Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
CRforVS13SP29_0-10010309.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
CRforVS13SP29_0-10010309.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
CRforVS13SP29_0-10010309.exe
-
Size
374.6MB
-
MD5
cf2c10349b9a91c62a71116babcf9524
-
SHA1
986ce6a9718e2762f385dcf50f9de34a9bd2e498
-
SHA256
f444a8d3170710a908aceb7f940170027e901334c7283905a8bd316bc54b8835
-
SHA512
6c642e6f4a3709a72fb7eabb38d8033a0f8442944c2fbb8c3e8eb620833e6aaf0b0b5448e112c49952ae379373432c5241415faf61e20acf9b2b9b43a9dae630
-
SSDEEP
6291456:jiWTNdWXEbLnxByxO+aE3F8fZB+3I2TXnu8YyAzrzsnlYAI770omn0FHBxoRA0wM:OWTNdWcxcxh3FQN27nunzsnCXG0FhxoP
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation CRforVS13SP29_0-10010309.exe -
Executes dropped EXE 1 IoCs
pid Process 3212 setup.exe -
Loads dropped DLL 2 IoCs
pid Process 768 MsiExec.exe 768 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: setup.exe File opened (read-only) \??\Q: setup.exe File opened (read-only) \??\V: setup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: setup.exe File opened (read-only) \??\B: setup.exe File opened (read-only) \??\I: setup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: setup.exe File opened (read-only) \??\L: setup.exe File opened (read-only) \??\Y: setup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: setup.exe File opened (read-only) \??\S: setup.exe File opened (read-only) \??\X: setup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: setup.exe File opened (read-only) \??\N: setup.exe File opened (read-only) \??\R: setup.exe File opened (read-only) \??\Z: setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: setup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: setup.exe File opened (read-only) \??\K: setup.exe File opened (read-only) \??\O: setup.exe File opened (read-only) \??\T: setup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: setup.exe File opened (read-only) \??\U: setup.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRforVS13SP29_0-10010309.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3212 setup.exe Token: SeIncreaseQuotaPrivilege 3212 setup.exe Token: SeSecurityPrivilege 688 msiexec.exe Token: SeCreateTokenPrivilege 3212 setup.exe Token: SeAssignPrimaryTokenPrivilege 3212 setup.exe Token: SeLockMemoryPrivilege 3212 setup.exe Token: SeIncreaseQuotaPrivilege 3212 setup.exe Token: SeMachineAccountPrivilege 3212 setup.exe Token: SeTcbPrivilege 3212 setup.exe Token: SeSecurityPrivilege 3212 setup.exe Token: SeTakeOwnershipPrivilege 3212 setup.exe Token: SeLoadDriverPrivilege 3212 setup.exe Token: SeSystemProfilePrivilege 3212 setup.exe Token: SeSystemtimePrivilege 3212 setup.exe Token: SeProfSingleProcessPrivilege 3212 setup.exe Token: SeIncBasePriorityPrivilege 3212 setup.exe Token: SeCreatePagefilePrivilege 3212 setup.exe Token: SeCreatePermanentPrivilege 3212 setup.exe Token: SeBackupPrivilege 3212 setup.exe Token: SeRestorePrivilege 3212 setup.exe Token: SeShutdownPrivilege 3212 setup.exe Token: SeDebugPrivilege 3212 setup.exe Token: SeAuditPrivilege 3212 setup.exe Token: SeSystemEnvironmentPrivilege 3212 setup.exe Token: SeChangeNotifyPrivilege 3212 setup.exe Token: SeRemoteShutdownPrivilege 3212 setup.exe Token: SeUndockPrivilege 3212 setup.exe Token: SeSyncAgentPrivilege 3212 setup.exe Token: SeEnableDelegationPrivilege 3212 setup.exe Token: SeManageVolumePrivilege 3212 setup.exe Token: SeImpersonatePrivilege 3212 setup.exe Token: SeCreateGlobalPrivilege 3212 setup.exe Token: SeCreateTokenPrivilege 3212 setup.exe Token: SeAssignPrimaryTokenPrivilege 3212 setup.exe Token: SeLockMemoryPrivilege 3212 setup.exe