Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi
Resource
win10v2004-20240426-en
General
-
Target
bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi
-
Size
35.0MB
-
MD5
94089be88986618b7be913ee8b0d8a67
-
SHA1
377ecca72bbdf278cb2a15531188e14eb59145e4
-
SHA256
bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36
-
SHA512
84d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987
-
SSDEEP
786432:Ilk27h2QVu9cCct5rB9rIX9gW6cnzELhEe2x53gp2KM:IlfA+ptO2Cnne2xU2
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 3 2848 msiexec.exe 5 2848 msiexec.exe 7 2848 msiexec.exe 8 2640 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f762226.msi msiexec.exe File opened for modification C:\Windows\Installer\f762224.ipi msiexec.exe File created C:\Windows\Installer\f762221.msi msiexec.exe File opened for modification C:\Windows\Installer\f762221.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2665.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI283C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2CEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2750.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI27BE.tmp msiexec.exe File created C:\Windows\Installer\f762224.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 1276 MsiExec.exe 1276 MsiExec.exe 1276 MsiExec.exe 1276 MsiExec.exe -
pid Process 2880 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2880 powershell.exe 2640 msiexec.exe 2640 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2848 msiexec.exe Token: SeIncreaseQuotaPrivilege 2848 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeSecurityPrivilege 2640 msiexec.exe Token: SeCreateTokenPrivilege 2848 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2848 msiexec.exe Token: SeLockMemoryPrivilege 2848 msiexec.exe Token: SeIncreaseQuotaPrivilege 2848 msiexec.exe Token: SeMachineAccountPrivilege 2848 msiexec.exe Token: SeTcbPrivilege 2848 msiexec.exe Token: SeSecurityPrivilege 2848 msiexec.exe Token: SeTakeOwnershipPrivilege 2848 msiexec.exe Token: SeLoadDriverPrivilege 2848 msiexec.exe Token: SeSystemProfilePrivilege 2848 msiexec.exe Token: SeSystemtimePrivilege 2848 msiexec.exe Token: SeProfSingleProcessPrivilege 2848 msiexec.exe Token: SeIncBasePriorityPrivilege 2848 msiexec.exe Token: SeCreatePagefilePrivilege 2848 msiexec.exe Token: SeCreatePermanentPrivilege 2848 msiexec.exe Token: SeBackupPrivilege 2848 msiexec.exe Token: SeRestorePrivilege 2848 msiexec.exe Token: SeShutdownPrivilege 2848 msiexec.exe Token: SeDebugPrivilege 2848 msiexec.exe Token: SeAuditPrivilege 2848 msiexec.exe Token: SeSystemEnvironmentPrivilege 2848 msiexec.exe Token: SeChangeNotifyPrivilege 2848 msiexec.exe Token: SeRemoteShutdownPrivilege 2848 msiexec.exe Token: SeUndockPrivilege 2848 msiexec.exe Token: SeSyncAgentPrivilege 2848 msiexec.exe Token: SeEnableDelegationPrivilege 2848 msiexec.exe Token: SeManageVolumePrivilege 2848 msiexec.exe Token: SeImpersonatePrivilege 2848 msiexec.exe Token: SeCreateGlobalPrivilege 2848 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2848 msiexec.exe 2848 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 2640 wrote to memory of 1276 2640 msiexec.exe 29 PID 1276 wrote to memory of 2880 1276 MsiExec.exe 30 PID 1276 wrote to memory of 2880 1276 MsiExec.exe 30 PID 1276 wrote to memory of 2880 1276 MsiExec.exe 30 PID 1276 wrote to memory of 2880 1276 MsiExec.exe 30
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2848
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D0C9850EA11B1CDBB68C35D712DB99C42⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss28B9.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi28B6.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr28B7.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr28B8.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5ece65bfdaceebc02d311cfa7848af065
SHA12a88a414072476bda4a7741f51c22348b4bd2ac3
SHA256756d2bc824a9587ed0356b9b9b29f4d8300d184af8119f045df833dbeef77181
SHA512bbad10bb8768269e772a298f24869f6ff7f1c01a8e5690015cf644cafc3db4aeef6d86bfbfb339a600ebf29b090ab62e4fac1c53f6782d51e08d04c5a1cde60c
-
Filesize
1KB
MD5e94fb54871208c00df70f708ac47085b
SHA14efc31460c619ecae59c1bce2c008036d94c84b8
SHA2567b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86
SHA5122e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598b0298603cbf6f0d9f45f7d9dee4eea
SHA1dd5f29ecd0102638738748522ff9af5ff7bd822d
SHA256ac0cf92d132c26fe31c0403fd9094ad594261d820ffd2ccffd353100fbd24da8
SHA51296e360c1a1e68d5fb2064373402ccaed630853f04ef6a205aac607fe4754b0e42860d1d3f7bca0760f75594aed0a419a93d827692c68aaa9368a7048b8a78f48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560
Filesize264B
MD5ba68c37e21da8e121f2bad389ec5cc96
SHA1e9fcf2028398ef7b5333d684f3c6274b56cc6744
SHA256de084f37957d1f5dc9f818cb7728119159525dd7279b3dc83c690b2e15c33a58
SHA51266dd739f485c1d42431838b10f9bc9468f67b63cf114a3332b75a341afb7bbcd3185873b5079ed91d0b4c502280cdada68ae2d0a1485ed71f967b61021906bd5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
54B
MD5db420131f396adc6189eb74ccab4ef61
SHA1f7a0653289e00ae8a37836e4bb0c484a5434f4db
SHA25620712a091c0903c153ec0394f349e4e687fc16980c77434fab8af6c768b4de22
SHA5128f29ec5eae268faa330bc71859bada8e36b6f53e27d819dff04451de2cb644307c80f64f71b5768906a6c5eb28e5e77f4a1b23dde01bbfa0e6b9575c4fd92f73
-
Filesize
6KB
MD530c30ef2cb47e35101d13402b5661179
SHA125696b2aab86a9233f19017539e2dd83b2f75d4e
SHA25653094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
SHA512882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
-
Filesize
558B
MD532aaf95e81f7c25950c11c53615c753a
SHA1603ae202e859261d2ea09ac44f84d98a44007316
SHA256e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58
SHA5124076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db
-
Filesize
975KB
MD524dac6152c216a1b7b1afef7c36e2b65
SHA1a832467931f07b3f41772d89feb194a90be4119b
SHA256784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449
SHA512b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce
-
Filesize
758KB
MD5fb4665320c9da54598321c59cc5ed623
SHA189e87b3cc569edd26b5805244cfacb2f9c892bc7
SHA2569fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
SHA512b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf
-
Filesize
35.0MB
MD594089be88986618b7be913ee8b0d8a67
SHA1377ecca72bbdf278cb2a15531188e14eb59145e4
SHA256bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36
SHA51284d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591