Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 02:56

General

  • Target

    bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi

  • Size

    35.0MB

  • MD5

    94089be88986618b7be913ee8b0d8a67

  • SHA1

    377ecca72bbdf278cb2a15531188e14eb59145e4

  • SHA256

    bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36

  • SHA512

    84d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987

  • SSDEEP

    786432:Ilk27h2QVu9cCct5rB9rIX9gW6cnzELhEe2x53gp2KM:IlfA+ptO2Cnne2xU2

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 14 IoCs
  • Loads dropped DLL 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2824
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 530C083810F7601B13597EBA48B8B723
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss6AF2.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi6AEF.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr6AF0.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr6AF1.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57641c.rbs

    Filesize

    19KB

    MD5

    c0a85eac7143c2a173032eb49bc17c7a

    SHA1

    00cf412ca956d1938093c29c9968044529379188

    SHA256

    6353429bdfe7fd42a0350076107d6f8e7cf0b954a5d283defb727c9f1b36e4a2

    SHA512

    ebe88266441927d12fce9bb79796cc28d0b1c72ca7dd81641ce81ea79581cf7d25a53ab194e690197fec006e1780594703f6b8f1ee19f273e46eea38a0176bc8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_E049417E5C2A0ECD64032982D0A31504

    Filesize

    1KB

    MD5

    09a503f2cd5a8b03d815617332b3a135

    SHA1

    adaeeece9b8092415a1ff15b367e3621e2fa6470

    SHA256

    aece3cd2e86a56c689a87316786b4dae3ccf00edc52d5a59f93b1b6948c98caf

    SHA512

    9664209a16c01c1ee3f85db5f4cf1559d7f0d59b26bd39045d363dee3468e763c14c7a748198e627092681be6679c94f22e2ae9b92189cc96a1d119197d7964b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

    Filesize

    1KB

    MD5

    ede73b901e0d3d0278803d3308d3c92d

    SHA1

    3b801b80ae63d1e481d15160c3c107cbbaaf1598

    SHA256

    882b12505a9d8a895a0a3c1f0ec4430516d0165549ee4f1f63a26983727c2b33

    SHA512

    1795ed50d73873974b9fbcad20c922aebc83bc6120ef9aa4ddb4a3005b5fa2696acdb64dea2beed0a715cfe6a3206faed462c16aa31e3454a870f4dbd65ffccd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_E049417E5C2A0ECD64032982D0A31504

    Filesize

    536B

    MD5

    3fa6a4c64adf40809811719e85aad913

    SHA1

    91f4b704c930942bbebfe3d95ee1193b67615213

    SHA256

    0c0d1a46f23a4d4ade7562aebd36f8c07b7f53a86d58977c8e98e7260585206d

    SHA512

    934da2b9f5152e05cb7c1fc1223caa8c5627226b272b3e9a0aa86c835d927de11f5e5afebc86e90ed2e5ba790713da9f41cd8a7ef7c4425e662a65907f0ede0f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

    Filesize

    536B

    MD5

    25b85bc9d13e453f849e9094fdf8090e

    SHA1

    3e3ddd28868cdeaa499f7195b63c2ad2c32ddcf3

    SHA256

    8df2007425ba06eb73ed19dd44fe031ea43903ef9abe77eddb396dbe5c124045

    SHA512

    de2c69081b6ba9503f9a4de8de343b6f470020f2e593eceaff981235b73ad8344467abf66ee9997f275e468b41d184afa2fa3ef6436ad1b79afdf55f6adf018f

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33ai1t2z.mxn.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\msi6AEF.txt

    Filesize

    54B

    MD5

    db420131f396adc6189eb74ccab4ef61

    SHA1

    f7a0653289e00ae8a37836e4bb0c484a5434f4db

    SHA256

    20712a091c0903c153ec0394f349e4e687fc16980c77434fab8af6c768b4de22

    SHA512

    8f29ec5eae268faa330bc71859bada8e36b6f53e27d819dff04451de2cb644307c80f64f71b5768906a6c5eb28e5e77f4a1b23dde01bbfa0e6b9575c4fd92f73

  • C:\Users\Admin\AppData\Local\Temp\pss6AF2.ps1

    Filesize

    6KB

    MD5

    30c30ef2cb47e35101d13402b5661179

    SHA1

    25696b2aab86a9233f19017539e2dd83b2f75d4e

    SHA256

    53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

    SHA512

    882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

  • C:\Users\Admin\AppData\Local\Temp\scr6AF0.ps1

    Filesize

    558B

    MD5

    32aaf95e81f7c25950c11c53615c753a

    SHA1

    603ae202e859261d2ea09ac44f84d98a44007316

    SHA256

    e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58

    SHA512

    4076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db

  • C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libgcrypt-20.dll

    Filesize

    975KB

    MD5

    24dac6152c216a1b7b1afef7c36e2b65

    SHA1

    a832467931f07b3f41772d89feb194a90be4119b

    SHA256

    784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449

    SHA512

    b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce

  • C:\Windows\Installer\MSI6561.tmp

    Filesize

    738KB

    MD5

    b158d8d605571ea47a238df5ab43dfaa

    SHA1

    bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

    SHA256

    ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

    SHA512

    56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

  • C:\Windows\Installer\MSI6844.tmp

    Filesize

    758KB

    MD5

    fb4665320c9da54598321c59cc5ed623

    SHA1

    89e87b3cc569edd26b5805244cfacb2f9c892bc7

    SHA256

    9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

    SHA512

    b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

  • C:\Windows\Installer\e576419.msi

    Filesize

    35.0MB

    MD5

    94089be88986618b7be913ee8b0d8a67

    SHA1

    377ecca72bbdf278cb2a15531188e14eb59145e4

    SHA256

    bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36

    SHA512

    84d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987

  • memory/3768-56-0x0000000005A40000-0x0000000005D94000-memory.dmp

    Filesize

    3.3MB

  • memory/3768-58-0x0000000005F10000-0x0000000005F5C000-memory.dmp

    Filesize

    304KB

  • memory/3768-57-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

    Filesize

    120KB

  • memory/3768-60-0x0000000007840000-0x0000000007EBA000-memory.dmp

    Filesize

    6.5MB

  • memory/3768-61-0x0000000006430000-0x000000000644A000-memory.dmp

    Filesize

    104KB

  • memory/3768-62-0x00000000070F0000-0x0000000007186000-memory.dmp

    Filesize

    600KB

  • memory/3768-63-0x00000000064C0000-0x00000000064E2000-memory.dmp

    Filesize

    136KB

  • memory/3768-64-0x0000000007EC0000-0x0000000008464000-memory.dmp

    Filesize

    5.6MB

  • memory/3768-46-0x00000000058D0000-0x0000000005936000-memory.dmp

    Filesize

    408KB

  • memory/3768-45-0x00000000057F0000-0x0000000005856000-memory.dmp

    Filesize

    408KB

  • memory/3768-44-0x0000000005010000-0x0000000005032000-memory.dmp

    Filesize

    136KB

  • memory/3768-43-0x0000000005110000-0x0000000005738000-memory.dmp

    Filesize

    6.2MB

  • memory/3768-42-0x0000000002590000-0x00000000025C6000-memory.dmp

    Filesize

    216KB