Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
Retrac_Launcher_1.0.9_x64_en-US.msi
Resource
win7-20240704-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_Launcher_1.0.9_x64_en-US.msi
Resource
win10v2004-20240709-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Retrac_Launcher_1.0.9_x64_en-US.msi
-
Size
6.6MB
-
MD5
79a3ef34fb61355df68b7931c56f08f5
-
SHA1
f945151e501116aa5d2fbe3698cd55ff9b766691
-
SHA256
e54675fdcd9d66f78f122b7dd4b61f2acd77951dcdd32914af8ace2ff71fd18c
-
SHA512
72c0e71202b50874a6200953e20adcd4b5b0299921172ab1185565fe57490b0073789e1528ebf1de5a7f2922b49b21a2c360f5aaaa455596f2f4fecfbad52f57
-
SSDEEP
196608:llBaVrNSXtyiN2gU3HS5oWQWnXl2m/YXGz:4db32jBnV2m/z
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
pid Process 708 powershell.exe 1752 powershell.exe 708 powershell.exe 1752 powershell.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Retrac Launcher\Retrac Launcher.exe msiexec.exe File created C:\Program Files\Retrac Launcher\Uninstall Retrac Launcher.lnk msiexec.exe File opened for modification C:\Program Files\Retrac Launcher\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76d470.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76d473.msi msiexec.exe File opened for modification C:\Windows\Installer\f76d474.ipi msiexec.exe File created C:\Windows\Installer\{7DD522F6-E5CD-4B2E-9A9D-A445D8FF8695}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID549.tmp msiexec.exe File created C:\Windows\Installer\f76d472.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f76d474.ipi msiexec.exe File created C:\Windows\Installer\f76d476.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76d46f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7B1.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f76d46f.msi msiexec.exe File created C:\Windows\Installer\f76d470.ipi msiexec.exe File opened for modification C:\Windows\Installer\{7DD522F6-E5CD-4B2E-9A9D-A445D8FF8695}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\f76d473.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Loads dropped DLL 9 IoCs
pid Process 2344 MsiExec.exe 2988 msiexec.exe 2988 msiexec.exe 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 2840 MsiExec.exe 2840 MsiExec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 2900 msiexec.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe -
Modifies registry class 35 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\ProductName = "Retrac Launcher" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\PackageName = "Retrac_Launcher_1.0.9_x64_en-US.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\PackageCode = "828E8B0467C91B844A891FE08A337B1D" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\ProductIcon = "C:\\Windows\\Installer\\{7DD522F6-E5CD-4B2E-9A9D-A445D8FF8695}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\287324E2A8A2DC05090DA73D4E4E3F4C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\Version = "16777225" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\287324E2A8A2DC05090DA73D4E4E3F4C\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F225DD7DC5EE2B4A9D94A548DFF6859\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\287324E2A8A2DC05090DA73D4E4E3F4C msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F225DD7DC5EE2B4A9D94A548DFF6859 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2988 msiexec.exe 2988 msiexec.exe 708 powershell.exe 2988 msiexec.exe 2988 msiexec.exe 1752 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2636 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2900 msiexec.exe Token: SeIncreaseQuotaPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeSecurityPrivilege 2988 msiexec.exe Token: SeCreateTokenPrivilege 2900 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2900 msiexec.exe Token: SeLockMemoryPrivilege 2900 msiexec.exe Token: SeIncreaseQuotaPrivilege 2900 msiexec.exe Token: SeMachineAccountPrivilege 2900 msiexec.exe Token: SeTcbPrivilege 2900 msiexec.exe Token: SeSecurityPrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeLoadDriverPrivilege 2900 msiexec.exe Token: SeSystemProfilePrivilege 2900 msiexec.exe Token: SeSystemtimePrivilege 2900 msiexec.exe Token: SeProfSingleProcessPrivilege 2900 msiexec.exe Token: SeIncBasePriorityPrivilege 2900 msiexec.exe Token: SeCreatePagefilePrivilege 2900 msiexec.exe Token: SeCreatePermanentPrivilege 2900 msiexec.exe Token: SeBackupPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeShutdownPrivilege 2900 msiexec.exe Token: SeDebugPrivilege 2900 msiexec.exe Token: SeAuditPrivilege 2900 msiexec.exe Token: SeSystemEnvironmentPrivilege 2900 msiexec.exe Token: SeChangeNotifyPrivilege 2900 msiexec.exe Token: SeRemoteShutdownPrivilege 2900 msiexec.exe Token: SeUndockPrivilege 2900 msiexec.exe Token: SeSyncAgentPrivilege 2900 msiexec.exe Token: SeEnableDelegationPrivilege 2900 msiexec.exe Token: SeManageVolumePrivilege 2900 msiexec.exe Token: