Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/04/2024, 01:07

General

  • Target

    4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi

  • Size

    1.5MB

  • MD5

    37605a3eb80f3366e56938031a9ac917

  • SHA1

    0582a0dd69d6027fb94765254ed91ad736ade305

  • SHA256

    4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a

  • SHA512

    772bb5538f5af14146d9bcf8d8c29a70860ecdf84b4af6cc99dae7589f60847ca7cb87b068bd2aa86f620e79d394c223b96c9fe95fe390e8a9c8422282f5b405

  • SSDEEP

    49152:JZH3YuW8zBQSc0ZnSKmZKumZr7AQB7aLTB:7Y90Zn0K/AQwLF

Score
10/10

Malware Config

Extracted

Family

latrodectus

C2

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Detect larodectus Loader variant 2 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:100
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 85788DB56DACE5EBEC815203B64F5664 C
      2⤵
      • Loads dropped DLL
      PID:3172
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4756
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F808205745B469607DDF9ED13CB35A4E
        2⤵
        • Loads dropped DLL
        PID:5092
      • C:\Windows\Installer\MSI68B0.tmp
        "C:\Windows\Installer\MSI68B0.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1364
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3316
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Windows\System32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_e17ea67f.dll", homq
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4024
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_e17ea67f.dll", homq
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e5766d9.rbs

      Filesize

      1KB

      MD5

      5d4f34c75e564d55bfbf43821b55592c

      SHA1

      e1a463e1976780eea046238d6c20ed150713bd81

      SHA256

      5f9de102311921985042f621648b41115dbca14897b73f0054ef4152dacafb7c

      SHA512

      a599a728f81dab2688eab9717af40b5a21dcf1a27c1d77cafdd08229ca11aa9986ff798ef8c83b08d5b1e6c81513f05a48b866e72cae1e80d0b5b0279fd252da

    • C:\Users\Admin\AppData\Local\Temp\MSI3902.tmp

      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

    • C:\Users\Admin\AppData\Local\sharepoint\360total.dll

      Filesize

      885KB

      MD5

      bd3a3714ee9a071ebeb59ac91d9ebb5a

      SHA1

      55110a221f20a4ceec34c58d0179fa31f8c102e9

      SHA256

      4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe

      SHA512

      7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8

    • C:\Windows\Installer\MSI68B0.tmp

      Filesize

      389KB

      MD5

      b9545ed17695a32face8c3408a6a3553

      SHA1

      f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

      SHA256

      1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

      SHA512

      f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      23.7MB

      MD5

      145cd7045d35e6aea801cc3c6a6554f6

      SHA1

      ede149fdf080f75df7021b8d85c9a622f1f922c2

      SHA256

      3692b1102301ac4fef8ac61ef12c2f9ec4ad47fb6c3907310de3d2d2e59d63ec

      SHA512

      79ddb08c319dfb54191b7afb6190833dd7f9e58315554958561433e0ba850fa74e8a01c645e84873fa6adf1fcaad3f1b4420f38bfd4e109f20fb85bfe656d971

    • \??\Volume{b97ed4d9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{abc4915e-dd25-42ca-bef4-f6cb97db352c}_OnDiskSnapshotProp

      Filesize

      6KB

      MD5

      68e7933965299918d1fd36330661af10

      SHA1

      901fd9c610c1efce9ca24ce4f039c708d4982c6d

      SHA256

      bd908ab386e353af3388c15940d6bce112e451119827c97c609b95724a6f9b94

      SHA512

      aaf3850b19b19aca246e79ce0f3cd2e890a3f6594cc7a29da2cfa216af83ed4399c3cde82e689a8509556dacf7de616728a232c32f505a27f1e7a5f692838b68

    • memory/3264-48-0x0000000180000000-0x0000000180184000-memory.dmp

      Filesize

      1.5MB

    • memory/4024-62-0x000002414EE90000-0x000002414EEA4000-memory.dmp

      Filesize

      80KB