Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/06/2024, 18:21 UTC

240616-wzfn9avhrn 7

16/06/2024, 17:48 UTC

240616-wdm67s1alg 8

Analysis

  • max time kernel
    1657s
  • max time network
    1676s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 17:48 UTC

General

  • Target

    tmp/ViGEmBusSetup_x64.msi

  • Size

    856KB

  • MD5

    d8d2cff2eae7f1d956e3f8a2edaf891d

  • SHA1

    bc33e35ed5d60c492bd6733462bd6cbc19c2cd59

  • SHA256

    5abbba8a4a07aaaeb50b4666183b2f243e0e5ad288026d2a9f3595ed237c4b28

  • SHA512

    50d98dd7d81e309cf764da7d40e321270f2e5ebc387d7b35ddb414c2efcfaa1bf302e51d5dfd3fa4cf871a3449705dc5e57466a3e97fdd5c16f5af3cd3051447

  • SSDEEP

    12288:ks/zRZDhrFD7Pd2w1t3jOZy2KsGU6a4KsBex5VkDSiF:d9ZDpFD7V2wbzOE2Z34Kd54S

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp\ViGEmBusSetup_x64.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2976
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.