fbda4e1e1c
SHA512299ebba518699921d38723cc2bec5ac58ded28c7c3ab7bed865d29f239dc600d9da0487d9f87e23b7fff67acc4bdba976e0e0ff72f0e4bc959feb73565f2fabc
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
23.7MB
MD54af4cb2dab0ccafdb79ff8433752aab5
SHA18959d411f59821fd35eeed2d3469e3f65e47f7eb
SHA256b3fa264532a83339a85fca1fcc1cf33cd90ca07abba2a827a05f095098f3cb08
SHA512ee1adb44ed7b0e1fedeac754873c83b2844286f3532ea1f552e1c963616d538a793441553f357605e60c17b514e3304069f71803728842384783893bb0613cb3
-
\??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{35445971-a9b9-474f-8619-327c4501f7b8}_OnDiskSnapshotProp
Filesize6KB
MD5379db48792e79b08a2be973e94e71dfd
SHA140ccfdbd41c8e2c3d286191d5ab5c0687466fbb4
SHA256a100a7dd3c9f923754df3b88d7b034a9ddf8d0f05814b5dbe33b924d7e945b23
SHA5122e2e4bd6d46995d714ba341ad40fbd8db33e4fb83267564ea82d3d3d70188e7fc90517b1462c6c8568511194667f75192548960527e1a8e1999f9457bc4b7c9f