Token: SeIncreaseQuotaPrivilege 3212 setup.exe Token: SeMachineAccountPrivilege 3212 setup.exe Token: SeTcbPrivilege 3212 setup.exe Token: SeSecurityPrivilege 3212 setup.exe Token: SeTakeOwnershipPrivilege 3212 setup.exe Token: SeLoadDriverPrivilege 3212 setup.exe Token: SeSystemProfilePrivilege 3212 setup.exe Token: SeSystemtimePrivilege 3212 setup.exe Token: SeProfSingleProcessPrivilege 3212 setup.exe Token: SeIncBasePriorityPrivilege 3212 setup.exe Token: SeCreatePagefilePrivilege 3212 setup.exe Token: SeCreatePermanentPrivilege 3212 setup.exe Token: SeBackupPrivilege 3212 setup.exe Token: SeRestorePrivilege 3212 setup.exe Token: SeShutdownPrivilege 3212 setup.exe Token: SeDebugPrivilege 3212 setup.exe Token: SeAuditPrivilege 3212 setup.exe Token: SeSystemEnvironmentPrivilege 3212 setup.exe Token: SeChangeNotifyPrivilege 3212 setup.exe Token: SeRemoteShutdownPrivilege 3212 setup.exe Token: SeUndockPrivilege 3212 setup.exe Token: SeSyncAgentPrivilege 3212 setup.exe Token: SeEnableDelegationPrivilege 3212 setup.exe Token: SeManageVolumePrivilege 3212 setup.exe Token: SeImpersonatePrivilege 3212 setup.exe Token: SeCreateGlobalPrivilege 3212 setup.exe Token: SeCreateTokenPrivilege 3212 setup.exe Token: SeAssignPrimaryTokenPrivilege 3212 setup.exe Token: SeLockMemoryPrivilege 3212 setup.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3212 setup.exe 3212 setup.exe 3212 setup.exe 3212 setup.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3636 wrote to memory of 3212 3636 CRforVS13SP29_0-10010309.exe 84 PID 3636 wrote to memory of 3212 3636 CRforVS13SP29_0-10010309.exe 84 PID 3636 wrote to memory of 3212 3636 CRforVS13SP29_0-10010309.exe 84 PID 688 wrote to memory of 768 688 msiexec.exe 91 PID 688 wrote to memory of 768 688 msiexec.exe 91 PID 688 wrote to memory of 768 688 msiexec.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\CRforVS13SP29_0-10010309.exe"C:\Users\Admin\AppData\Local\Temp\CRforVS13SP29_0-10010309.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3212
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0E0A59FABE0D3C6031395E4E5D240A35 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5a5e62eb88f1ff6bfc0649415e203bdb6
SHA1befdd15ed57f19013d355dfa3908981f5062c2ec
SHA256e694fbbd7b691674d25c71da30f36dec52e06d0542baa5bdbc3c5b7b696a7934
SHA51220f4e1177b9a0e2850c8cdb79a4f34f2f89aa507ae59bed651c2a971074e436b6bf4935affae431d4a19c1e4d516cb3d7f6c9a6627695106b5ce567819f749d6
-
Filesize
268KB
MD523cde22035b62b6e9c87fa2bfa1ca7d4
SHA121eae83940e30b0f4623efc58ac0fa37528f7275
SHA256330d514ca2d6a93a2bf122dc71b47fb2301aa01695441f2a937a8f66fbf84e42
SHA51245de290f746d7a96a701764dc0b2d0fc68cb168246ed87b836f3a80618dd09b9ff8abf56445386d08367cd2e0e53f3a9af381fff1870d859ebca64e4f2f82cb4
-
Filesize
300KB
MD5e7a748b2e9b5e68f457edc2415af944d
SHA151556df613ad54684e40b8e83d5dbc4e63424cc2
SHA256b0178beeba6020ab0720d2362460afb7680906f5281e53682ec98ad40748ae9e
SHA512e7c6e650274108feda9ee13a50649a91060c4288fb89e64e5d5f51c58506d05125cab97a926b77ccdb762bac4bdff7c88f9a3f86c8cd88b52b6baf3e0c9a3cc1
-
Filesize
3.4MB
MD55b45fb825b3ee4370ab066813002e86b
SHA11ac63aad11dd26db7dcb1524695dd50cf63f0334
SHA2566b7b104341585703ba1a4ac025ea2c7aa591ec79467270b322e5e9d9f0419d99
SHA5120a1a7e12740f5170a1a2ba3eac3e9ab74f0b32761898f15195bd007279fc9da125f80c99284d4f54cf6a1c9b09d27f5ed7fae94b185560633168d9d9204c52e0
-
Filesize
230B
MD5e495d03378fb39b980228abae1c880f5
SHA150fe165b6fe0cee012bea4fe92120116a8596fc4
SHA256cb9b4b4c065f75ea1c61baaecb14afebd1810b38bf84834980f95ccf71f7c78e
SHA512cce1fd439494de0c1463c31f7fe3a2d60f3f7a5c016fa3af1fbb319cf64b79534c4633fd613572dd0cd91d653073ccefc7b36bb3c5f87a502777245cf910c30e