Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
Chorme_installer_v56.58.03.msi
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Chorme_installer_v56.58.03.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
Chorme_installer_v56.58.03.msi
-
Size
37.2MB
-
MD5
2e859514e7c8e73b276d5f0cbe5a7cca
-
SHA1
2d46ba837702a6f11bed1a6298b7fd443feb8c63
-
SHA256
9c9aca6b60e90876f4c2727ecfb5ec5021586f830dee3da064f9d99605410d15
-
SHA512
5a00b43861009cf82708167b263965cad7a327bbcb2bd01c3c1bcc1e6793ef75aa5fe8035a54e9f502cac5b7aa3a92b251d53481eff15b04870a3d07aa27d257
-
SSDEEP
786432:Pib1xBH1OwK5d+coZlrR0GiuskPuJJNJUON8y+cv+1dnnZZ8bbiqbBP0:Kb1X1O/d+co3ODJNJV8fcva9nZZmi6
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Loads dropped DLL 5 IoCs
pid Process 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1620 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1620 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1620 msiexec.exe Token: SeIncreaseQuotaPrivilege 1620 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeSecurityPrivilege 1144 msiexec.exe Token: SeCreateTokenPrivilege 1620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1620 msiexec.exe Token: SeLockMemoryPrivilege 1620 msiexec.exe Token: SeIncreaseQuotaPrivilege 1620 msiexec.exe Token: SeMachineAccountPrivilege 1620 msiexec.exe Token: SeTcbPrivilege 1620 msiexec.exe Token: SeSecurityPrivilege 1620 msiexec.exe Token: SeTakeOwnershipPrivilege 1620 msiexec.exe Token: SeLoadDriverPrivilege 1620 msiexec.exe Token: SeSystemProfilePrivilege 1620 msiexec.exe Token: SeSystemtimePrivilege 1620 msiexec.exe Token: SeProfSingleProcessPrivilege 1620 msiexec.exe Token: SeIncBasePriorityPrivilege 1620 msiexec.exe Token: SeCreatePagefilePrivilege 1620 msiexec.exe Token: SeCreatePermanentPrivilege 1620 msiexec.exe Token: SeBackupPrivilege 1620 msiexec.exe Token: SeRestorePrivilege 1620 msiexec.exe Token: SeShutdownPrivilege 1620 msiexec.exe Token: SeDebugPrivilege 1620 msiexec.exe Token: SeAuditPrivilege 1620 msiexec.exe Token: SeSystemEnvironmentPrivilege 1620 msiexec.exe Token: SeChangeNotifyPrivilege 1620 msiexec.exe Token: SeRemoteShutdownPrivilege 1620 msiexec.exe Token: SeUndockPrivilege 1620 msiexec.exe Token: SeSyncAgentPrivilege 1620 msiexec.exe Token: SeEnableDelegationPrivilege 1620 msiexec.exe Token: SeManageVolumePrivilege 1620 msiexec.exe Token: SeImpersonatePrivilege 1620 msiexec.exe Token: SeCreateGlobalPrivilege 1620 msiexec.exe Token: SeCreateTokenPrivilege 1620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1620 msiexec.exe Token: SeLockMemoryPrivilege 1620 msiexec.exe Token: SeIncreaseQuotaPrivilege 1620 msiexec.exe Token: SeMachineAccountPrivilege 1620 msiexec.exe Token: SeTcbPrivilege 1620 msiexec.exe Token: SeSecurityPrivilege 1620 msiexec.exe Token: SeTakeOwnershipPrivilege 1620 msiexec.exe Token: SeLoadDriverPrivilege 1620 msiexec.exe Token: SeSystemProfilePrivilege 1620 msiexec.exe Token: SeSystemtimePrivilege 1620 msiexec.exe Token: SeProfSingleProcessPrivilege 1620 msiexec.exe Token: SeIncBasePriorityPrivilege 1620 msiexec.exe Token: SeCreatePagefilePrivilege 1620 msiexec.exe Token: SeCreatePermanentPrivilege 1620 msiexec.exe Token: SeBackupPrivilege 1620 msiexec.exe Token: SeRestorePrivilege 1620 msiexec.exe Token: SeShutdownPrivilege 1620 msiexec.exe Token: SeDebugPrivilege 1620 msiexec.exe Token: SeAuditPrivilege 1620 msiexec.exe Token: SeSystemEnvironmentPrivilege 1620 msiexec.exe Token: SeChangeNotifyPrivilege 1620 msiexec.exe Token: SeRemoteShutdownPrivilege 1620 msiexec.exe Token: SeUndockPrivilege 1620 msiexec.exe Token: SeSyncAgentPrivilege 1620 msiexec.exe Token: SeEnableDelegationPrivilege 1620 msiexec.exe Token: SeManageVolumePrivilege 1620 msiexec.exe Token: SeImpersonatePrivilege 1620 msiexec.exe Token: SeCreateGlobalPrivilege 1620 msiexec.exe Token: SeCreateTokenPrivilege 1620 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1620 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1144 wrote to memory of 2720 1144 msiexec.exe 31 PID 1144 wrote to memory of 2720 1144 msiexec.exe 31 PID 1144 wrote to memory of 2720 1144 msiexec.exe 31 PID 1144 wrote to memory of 2720 1144 msiexec.exe 31 PID 1144 wrote to memory of 2720 1144 msiexec.exe 31 PID 1144 wrote to memory of 2720 1144 msiexec.exe 31 PID 1144 wrote to memory of 2720 1144 msiexec.exe 31
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Chorme_installer_v56.58.03.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1620
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F32485DCD48629A485DEDC5731C24E8C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9