Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
57ff67.msi
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
57ff67.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
57ff67.msi
-
Size
1.9MB
-
MD5
74a757de4790c76a4d83d640901e5249
-
SHA1
d27c7ace0079aaf1fd39abbc0e161aa84aa399a9
-
SHA256
6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47
-
SHA512
db06f8f0082fb45c97e35b3d959e513dc9defc8ed2ef15f4a937dee92c2a762ef0802dfcadb6a8741964e517eb0190bf40adca08c64bc0f9a976cbca57a2ede4
-
SSDEEP
24576:Qt9cpVDh7lt0nSRDxmR+UJ2jUvshD3rcxCEiPzRqe:PpRh7FDxzUSDFr7EKz9
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 1988 ICACLS.EXE 408 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f77147a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1610.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\f77147b.ipi msiexec.exe File created C:\Windows\Installer\f77147b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f77147a.msi msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 876 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2328 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1748 msiexec.exe 1748 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2328 msiexec.exe Token: SeIncreaseQuotaPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe Token: SeSecurityPrivilege 1748 msiexec.exe Token: SeCreateTokenPrivilege 2328 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2328 msiexec.exe Token: SeLockMemoryPrivilege 2328 msiexec.exe Token: SeIncreaseQuotaPrivilege 2328 msiexec.exe Token: SeMachineAccountPrivilege 2328 msiexec.exe Token: SeTcbPrivilege 2328 msiexec.exe Token: SeSecurityPrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeLoadDriverPrivilege 2328 msiexec.exe Token: SeSystemProfilePrivilege 2328 msiexec.exe Token: SeSystemtimePrivilege 2328 msiexec.exe Token: SeProfSingleProcessPrivilege 2328 msiexec.exe Token: SeIncBasePriorityPrivilege 2328 msiexec.exe Token: SeCreatePagefilePrivilege 2328 msiexec.exe Token: SeCreatePermanentPrivilege 2328 msiexec.exe Token: SeBackupPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeShutdownPrivilege 2328 msiexec.exe Token: SeDebugPrivilege 2328 msiexec.exe Token: SeAuditPrivilege 2328 msiexec.exe Token: SeSystemEnvironmentPrivilege 2328 msiexec.exe Token: SeChangeNotifyPrivilege 2328 msiexec.exe Token: SeRemoteShutdownPrivilege 2328 msiexec.exe Token: SeUndockPrivilege 2328 msiexec.exe Token: SeSyncAgentPrivilege 2328 msiexec.exe Token: SeEnableDelegationPrivilege 2328 msiexec.exe Token: SeManageVolumePrivilege 2328 msiexec.exe Token: SeImpersonatePrivilege 2328 msiexec.exe Token: SeCreateGlobalPrivilege 2328 msiexec.exe Token: SeBackupPrivilege 2956 vssvc.exe Token: SeRestorePrivilege 2956 vssvc.exe Token: SeAuditPrivilege 2956 vssvc.exe Token: SeBackupPrivilege 1748 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeLoadDriverPrivilege 2952 DrvInst.exe Token: SeLoadDriverPrivilege 2952 DrvInst.exe Token: SeLoadDriverPrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2328 msiexec.exe 2328 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 1748 wrote to memory of 876 1748 msiexec.exe 35 PID 876 wrote to memory of 1988 876 MsiExec.exe 36 PID 876 wrote to memory of 1988 876 MsiExec.exe 36 PID 876 wrote to memory of 1988 876 MsiExec.exe 36 PID 876 wrote to memory of 1988 876 MsiExec.exe 36 PID 876 wrote to memory of 860 876 MsiExec.exe 38 PID 876 wrote to memory of 860 876 MsiExec.exe 38 PID 876 wrote to memory of 860 876 MsiExec.exe 38 PID 876 wrote to memory of 860 876 MsiExec.exe 38 PID 876 wrote to memory of 2500 876 MsiExec.exe 40 PID 876 wrote to memory of 2500 876 MsiExec.exe 40 PID 876 wrote to memory of 2500 876 MsiExec.exe 40 PID 876 wrote to memory of 2500 876 MsiExec.exe 40 PID 876 wrote to memory of 2536 876 MsiExec.exe 42 PID 876 wrote to memory of 2536 876 MsiExec.exe 42 PID 876 wrote to memory of 2536 876 MsiExec.exe 42 PID 876 wrote to memory of 2536 876 MsiExec.exe 42 PID 876 wrote to memory of 408 876 MsiExec.exe 44 PID 876 wrote to memory of 408 876 MsiExec.exe 44 PID 876 wrote to memory of 408 876 MsiExec.exe 44 PID 876 wrote to memory of 408 876 MsiExec.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\57ff67.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2328
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15D056002E22474D7D033CB663DBDF592⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-728a4ade-f9bc-484a-8b0f-664a96c1e652\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1988
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf3⤵
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-728a4ade-f9bc-484a-8b0f-664a96c1e652\files"3⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-728a4ade-f9bc-484a-8b0f-664a96c1e652\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:408
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000498" "0000000000000598"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5d0ecbe8399a46101b4e9d90b891deeb8
SHA11bcd3c5af8ab80e427402c92665e39a993a85b9a
SHA256639f888682c0526229cabecac2da894fddf3a90e899f20d48aad28563b2cd3fb
SHA5126986e33f3b3be73803a32d481f0987c3906bfadfe38a6fddf2b0df626f74bf9618e964aec9d091ad38f4253b0c5d2a242c8f4840c81e27464f537fc13730619f
-
Filesize
1KB
MD5f5bedf3eefa890c5738fdb5a4af2454c
SHA13db6cdcffa79c4b978ab64f4b4a1a3749f0097cd
SHA25669680697798506a84bb9261a58b023e409f7fa02b758fd51e98a9e5a2a6db298
SHA512bdae79dd62a2d442baf6b714819b950f3e0f7a5c588bfc17b1352e1058db5d94e79660e1968640bfcd78b282ac1868e245964a1ceabc25781fcf800a2e0f53ab
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108