Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 20:00

General

  • Target

    playit-windows-x86_64-signed.msi

  • Size

    2.1MB

  • MD5

    818632a790c6f405474d29e66bd9bcec

  • SHA1

    0140d14851f2a16e37fe4a3b1c126d4b2cead3b1

  • SHA256

    91ff5e398d2c7b7c04e7ddfd58936246839f27d8db7b7474d55e1b38a7b634d0

  • SHA512

    2285fa657cb372e571d3487d68be9b534b8308cfd086e8a0499945f604339a9d71e4103494d41eaed783bb1ff986307ef9e18dfce67c5e53d4b0b5dd53327b04

  • SSDEEP

    49152:2+vdFMXhTj0et/HJQ+rd7OYJCYE312NXNdmVci2wy9SIT7ZGjYTytJPr+VuOSAEq:2+rYxQ+rxOZ12NbmVci2wy9SIT7ZGjYB

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\playit-windows-x86_64-signed.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1216
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads