Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd.msi
-
Size
54.5MB
-
MD5
2d6151dbbbb50c077564ef7ffc971a4e
-
SHA1
b67ec6dd683f5f8b12d52aa79aeee9a498380589
-
SHA256
2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd
-
SHA512
22a30787cf820da489ed59b8f6401b1282b923a66f796211c2300f1864f4f10bee01d24133bfcb35975695f32273796cacdef03d726345c7a12cfb8ce6509979
-
SSDEEP
1572864:0p+Ty2SfWnHDk8FjVbfzPTq4h+RZYoFczfDiQPU8azMCAJ:h/0WnHDkkjBPTq4kYoFefTPU8awCm
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2372 MsiExec.exe 7 2372 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\f76c7d1.msi msiexec.exe File opened for modification C:\Windows\Installer\f76c7d1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE2E5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE324.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE373.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC96A.tmp msiexec.exe File created C:\Windows\Installer\f76c7d6.msi msiexec.exe File opened for modification C:\Windows\Installer\f76c7d4.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF794.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC91B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICA07.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF2C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC81F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE3B3.tmp msiexec.exe File created C:\Windows\Installer\f76c7d4.ipi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2004 UnRAR.exe 320 NVIDIA GeForce Experience.exe -
Loads dropped DLL 14 IoCs
pid Process 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2372 MsiExec.exe 2268 msiexec.exe 2372 MsiExec.exe 2268 msiexec.exe 2268 msiexec.exe 320 NVIDIA GeForce Experience.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2148 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2268 msiexec.exe 2268 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2148 msiexec.exe Token: SeIncreaseQuotaPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeCreateTokenPrivilege 2148 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2148 msiexec.exe Token: SeLockMemoryPrivilege 2148 msiexec.exe Token: SeIncreaseQuotaPrivilege 2148 msiexec.exe Token: SeMachineAccountPrivilege 2148 msiexec.exe Token: SeTcbPrivilege 2148 msiexec.exe Token: SeSecurityPrivilege 2148 msiexec.exe Token: SeTakeOwnershipPrivilege 2148 msiexec.exe Token: SeLoadDriverPrivilege 2148 msiexec.exe Token: SeSystemProfilePrivilege 2148 msiexec.exe Token: SeSystemtimePrivilege 2148 msiexec.exe Token: SeProfSingleProcessPrivilege 2148 msiexec.exe Token: SeIncBasePriorityPrivilege 2148 msiexec.exe Token: SeCreatePagefilePrivilege 2148 msiexec.exe Token: SeCreatePermanentPrivilege 2148 msiexec.exe Token: SeBackupPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeShutdownPrivilege 2148 msiexec.exe Token: SeDebugPrivilege 2148 msiexec.exe Token: SeAuditPrivilege 2148 msiexec.exe Token: SeSystemEnvironmentPrivilege 2148 msiexec.exe Token: SeChangeNotifyPrivilege 2148 msiexec.exe Token: SeRemoteShutdownPrivilege 2148 msiexec.exe Token: SeUndockPrivilege 2148 msiexec.exe Token: SeSyncAgentPrivilege 2148 msiexec.exe Token: SeEnableDelegationPrivilege 2148 msiexec.exe Token: SeManageVolumePrivilege 2148 msiexec.exe Token: SeImpersonatePrivilege 2148 msiexec.exe Token: SeCreateGlobalPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2148 msiexec.exe 2148 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2372 2268 msiexec.exe 31 PID 2268 wrote to memory of 2004 2268 msiexec.exe 34 PID 2268 wrote to memory of 2004 2268 msiexec.exe 34 PID 2268 wrote to memory of 2004 2268 msiexec.exe 34 PID 2268 wrote to memory of 320 2268 msiexec.exe 36 PID 2268 wrote to memory of 320 2268 msiexec.exe 36 PID 2268 wrote to memory of 320 2268 msiexec.exe 36
