Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

bbb45077f5...36.msi

windows7-x64

6

bbb45077f5...36.msi

windows10-2004-x64

6

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 02:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi

  • Size

    35.0MB

  • MD5

    94089be88986618b7be913ee8b0d8a67

  • SHA1

    377ecca72bbdf278cb2a15531188e14eb59145e4

  • SHA256

    bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36

  • SHA512

    84d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987

  • SSDEEP

    786432:Ilk27h2QVu9cCct5rB9rIX9gW6cnzELhEe2x53gp2KM:IlfA+ptO2Cnne2xU2

Score
6/10
execution

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Loads dropped DLL 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2848
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0C9850EA11B1CDBB68C35D712DB99C4
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss28B9.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi28B6.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr28B7.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr28B8.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f762225.rbs
    Filesize

    18KB

    MD5

    ece65bfdaceebc02d311cfa7848af065

    SHA1

    2a88a414072476bda4a7741f51c22348b4bd2ac3

    SHA256

    756d2bc824a9587ed0356b9b9b29f4d8300d184af8119f045df833dbeef77181

    SHA512

    bbad10bb8768269e772a298f24869f6ff7f1c01a8e5690015cf644cafc3db4aeef6d86bfbfb339a600ebf29b090ab62e4fac1c53f6782d51e08d04c5a1cde60c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560
    Filesize

    1KB

    MD5

    e94fb54871208c00df70f708ac47085b

    SHA1

    4efc31460c619ecae59c1bce2c008036d94c84b8

    SHA256

    7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

    SHA512

    2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    98b0298603cbf6f0d9f45f7d9dee4eea

    SHA1

    dd5f29ecd0102638738748522ff9af5ff7bd822d

    SHA256

    ac0cf92d132c26fe31c0403fd9094ad594261d820ffd2ccffd353100fbd24da8

    SHA512

    96e360c1a1e68d5fb2064373402ccaed630853f04ef6a205aac607fe4754b0e42860d1d3f7bca0760f75594aed0a419a93d827692c68aaa9368a7048b8a78f48

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560
    Filesize

    264B

    MD5

    ba68c37e21da8e121f2bad389ec5cc96

    SHA1

    e9fcf2028398ef7b5333d684f3c6274b56cc6744

    SHA256

    de084f37957d1f5dc9f818cb7728119159525dd7279b3dc83c690b2e15c33a58

    SHA512

    66dd739f485c1d42431838b10f9bc9468f67b63cf114a3332b75a341afb7bbcd3185873b5079ed91d0b4c502280cdada68ae2d0a1485ed71f967b61021906bd5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab20AC.tmp
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar20AF.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\msi28B6.txt
    Filesize

    54B

    MD5

    db420131f396adc6189eb74ccab4ef61

    SHA1

    f7a0653289e00ae8a37836e4bb0c484a5434f4db

    SHA256

    20712a091c0903c153ec0394f349e4e687fc16980c77434fab8af6c768b4de22

    SHA512

    8f29ec5eae268faa330bc71859bada8e36b6f53e27d819dff04451de2cb644307c80f64f71b5768906a6c5eb28e5e77f4a1b23dde01bbfa0e6b9575c4fd92f73

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\pss28B9.ps1
    Filesize

    6KB

    MD5

    30c30ef2cb47e35101d13402b5661179

    SHA1

    25696b2aab86a9233f19017539e2dd83b2f75d4e

    SHA256

    53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

    SHA512

    882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\scr28B7.ps1
    Filesize

    558B

    MD5

    32aaf95e81f7c25950c11c53615c753a

    SHA1

    603ae202e859261d2ea09ac44f84d98a44007316

    SHA256

    e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58

    SHA512

    4076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libgcrypt-20.dll
    Filesize

    975KB

    MD5

    24dac6152c216a1b7b1afef7c36e2b65

    SHA1

    a832467931f07b3f41772d89feb194a90be4119b

    SHA256

    784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449

    SHA512

    b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce

    Download Submit

  • C:\Windows\Installer\MSI283C.tmp
    Filesize

    758KB

    MD5

    fb4665320c9da54598321c59cc5ed623

    SHA1

    89e87b3cc569edd26b5805244cfacb2f9c892bc7

    SHA256

    9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

    SHA512

    b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

    Download Submit

  • C:\Windows\Installer\f762221.msi
    Filesize

    35.0MB

    MD5

    94089be88986618b7be913ee8b0d8a67

    SHA1

    377ecca72bbdf278cb2a15531188e14eb59145e4

    SHA256

    bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36

    SHA512

    84d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987

    Download Submit

  • \Windows\Installer\MSI2665.tmp
    Filesize

    738KB

    MD5

    b158d8d605571ea47a238df5ab43dfaa

    SHA1

    bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

    SHA256

    ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

    SHA512

    56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

    Download Submit