Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 13:33

General

  • Target

    cvery.com/Aspose.Project.msi

  • Size

    1.8MB

  • MD5

    7cb16f5b86ac83968ed2658f07197194

  • SHA1

    6217590f6a50a7d7153b6929b09c8c3cec155407

  • SHA256

    58d60a9b8531f74288acd34997ba90e366f955052dc63757a9345386c26e1e86

  • SHA512

    82e62edd0fefef514540bed77340b55ec3394b390f5f41f7c1b071b9fd9fcbc38b59a92c062946eef6e674e7722ac9b03be08db9ba06c78bd9a1a1f738671046

  • SSDEEP

    49152:1eN67Bt+EEBe3Q5IN2DXPANeMrmV/juYoXP0r:I6X3x3wIsjAsMrmtjAi

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 2 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cvery.com\Aspose.Project.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2356
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B1D7D9B200DCBAB6A52431A7E12E56B6 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=9832
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b7e66e29b625e4370f4a88313c346ad1

    SHA1

    2a7b3296f9675ea42d4e7ed1fe3614c6a6143895

    SHA256

    3294c8e73cb23adad8e72270a77505ef083bb62e7b819350ef5b862f842ce8b5

    SHA512

    cca5bb27c7a034dc370c61297af6424895d7598b9e514cae6fffa62176793d2bef217d9d64c08375d9a79419dc71f7616be56e9cfa935059349dcd19793d8b40

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4f7f288a749b09e3290cfaa4f73181ec

    SHA1

    23a922432c9aa2d24915a47b891d3b8fda9ebca7

    SHA256

    c27d56c32d9dc2c573ad9dc3c7562d189cae06901c067e3cdd96586a6eb2fe0a

    SHA512

    e49bdbafa3a07c1d060fc59143fd3b95c9d3aaccf3ecf6bcfb6275762b428a27a5df0f4e8429eae68a26f75b192312eeb2f2b6417d5cd70783c529c68da436d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    afe49ffabc601543168799e9c9d22bd5

    SHA1

    e0ca55b316af5441ca225ae1ff10ddbec30b72d8

    SHA256

    004c37a50cd695a06246b81b002ce661c8da71a73d2df1993c2654501c1b3e31

    SHA512

    ba5339c17efe3f2f679c060774b620596aa7f3c067be56447c5ecea064ee41fba7280b5dbcc9c2df662661e92d318369f6b88253565760c00e0afb46a0c5ea3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e0c623ac28e146b909ef8c2ec02fa13b

    SHA1

    e5ae54d020d168128d08b4aff9cf831dc64ab736

    SHA256

    9b367e1fdc875ca8f8835e751f312852fc906f6dff357204b252ad11a34cdc58

    SHA512

    945acb535b5f1e7db77ec5a9044cb02aa6acd84416b5e66f86edf92389057173aaa3bc91835c634eaffc8fce09b2a7dc70fdf505762deaec04e10131e457ec7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6bcf7d943c1bcd3e4aefba58e1cab26d

    SHA1

    4d4eec4be5755ed53e4fc3a61c0a938614ea3994

    SHA256

    5e6e71af5fba6c257ee450a487c8f4bbc357d1eba4f5fa11f64b8ab63413a148

    SHA512

    95c53517295f5b6425027fa0c4462cb0f283c77c4773050f9b32fd7de6479da6aa9c1b2121d06b4e479af2c6d9d655482b1c9e5bd88b9ab8bcd1251830100eaf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d24de7c5bf8c1896a74f5c8d6bc417e1

    SHA1

    e9e7994c7acd65b48f0caad5deaecb71e822c90a

    SHA256

    c20329831138e53c292d9ea7f0f7c94c0135f48528c1a52c471d8f2b8edf72f6

    SHA512

    5524f95185d2bad0c4f964bcb787d6ca1ebea8eae0ec9280de010959fe54f27b54de7b30497c3edd969b1b37436080a9a3acbf47d9015eb060f1ba9bb98ba9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    88a9044350bfd9c3896bbc002b991f40