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2148
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADC0A7C474E9C1C7053385A33191B11B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2372
-
-
C:\Users\Admin\AppData\Roaming\Haye Cosq\NoqotApp\UnRAR.exe"C:\Users\Admin\AppData\Roaming\Haye Cosq\NoqotApp\UnRAR.exe" x -p2161183588a "C:\Users\Admin\AppData\Roaming\Haye Cosq\NoqotApp\guirq.rar" "C:\Users\Admin\AppData\Roaming\Haye Cosq\NoqotApp\"2⤵
- Executes dropped EXE
PID:2004
-
-
C:\Users\Admin\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe"C:\Users\Admin\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
338KB
MD55398629627b8d8ed09c751d9ee2c1a16
SHA1b0ce9e13c25a4af3c88766c1252c1bf63e5e9de4
SHA256aff12095fc565a160ffd82a6688ab0edd4501868c06063b75dd489e61996a025
SHA51228353383c1b6e34daffdedcebdc806636e2d5ae64e8a0e9851a6dfac6c5957534cc36eac0e853995ba954375f84c5be4f33c96f88a70ae8d30d55571f820386c
-
Filesize
310KB
MD587daf01078a7a7aca146db8de935b97e
SHA16aa0e88ef8d274f08409c63d5e2fe885e1c45d62
SHA256d8387af9263f8427b2eaaef4a20d2c2951316caf69dbddd59df0eabe9e8901d2
SHA512361f9533007097279fb2e37138d2cea7daf5ac013d6d1c8a52bf6cbb96874441df0cee14ba989526aeec385fb1435d551f65704fbd7d56f9159be17507899418
-
Filesize
889KB
MD5603063caa087b2baf3be97713f498fb3
SHA149d2f2c8f8454272c2f2f2ef8f0238426bc9dfc3
SHA25675261f095b5a37374addd8287179bc0a708d3835ddaa571756dfc8f10bf45e95
SHA512c5bc473f53654e2d80800eb6efad54653aa2de06fb97d5a6fae091c1cb3308ffd4aff36f7cee0ce5126af8516d5455fd2d615a256d919330b832029fbd79e561
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
870KB
MD56119e62d8047032a715ba0670fc476c5
SHA152e639024460bf111c469e95fb011c07d6fc89e8
SHA256bc31f85266df2cdfdbe22149937105388fa3adc17e3646fa4a167736e819af77
SHA512e7301fa21f01f7f7562b853e9bb246ed051951e3cef152bb0b3558d4863f141edbbc0c4d439c30f51f9997805490f131a5e4cd00872b61ccb08ba9d200f811d8
-
Filesize
1.1MB
MD51a2b237796742c26b11a008d0b175e29
SHA1cfd5affcfb3b6fd407e58dfc7187fad4f186ea18
SHA25681e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730
SHA5123135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5
-
Filesize
314KB
MD561123cbc153cb7f178ddbb318a7ea000
SHA10cfb1faa4c166d2a335ee62b05dd62b730ded9d6
SHA256e5e0183dfd9f65406042762c0427bbcff010402b9934dadd2bddbb6c382d625c
SHA5123249f814c9e4c472b5962ab159729bb44e28314e2e402abf4b5ec6789cb729192b662c948d362fa71f4284038544e4fdbb8f6d55b6ec0fb92c4de04840a15926
-
Filesize
364KB
MD554d74546c6afe67b3d118c3c477c159a
SHA1957f08beb7e27e657cd83d8ee50388b887935fae
SHA256f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611
SHA512d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f
-
Filesize
3.2MB
MD5bbe60e23dd94fbb56e878eacb5f1a44c
SHA1b08f8b87efc450368816c769c8c1c54ff6da53b9
SHA25665da40ab4ef47a5b513c268f15ac9b2dfef203f87394a1ded33b1ebe1c474669
SHA5122faaca8a4676143ae628ae64c75b8b99dbf82380eb2a82efc560aa5a58c999ace46fa82f144e214322aaa7e57e8ae3bae5acab903e91c1071279c6ca7370b75e
-
Filesize
494KB
MD598ccd44353f7bc5bad1bc6ba9ae0cd68
SHA176a4e5bf8d298800c886d29f85ee629e7726052d
SHA256e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b
SHA512d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f
-
Filesize
449KB
MD5846cce051e8e1eecbf7af5fbb6d254a7
SHA1cdf4675fd842ffddc2564a9139b7a9a6e0bc75e5
SHA256def3eba3d76a81da41dffe07b2359d420d83d535b39b71755cf622dfae82fe3f
SHA512e5f150696e75c5c41ee874d38f9ef1dee3417ac70844731e61442a0601c8f6bb0bb212a342fea81dafa9ad64deb4352afe72240d6dc7c4840b83246a5a5245b2