Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2024, 01:23

General

  • Target

    babb74a30ceeab2e98e75f70957d27a70f9079ba8b903f18db9074d437b5c4d2.msi

  • Size

    1.9MB

  • MD5

    79e7bd0f6f85c4fadafe9b82f0b0d41a

  • SHA1

    c46736c9024aed2f0e5205ef17e278789ba3d77c

  • SHA256

    babb74a30ceeab2e98e75f70957d27a70f9079ba8b903f18db9074d437b5c4d2

  • SHA512

    6c4884a3291723f51f4920983e1a454340dfabc262f49f061f5f6c4e05a4a44d253d1a26e3ff35ede6385c6f3df7a500b1681f094a9b7dd71af7c30ca6cc3b83

  • SSDEEP

    49152:KZEWXCT4dSLlYJqI6hnPw48VW+2qHkTFbyONmHuExZMvIU:K6WXCTuGXFYY+2qGwl

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\babb74a30ceeab2e98e75f70957d27a70f9079ba8b903f18db9074d437b5c4d2.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1204
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 71A88C4DC157DCC4B7D9F54E43427486
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI9627.tmp

    Filesize

    1.9MB

    MD5

    d141e531f847cf4d0ab6745095b150da

    SHA1

    d826d443930d093a6d17979fb916b567ef316243

    SHA256

    d5479710988c54042cb0286f9bcc5a350c753a55640c52c61dcad6163b485fc0

    SHA512

    2b774044ab965aa049b1453da9001bb10ece560dc0f9246b66c30409949b7ca1d33542a68abcaadc692ae27be47f7817d079c22df03626214247193bf784d7aa