    SHA1

    5c08cf7691461aa5fcc0c4382bcd91e830254bfa

    SHA256

    9e93cffc7dfe03b3d1d0f7c963a2d328c6dd78c59e64307aafe8c16f7f144ce7

    SHA512

    a7b6b1a3fd73e254336c03b28d6a88517cdb374c32455d65e04d9bdce0968c956b2d6894ed9be96f4f01cc1a523efa385d1507f8e722982d5e7a177edb2ffb5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06a0a557b0dc71e186c5a6d3e767abc2

    SHA1

    1fccfeae232cdf76d1c82dddc056c8e5998f0532

    SHA256

    fe9dd367b68e2693e892fdf5926ff2a2339572a4b369f33e06dfee8593b5eefd

    SHA512

    a6988a8f1037fa63b27e2750fe0f96915a7771581fac224e86a6aaa790bc34685eea5ef3558826e3787beeb376bb153335059fdfd2227177e59662f19b4b8b7a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8bae6b7544e02c857b7282c6888a4deb

    SHA1

    584a688f9615c737b0da7eae33f775819944e37c

    SHA256

    a068132fcd52ac88581c00feeb6c78cf858959b413fddd7e63fddc6b904143a3

    SHA512

    a0a70dfa557f8af58c3dcbb66262ea61f769a18891651efa5fa4b0d77dc5ab2dfdc1ce8de82770f03726c5c13772e88a378841080dd460fb910f118f7beb9649

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    df14117afbe49874f37c6dc7dcdf94e5

    SHA1

    413bec3562ef0253d622007e303e1c584e82f156

    SHA256

    14dce63b214ef06fe0d481814ad2d45046710ea1583b3f71d886be8253da66bf

    SHA512

    f479a758ccebc03d8042f59499e86084cc5b9a09e4cb99532c098314cb0db5180fe961060e7334bc4edd286d0fa23bb2a1457b95b7aa9e1af6fa4f01713ce21c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9a26608a6428ad2e1e4ba4b7d594ae6c

    SHA1

    6ae44d99a1f8bd9851fab2ab3f3abc2eb02a9dc5

    SHA256

    0478260b5f66563aa3e035887b033832dc130022124e01d3dc02aa19be1e68c6

    SHA512

    3a2dff9190fff35e22edcf03a1bb650493d6d92c56a66c1b46ced489d36a31c028dbcd1d1514083125726849b6d71b9290198adb3562457c0e1fbdb8deb3c142

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    704eaba287b44d94a44ee8e6485d1118

    SHA1

    fa8528e8d6778ccae36746c4a438e699086aef62

    SHA256

    020c056fa276fac2524aca6ae0fea6bdda46a50dff091385fec63a87a6296285

    SHA512

    ae86724cdf6237070b54574b4e8b1eb4fe6e6eab2aef80e39663f3a4cb48d976a4dbd63e1d375231a820500d501cb9ec47e3cddac5a0a5ffcfc083013645734e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f62c70e626de02b7b5962c682c5ab74b

    SHA1

    04b77be35ada554c9f23882b8461737d9ed8442b

    SHA256

    22da05f0b0469f6c5714d9e46bc4ea3f293a01271f73038887bf60fa765dcbee

    SHA512

    45412cd11c773747bf0a612565fbd078116e6a373d33054b3caceeb03df03f11f375f1d7b37b55076f557e175fefeb2319f6b6d4da555c1d0131dbb6e1e6eb97

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d8ce1b94f818094325fd4360426bc9f8

    SHA1

    d8608dbc975658fd1d77cfea3c1a3939d33f5fc5

    SHA256

    eef23e042f3bc14764c773827cda4109b54307359138f188f99f12d1372d4fbe

    SHA512

    998046796cf7d4a5592baba1c9269bd670787e7204fb7af918ecb7d90287a99f2c3c9f1e37ead3031df7bf0911583f5aaaef8c7efbf9d49ba96159d43777d852

