Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/09/2024, 20:16
240930-y2bt7axdme 830/09/2024, 20:14
240930-yzywyaxdje 830/09/2024, 20:06
240930-yvhzxsshmn 6Analysis
-
max time kernel
88s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
UpdateTool.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
UpdateTool.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
UpdateTool.msi
-
Size
173.6MB
-
MD5
90c290ef28ab6f163a446969090f2daf
-
SHA1
c98b1d586dbb4be7781799a5f414292f11b8326d
-
SHA256
667c036ba1c67b0e6377a23deca78f35220ff15ec278e34fffa521f779b1ddb4
-
SHA512
5615cf7e26f9f762e3853b49b42a327dffdb9f601178bb7d743ab362277d0c850fcbbf40b7c759d7a41f9436dc7e16138a91729fb7ec13d199bffc05b0bb660d
-
SSDEEP
3145728:QP7AKGpPJJgLBZV7MVRy7mURaD8RhDFoqoCPO5R3CvKCNaInqqD7vZbUD02ilsjr:mAKgPLgLBZVR3RBlatCPO2H/5b2iqjr
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 6 3964 msiexec.exe 9 3964 msiexec.exe 13 3964 msiexec.exe 16 3964 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA28C.tmp msiexec.exe File created C:\Windows\Installer\e579ccc.msi msiexec.exe File opened for modification C:\Windows\Installer\e579ccc.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA0A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA1DE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA25C.tmp msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 1108 MsiExec.exe 1108 MsiExec.exe 1108 MsiExec.exe 1108 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3964 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 3964 msiexec.exe Token: SeIncreaseQuotaPrivilege 3964 msiexec.exe Token: SeSecurityPrivilege 3020 msiexec.exe Token: SeCreateTokenPrivilege 3964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3964 msiexec.exe Token: SeLockMemoryPrivilege 3964 msiexec.exe Token: SeIncreaseQuotaPrivilege 3964 msiexec.exe Token: SeMachineAccountPrivilege 3964 msiexec.exe Token: SeTcbPrivilege 3964 msiexec.exe Token: SeSecurityPrivilege 3964 msiexec.exe Token: SeTakeOwnershipPrivilege 3964 msiexec.exe Token: SeLoadDriverPrivilege 3964 msiexec.exe Token: SeSystemProfilePrivilege 3964 msiexec.exe Token: SeSystemtimePrivilege 3964 msiexec.exe Token: SeProfSingleProcessPrivilege 3964 msiexec.exe Token: SeIncBasePriorityPrivilege 3964 msiexec.exe Token: SeCreatePagefilePrivilege 3964 msiexec.exe Token: SeCreatePermanentPrivilege 3964 msiexec.exe Token: SeBackupPrivilege 3964 msiexec.exe Token: SeRestorePrivilege 3964 msiexec.exe Token: SeShutdownPrivilege 3964 msiexec.exe Token: SeDebugPrivilege 3964 msiexec.exe Token: SeAuditPrivilege 3964 msiexec.exe Token: SeSystemEnvironmentPrivilege 3964 msiexec.exe Token: SeChangeNotifyPrivilege 3964 msiexec.exe Token: SeRemoteShutdownPrivilege 3964 msiexec.exe Token: SeUndockPrivilege 3964 msiexec.exe Token: SeSyncAgentPrivilege 3964 msiexec.exe Token: SeEnableDelegationPrivilege 3964 msiexec.exe Token: SeManageVolumePrivilege 3964 msiexec.exe Token: SeImpersonatePrivilege 3964 msiexec.exe Token: SeCreateGlobalPrivilege 3964 msiexec.exe Token: SeRestorePrivilege 3020 msiexec.exe Token: SeTakeOwnershipPrivilege 3020 msiexec.exe Token: SeRestorePrivilege 3020 msiexec.exe Token: SeTakeOwnershipPrivilege 3020 msiexec.exe Token: SeRestorePrivilege 3020 msiexec.exe Token: SeTakeOwnershipPrivilege 3020 msiexec.exe Token: SeRestorePrivilege 3020 msiexec.exe Token: SeTakeOwnershipPrivilege 3020 msiexec.exe Token: SeRestorePrivilege 3020 msiexec.exe Token: SeTakeOwnershipPrivilege 3020 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3964 msiexec.exe 3964 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1108 3020 msiexec.exe 84 PID 3020 wrote to memory of 1108 3020 msiexec.exe 84 PID 3020 wrote to memory of 1108 3020 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UpdateTool.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3964
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9D4165D6ABE0D3DE320F64A46CE7966D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_3EA7DE19EE0C309EB676B7E60E82F717
Filesize727B
MD5e5b34a1d4fb702a002aadc2ba0a2c550
SHA1dc66efde97577f57c4d0637126699a8fbc5d1fdb
SHA2564e4e8de8822628ad8a1a124e0787540107599e74c772139127fcc7a77f1dc46c
SHA512729bc09347d0bfebc86865cd0156ca643f7d8ff0a9501fe851d25c43af80ec1f14047e9a43e11dbf8f7613cd99291c1bae6a64f148585290be8375566931b9f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Filesize727B
MD57e5e9912de7a985ff6257b5e3005de2c
SHA13d5557f4d0ce85b5d42ae97579b154c53648c418
SHA256ec0bdea0fcc54be0a302cac5a2513186ccd5a9e1bd9de7c8dd81ce1773141571
SHA512a2a8e2118dcbbeeb1c208fc34ac67d78ba85bddeffe3cc81668ce2b90d8cb992b2be881ed9db2c9847cebc597558060d2cec50337cef115bc2a07773076a6e4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_3EA7DE19EE0C309EB676B7E60E82F717
Filesize478B
MD51bc8b45fede588166f6064a6994433c5
SHA1a662ed0eaadc13975127fbf84bb372b3914b5a89
SHA256a24dff64b3e45612ea7ebdc19b798ecdffba27beba78ca25045150ecbc2b8bb6
SHA512d3501d00c0015a5722851cbe209da2fa865c2336524363f8beaee744e0b04eb2188df5562ace113d00e3f41b019d5ebac7bdbb7ec4920e40a93da8a632db7e0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Filesize478B
MD5589368f8d6f497d0f761351d661a6c73
SHA11a5c47d0b8f6a1aedc119bac2943a4bffbe0be1a
SHA256a2c35da846cf22412c25e9306eae095de653a23a6d5a25cbb8b88963c8a5d35e
SHA512ba81389f15a5956bdd73f92cddc785e509757cc93ca0e1701b00dd9d8c4e6c6a8e5a3ca48d106c78ab9b3bd383be775501a5e786fb1459286525ed0b456516d4
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
945KB
MD575fdd4bafba5d7082126be37eef2598a
SHA173cb2823016ecb1ce287da67e135e02c13c556c6
SHA2564ecd8241776a95987927cc7cc4854f2d1b4ce3e0631aed33c7639e931921ba15
SHA51200bd76d4bb9ac5cb5ded051d37e8df5e4a9c6209e747b2b399f7744d833fad0e957fd4fa897db02bc3ea9ae1da8d25e29623ef19c968c7791481e51fd6a7f891