Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

avp.msi

windows7-x64

6

avp.msi

windows10-2004-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 14:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    avp.msi

  • Size

    1.4MB

  • MD5

    4d81be09c23e02fab7364e508c21c111

  • SHA1

    52cae521d7a808c8206f4b5afd6b037bc573b50e

  • SHA256

    dcae57ec4b69236146f744c143c42cc8bdac9da6e991904e6dbf67ec1179286a

  • SHA512

    4f5b4fdeb9a056025455ede8ee6e1757da8db64f9692df2a46558a3c04aaec551734b4d75803bbd579e1163b9aba5005f71c5efb22ee3d336779804a11b2b5a5

  • SSDEEP

    24576:BqKxnNTYUx0ECIgYmfLVYeBZr7A9zdfoAX+8UhxcS:Bq6TYCZKumZr7ARdAAO8oxz

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 9 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\avp.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4556
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 28CED8F0F3310FFA5943D81F600611FC C
      2⤵
      • Loads dropped DLL
      PID:572
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:720
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D20C277F4280DF6D38808C7E0A1A252B
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:4876
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4460

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      107.211.222.173.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      107.211.222.173.in-addr.arpa
      IN PTR
      Response
      107.211.222.173.in-addr.arpa
      IN PTR
      a173-222-211-107deploystaticakamaitechnologiescom
    • flag-us
      DNS
      23.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      248.81.21.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      248.81.21.2.in-addr.arpa
      IN PTR
      Response
      248.81.21.2.in-addr.arpa
      IN PTR
      a2-21-81-248deploystaticakamaitechnologiescom
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.126.166.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.126.166.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      65.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      65.139.73.23.in-addr.arpa
      IN PTR
      Response
      65.139.73.23.in-addr.arpa
      IN PTR
      a23-73-139-65deploystaticakamaitechnologiescom
    • flag-us
      DNS
      57.82.21.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.82.21.2.in-addr.arpa
      IN PTR
      Response
      57.82.21.2.in-addr.arpa
      IN PTR
      a2-21-82-57deploystaticakamaitechnologiescom
    • flag-us
      DNS
      79.121.231.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.121.231.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      api.ipify.org
      MsiExec.exe
      Remote address:
      8.8.8.8:53
      Request
      api.ipify.org
      IN A
      Response
      api.ipify.org
      IN A
      104.26.12.205
      api.ipify.org
      IN A
      104.26.13.205
      api.ipify.org
      IN A
      172.67.74.152
    • flag-us
      GET
      https://api.ipify.org/
      MsiExec.exe
      Remote address:
      104.26.12.205:443
      Request
      GET / HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Host: api.ipify.org
      Response
      HTTP/1.1 200 OK
      Date: Wed, 17 Apr 2024 14:49:22 GMT
      Content-Type: text/plain
      Content-Length: 14
      Connection: keep-alive
      Vary: Origin
      CF-Cache-Status: DYNAMIC
      Server: cloudflare
      CF-RAY: 875d38acfe5794af-LHR
    • flag-us
      DNS
      205.12.26.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.12.26.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      POST
      http://85.239.53.219/api/gateway
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      POST /api/gateway HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/json
      Referer: */*
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 174
      Host: 85.239.53.219
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Wed, 17 Apr 2024 14:49:34 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 74
      Connection: keep-alive
      Referrer-Policy: no-referrer
    • flag-us
      POST
      http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      POST /api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/json
      Referer: */*
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 0
      Host: 85.239.53.219
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Wed, 17 Apr 2024 14:49:34 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 185
      Connection: keep-alive
      Referrer-Policy: no-referrer
    • flag-us
      GET
      http://85.239.53.219/download?id=Nevada&module=2&filename=None
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      GET /download?id=Nevada&module=2&filename=None HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Host: 85.239.53.219
      Response
      HTTP/1.1 500 Internal Server Error
      Server: nginx
      Date: Wed, 17 Apr 2024 14:49:54 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 55
      Connection: keep-alive
    • flag-us
      POST
      http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      POST /api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/json
      Referer: */*
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 0
      Host: 85.239.53.219
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Wed, 17 Apr 2024 14:49:54 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 0
      Connection: keep-alive
      Referrer-Policy: no-referrer
    • flag-us
      POST
      http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      POST /api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/json
      Referer: */*
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 0
      Host: 85.239.53.219
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Wed, 17 Apr 2024 14:50:14 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 0
      Connection: keep-alive
      Referrer-Policy: no-referrer
    • flag-us
      POST
      http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      POST /api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/json
      Referer: */*
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 0
      Host: 85.239.53.219
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Wed, 17 Apr 2024 14:50:35 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 0
      Connection: keep-alive
      Referrer-Policy: no-referrer
    • flag-us
      POST
      http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks
      MsiExec.exe
      Remote address:
      85.239.53.219:80
      Request
      POST /api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/json
      Referer: */*
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 0
      Host: 85.239.53.219
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Wed, 17 Apr 2024 14:50:55 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 0
      Connection: keep-alive
      Referrer-Policy: no-referrer
    • flag-us
      DNS
      219.53.239.85.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      219.53.239.85.in-addr.arpa
      IN PTR
      Response
      219.53.239.85.in-addr.arpa
      IN PTR
      xfdxyf6rfyfirstopportunityonline
    • flag-us
      DNS
      18.24.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.24.18.2.in-addr.arpa
      IN PTR
      Response
      18.24.18.2.in-addr.arpa
      IN PTR
      a2-18-24-18deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      123.10.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      123.10.44.20.in-addr.arpa
      IN PTR
      Response
    • 104.26.12.205:443
      https://api.ipify.org/
      tls, http
      MsiExec.exe
      892 B
       6.0kB
       9
      9