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    20b0e0421e0be03019a86e03bc0c1923

    SHA1

    11f6566a85ffe5899c44961c8431bd50a0eca6e5

    SHA256

    bc92878f7fa67f9731ddad3fc7399a325cd60d9b493958e4fb8b2f0b44c2e51d

    SHA512

    2c408dbd13162e2f36f035ebd4aff6241f03de7932c98df4e13a0fcaaa0abebf9d4ed97bd0f8f1f641ef782a2f7894270cb45713d11e5c9fa39baa0144d33ed2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    379c455f3454454b7d544e0c90203e04

    SHA1

    397540045ffc4dd39e1f8e75cd98680a9be76c62

    SHA256

    5af0dc93ee1baf2707ba117af03d6f13a8d3c74e5755cc9f8f45fe0adfa9a460

    SHA512

    8603410b68ed4c7c667c7c2da2d61226be097c7e7b6c04f4d358c9ed73a287b6ecd68476204f2b2ab84907c679550ad2c09053f073313e1998cd889fd56033f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3e57933140f70f83ffbab7a6dea3871

    SHA1

    4e999bd219022b3eb038f02238ebb9e92d54e3e3

    SHA256

    d0aa4649ceb61c473ad3457467edc5eae2cdf4eb72b41e8ede893681d1c7e0b1

    SHA512

    11d7d807aa85c8cb3b78584258b159664f33a775c992971f20dff412eb0bc0dc40538e72cd05f43d54d62a2da380d2286f865043217c46d1bf611692f4755a4f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f318bb20633685dd5c9a3aa0692b6ae

    SHA1

    92e4c1d1ae0b6eda98c757f2edcd5df663b6ef66

    SHA256

    4e5830bae62fc885aac64e24caa27db073bdc1449431c5da7421a7535e5ae080

    SHA512

    32b57a02953a4147a5791f4fbf16221261ad3af42d48d112ab5ccd3242917d854e26538846d63b346ceea100e9f455716293f7f561339874206e3a2e73d412a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    717b2724200b7a17f5d0b8e23a7e3909

    SHA1

    a04c205c295fb161aa424a2346ab304519b72e64

    SHA256

    ba2059fa0c9166ff2170a72ab5caabae231821654be5a373f68c583ac2c9d80e

    SHA512

    729dc083224fc35198d8fda5f12c635211440e4eb08d763527625d7e1040f0ef60e58c326568ae082dc6850d12fe05965b89dad359593a37db253ac6473fa8d4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    957a680745db4324f14c2ba242c653f4

    SHA1

    6c2d7907e7198cc976505ca7e57b39e86d118411

    SHA256

    ff4eaec76f88b620014a07e9fc0e3f7fc3852c2043b950d8952439935cc4bf52

    SHA512

    4d610e3cd36356ae95571e039a4bf917a51f92ebe8cbbd7f5a619fbda389b26a8b48c894774c5aea04b1c44ef6599a57ca353320a55304354404d244890c3d3f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    69f044f2857e268c5294f86acf580a33

    SHA1

    6bed4ff4017f8bc56336fddfecfbe95a968948ae

    SHA256

    3b32ac169f78d81b4e63504dccccd8c67f582d9018f9a9b1defbffaf87ddc54c

    SHA512

    4e8fcab33622465384cf36364ba67016df20764ad55819c8c2d7f970767470044cf5d43913f16c41e7f05d0e744545ef83f0157fa0b54a43d46ac04ad3ab36d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5e2c5145ab977d4475f953ab890b1e11

    SHA1

    2ce6a1d7315a72aa7d9ba03bf3fe9e963a8ee858

    SHA256

    cef8b2182579ed22bb7d359400527b9781df597dc2adb17148045d460b639ca2

    SHA512

    ea9065d5ab0f5cc055bb1be0d344fbfc48c1845ddb953cb44c3c653c2dfc0bc6fdb42783215f065843141ae59a6e5f802e56580e66acf96774deca83671a50b0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8405348522964885a88c0abadd6eeaef

