Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 16:37

General

  • Target

    7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef.msi

  • Size

    18.4MB

  • MD5

    e94eb6be9108f379432b4687c8118d8a

  • SHA1

    ae6c7a88b243c5bbaf331ef7bf72aa849411a403

  • SHA256

    7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef

  • SHA512

    2bafff3240c240ac22f6a85207e374bf919d4ba2cb1fea28936bfde9c38dd140cb066a7210eb585926c2af2861937472d44191c126170be9c4ffb304d55c681f

  • SSDEEP

    393216:hQ0Frf5krXSujsG+tn43vEZMBsvuSqqVBRALiJ7AAP9dmQLQFH78XYEo8q:hQ05JQsG+54s0t7KR37AAPfrLQFgXw8q

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2008
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 331BC4A371540F3415E9862729DE32DC M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe
        "C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe" x "C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE" -o"C:\Program Files\AchieveAdvocateUnique\" -pRqmkCHAqYDofrFbTRHzi -y
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3004
      • C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe
        "C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe" -number 200 -file file3 -mode mode3 -flag flag3
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2984
      • C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe
        "C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe"
        3⤵
        • Executes dropped EXE
        PID:2736
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1004
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004C4" "0000000000000470"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f769f6d.rbs

    Filesize

    7KB

    MD5

    650e65d2b597664316943ddf38b056f2

    SHA1

    3f486904d8852f941625e09a4fcf86ab87ed8ae1

    SHA256

    edde8b01d713014ca3fba46924dfb7bb018912b099fee45525d933b1b9afbb37

    SHA512

    87fab9a36c0e72247359a7f808b114616400ef02b6491e957f248a13f27d7f1b38320c3a7b237980008205dcd3eb96e90597890c06a40f73764e6cf552142f49

  • C:\Program Files\AchieveAdvocateUnique\ChromeSetup.exe

    Filesize

    8.5MB

    MD5

    5adff4313fbd074df44b4eb5b7893c5e

    SHA1

    d27388ef6cf34d40e0e7666f6381fcc5bbafa0f7

    SHA256

    d0c7a4390bdd6b442b96fc76f8a38f7b756ba2c16752ea259844420161865cae

    SHA512

    f5d639922b91878cf83d97563288a3aa4cba94db3ad5e8ac11d24ef7c44b019383a4414aeba6171b4c7bfa83ea1eafc1231cc9233e3b82b5ca7dc0b3ffacbf60

  • C:\Program Files\AchieveAdvocateUnique\MrwBUjNvvYLA.exe

    Filesize

    574KB

    MD5

    42badc1d2f03a8b1e4875740d3d49336

    SHA1

    cee178da1fb05f99af7a3547093122893bd1eb46

    SHA256

    c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    SHA512

    6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

  • C:\Program Files\AchieveAdvocateUnique\VoJdQmpoYW6.exe

    Filesize

    2.1MB

    MD5

    1c65da3b593605961fe66bb4d4084498

    SHA1

    57f5be5cdf0b6716caf41290ab6753a01ff29954

    SHA256

    0393a96233c4d9a48767bc8ade9684a742068ddf5269c378a7f9f2379b0329d1

    SHA512

    6f81dadc8060dc852a136db9bb9714bf705b94a3d789a67916d01b793fb4a09fbd44818981956f374d03a2aa5c99b70b09d6c6ac02dca8b78e4421a611f955b5

  • C:\Program Files\AchieveAdvocateUnique\uxQTeZhsysKgAhmGAFbE

    Filesize

    765KB

    MD5

    d77d7a492861b33040238ad414540106

    SHA1

    3036572891a017157580854a650348f05037f70e

    SHA256

    dd34f06a206c139155d1855739c7da96752d4a464c952cc710fd7e9e58d18132

    SHA512

    95d3911a9aec01a22bba3f75a8e93d8410c69defdfa93bf122a7f9d205a6d2e76e1ad5d1c07bc8824aaaa488ce0b2123fb053635c3210b7b21c8754c656068c5

  • C:\Windows\Installer\f769f6b.msi

    Filesize

    18.4MB

    MD5

    e94eb6be9108f379432b4687c8118d8a

    SHA1

    ae6c7a88b243c5bbaf331ef7bf72aa849411a403

    SHA256

    7fcaf225d0407d2274dd7ed72dc373d44acef7c0f8acb49bc2e533c646d5e1ef

    SHA512

    2bafff3240c240ac22f6a85207e374bf919d4ba2cb1fea28936bfde9c38dd140cb066a7210eb585926c2af2861937472d44191c126170be9c4ffb304d55c681f

  • memory/2536-12-0x0000000000260000-0x0000000000262000-memory.dmp

    Filesize

    8KB