      HTTP Request

      GET https://api.ipify.org/

      HTTP Response

      200
    • 85.239.53.219:80
      http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks
      http
      MsiExec.exe
      2.8kB
       2.1kB
       15
      11

      HTTP Request

      POST http://85.239.53.219/api/gateway

      HTTP Response

      200

      HTTP Request

      POST http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks

      HTTP Response

      200

      HTTP Request

      GET http://85.239.53.219/download?id=Nevada&module=2&filename=None

      HTTP Response

      500

      HTTP Request

      POST http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks

      HTTP Response

      200

      HTTP Request

      POST http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks

      HTTP Response

      200

      HTTP Request

      POST http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks

      HTTP Response

      200

      HTTP Request

      POST http://85.239.53.219/api/4a0d7e7e-1c23-306f-c914-3c6b55e232e5/tasks

      HTTP Response

      200
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      107.211.222.173.in-addr.arpa
      dns
      74 B
       141 B
       1
      1

      DNS Request

      107.211.222.173.in-addr.arpa

    • 8.8.8.8:53
      23.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      23.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      248.81.21.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      248.81.21.2.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      56.126.166.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      56.126.166.20.in-addr.arpa

    • 8.8.8.8:53
      65.139.73.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      65.139.73.23.in-addr.arpa

    • 8.8.8.8:53
      57.82.21.2.in-addr.arpa
      dns
      69 B
       131 B
       1
      1

      DNS Request

      57.82.21.2.in-addr.arpa

    • 8.8.8.8:53
      79.121.231.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      79.121.231.20.in-addr.arpa

    • 8.8.8.8:53
      api.ipify.org
      dns
      MsiExec.exe
      59 B
       107 B
       1
      1

      DNS Request

      api.ipify.org

      DNS Response

      104.26.12.205
      104.26.13.205
      172.67.74.152

    • 8.8.8.8:53
      205.12.26.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      205.12.26.104.in-addr.arpa

    • 8.8.8.8:53
      219.53.239.85.in-addr.arpa
      dns
      72 B
       120 B
       1
      1

      DNS Request

      219.53.239.85.in-addr.arpa

    • 8.8.8.8:53
      18.24.18.2.in-addr.arpa
      dns
      69 B
       131 B
       1
      1

      DNS Request

      18.24.18.2.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      123.10.44.20.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      123.10.44.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MSI6050.tmp
      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

      Download Submit

    • C:\Users\Admin\AppData\Local\sharepoint\forcedelctl.dll
      Filesize

      956KB

      MD5

      b28a478eb5b99efcdc7caf428bffb89a

      SHA1

      d394c7b8fe15753bfbff79fb4f648f6f8bae70f9

      SHA256

      3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f

      SHA512

      decb2581f64949bfaaaf0368917f0705d7a4b7392ec272eda025cf06a4384ec4cdd5202081c2e085f00645029dd96bfef262e8628bed1861185adf6281c1cc88

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      23.7MB

      MD5

      d43d5be45efd10a0115763ff4f36163c

      SHA1

      54f801428965634eb3d4bcb91a077906f2217260

      SHA256

      8120fe9e4437c5cc14ecb7f5c962fb32c9e7f5e25c9fa4bffeb0ca00a9f3da32

      SHA512

      d45506d68a958afdd9926a69ca57ec73374259925f35159b986c3b96419ed459f587dc60c76ab8b5382b194496f3990c4c63f563a8cc7ffac0ec73d63474881f

      Download Submit

    • \??\Volume{afa4c2e5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{52081ded-d4e7-4b1d-b185-016bb1d2e97f}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      194b4d86b2772a1de267c7b6338b29fc

      SHA1

      4120af0df7e90fd97252115e0dd0fb3755759dfa

      SHA256

      0e67706a2f86eed61131e28449b1aaa390f127528f5f5ae307b3e6fcd7f26ad1

      SHA512

      ee697c7873d603c1e0ffa09973151887d5ee274b26a65096985b3ce6e8fa61659f8f1d7d61fb30158cc50d50a5ad6f1be207831d97068284e270bd5448c6a7cf

      Download Submit

    • memory/4876-45-0x0000000010000000-0x00000000100F9000-memory.dmp

      Filesize

      996KB

      Download

    • memory/4876-46-0x00000000029C0000-0x0000000002A35000-memory.dmp

      Filesize

      468KB

      Download

    • memory/4876-47-0x0000000002A40000-0x0000000002AB3000-memory.dmp

      Filesize

      460KB

      Download

    • memory/4876-52-0x0000000010000000-0x00000000100F9000-memory.dmp

      Filesize

      996KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.