    SHA1

    507c706afa59e4eab190559d5d17be171d0f1618

    SHA256

    76c2b817811a807da4255d4682ab2d0356ff99e858827db2ac00680440bb1935

    SHA512

    a2d50ee2b86afd51c010b13f81b6eb32ffa2e3ee537c1b2336dd9e2874fa1e00e5dc7716495b3ca2c3f6cb362752ef25571981b4e9f58de18ac9d9be1f748fb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbc181b4d7a1688e0604cb28464a0a26

    SHA1

    2acb083e0cb034bb870ecfd1a97e611fb5be56ac

    SHA256

    6abf3b7440d28b968e493e70ed8c500124e35126e94d2a8ebd1e4e0bed2ed2e1

    SHA512

    f28208a53ce6b81f33cc32bd7203cfc6c638ca5aa3bef300cf9be9853b944d8c8947a7f7552183de50259705a5749e7e75fc524a26aa8ceeff04fa6273b593c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9fda277bc708f710906049e6c98d2520

    SHA1

    b0bfee28ac3f46e65d2bca61272a450447290565

    SHA256

    1fdd4c5c12a31eab2ac79f8284b7dfdcdc4cfe6294335af13153ea9cc323c965

    SHA512

    7ce02ac16afce89c401b087e35cab40c2aa20e139629b5cc27c0e305a000c1861f729b6b4422b38a8866b15e0784c2d295bcb39dd455d865e6ac2922c614d30e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e89918a7d0dbb124c8a62d2492d1bd8d

    SHA1

    b8fc86bf61538ab88f879bf12680d8b238d4839e

    SHA256

    4a52157e4e83d54b4936aa7745e4b8bc73001512cd9c8c55d88e8cf253df371e

    SHA512

    d16406a4054ff911001d2bc9f8a0d93422f7fefde10e6be76655ae1ec02541f2fd8aad2f26079a3fc149c26103bf7bd91f6054ab0cf4bd97138b6ef2262a68d4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c36c99a81d9c550820d5389f7b9157ff

    SHA1

    49f73b66b9bb4c2df094dad7a83b954f65c6d6fe

    SHA256

    76a7205a05183f3a206d49aa1d4cb1fbd4cd748c338a20ea5859dba15348fa01

    SHA512

    854341a5e74cea4079a6648dd8d565199472ec6b58c141f2a74a682b9eb16e5ef1e2ec3ca5060ab7fbd30a57e7b072f2f79a5831940123a449d3cb9d3ff3e826

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fb11cbdc08069412f0322faf1b51e9e6

    SHA1

    da5fd12db1662c9611b0d32cac57ac13734c0655

    SHA256

    92f902fade41197b159265df9813413775c4125a1880faff344fcb3014a89c41

    SHA512

    7734b12a90075b0dadfc3ae0b1539fd0e3627f9ad341dabb430f49204c4f2c6315f937cb2de61692100372ba7cfb146945735d7898a92d3c6cec92b686a7959e

  • C:\Users\Admin\AppData\Local\Temp\CabED2E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\MSIC458.tmp

    Filesize

    204KB

    MD5

    ccc3bcc7dba16b96fb3b62f7b1c5164e

    SHA1

    465b35f14500e67b7a2b6ad01f07e740729fded8

    SHA256

    124c8472f359e036755e0a4d87487ee41ac26cf78e2cc4175f88a13797d76cf8

    SHA512

    cdefb9870354c2d315b1226170337fff0585482eee812a7d58f41396c91e4e5eb0ff169e237c2bab0de69c651749fdbd0166d73af6b2ae97fa60e12de8b5b0f6

  • C:\Users\Admin\AppData\Local\Temp\TarEDEF.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b