SeImpersonatePrivilege 2900 msiexec.exe Token: SeCreateGlobalPrivilege 2900 msiexec.exe Token: SeCreateTokenPrivilege 2900 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2900 msiexec.exe Token: SeLockMemoryPrivilege 2900 msiexec.exe Token: SeIncreaseQuotaPrivilege 2900 msiexec.exe Token: SeMachineAccountPrivilege 2900 msiexec.exe Token: SeTcbPrivilege 2900 msiexec.exe Token: SeSecurityPrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeLoadDriverPrivilege 2900 msiexec.exe Token: SeSystemProfilePrivilege 2900 msiexec.exe Token: SeSystemtimePrivilege 2900 msiexec.exe Token: SeProfSingleProcessPrivilege 2900 msiexec.exe Token: SeIncBasePriorityPrivilege 2900 msiexec.exe Token: SeCreatePagefilePrivilege 2900 msiexec.exe Token: SeCreatePermanentPrivilege 2900 msiexec.exe Token: SeBackupPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeShutdownPrivilege 2900 msiexec.exe Token: SeDebugPrivilege 2900 msiexec.exe Token: SeAuditPrivilege 2900 msiexec.exe Token: SeSystemEnvironmentPrivilege 2900 msiexec.exe Token: SeChangeNotifyPrivilege 2900 msiexec.exe Token: SeRemoteShutdownPrivilege 2900 msiexec.exe Token: SeUndockPrivilege 2900 msiexec.exe Token: SeSyncAgentPrivilege 2900 msiexec.exe Token: SeEnableDelegationPrivilege 2900 msiexec.exe Token: SeManageVolumePrivilege 2900 msiexec.exe Token: SeImpersonatePrivilege 2900 msiexec.exe Token: SeCreateGlobalPrivilege 2900 msiexec.exe Token: SeCreateTokenPrivilege 2900 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2900 msiexec.exe 2900 msiexec.exe 2636 msiexec.exe 2636 msiexec.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 2344 2988 msiexec.exe 31 PID 2988 wrote to memory of 708 2988 msiexec.exe 36 PID 2988 wrote to memory of 708 2988 msiexec.exe 36 PID 2988 wrote to memory of 708 2988 msiexec.exe 36 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 2840 2988 msiexec.exe 45 PID 2988 wrote to memory of 1752 2988 msiexec.exe 47 PID 2988 wrote to memory of 1752 2988 msiexec.exe 47 PID 2988 wrote to memory of 1752 2988 msiexec.exe 47 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_Launcher_1.0.9_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2900
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADC0D98CF3F8A4BB91D0DC241589A13C C2⤵
- Loads dropped DLL
PID:2344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:708
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 880F8646C4032747C2B65432340EAD7F C2⤵
- Loads dropped DLL
PID:2840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2800
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D8" "00000000000004B0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2776
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2708
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1520
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Retrac_Launcher_1.0.9_x64_en-US.msi"1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2636
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000005E8" "00000000000004B0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5943880712fe26cf5e9dbc1472f6ddf29
SHA1de771f0dbab34ecc164313c57dd1e3fc58c8645c
SHA2566b0431ac3495847232adecf728d0c745fa9500fb200f5d8ebd5b314e736dd0e3
SHA512708a7092b49e7849d44bbac175f4142f6dec6f3367f730370a7203fdada6e70322249b96887f6fbfeb50b4a6af739fe1a2b34428d57607a9ff37cd0b80d249df
-
Filesize
2KB
MD5a9272f8cbd542848392e5b201b0a3d9a
SHA1cc2eaffd9b2850fb955d43e4885201c29df124bd
SHA256b62e66008c1366effe469f2e197195dd8866a6ddeb7c8a792664df6ff56032ea
SHA512c3a1b9018b04e895d29d3083df44bae0c26dec91821cec0b1de4ce4a61ffe378e26923828b7e814181bab677fc9fa7e6b1bfc35d51e2e38a41d2f6ab48c26d3a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD526c43b4dda4fa1de37f88ae7cc74e5ca
SHA1d514451ab783ec084c1f4531ede62a3aa0caa701
SHA256129414db9dd1f919ae5c447803230029d4e6e5989c72a54ac089332418c2d7f9
SHA51214c9da6d6c04efce0c69d55c30d1bbb89772f7131154e17eaac08bafc0c6aae3e006c3d082a4f90596c3fa17942a859a773f2ee7d7b3301beb0fd08cddc7880d
-
Filesize
6.6MB
MD579a3ef34fb61355df68b7931c56f08f5
SHA1f945151e501116aa5d2fbe3698cd55ff9b766691
SHA256e54675fdcd9d66f78f122b7dd4b61f2acd77951dcdd32914af8ace2ff71fd18c
SHA51272c0e71202b50874a6200953e20adcd4b5b0299921172ab1185565fe57490b0073789e1528ebf1de5a7f2922b49b21a2c360f5aaaa455596f2f4fecfbad52f57
-
Filesize
92KB
MD5b57f2765879042b033b21c525c289d80
SHA157e306c6336fb5c177a495d1058676dd725ec82e
SHA256b9f884956c9d614cce40b8e362f814c279ac9c93bbfba75601587bcd6b7cd117
SHA51280a1b49041acf176cb488be453b272e5290dca5fc912f658b03ad4b51e635f08876e1d3a00e47f6018a5b0f60b43a28687df378c79f240e4342394545355beaf
-
Filesize
12.7MB
MD58a411f7637a57f78d46eeb31847a5d18
SHA1e177907ad513d2e2ccbc56d46cf2ad9bacd263f4
SHA2563a4e19039b443e73f9247b42f7780552af52dd647bbf6a9010a2e58fde4c33b1
SHA5123e6339652efd8b41671fcc29e9fd36696d17b3a9fce8795bfd1790b0a1c95fa4f3e41af86ed54e5387d437c2471837694e4188ea3ed56dea3d863b320daa3cb5
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600