Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/12/2024, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47.msi
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47.msi
-
Size
1.9MB
-
MD5
74a757de4790c76a4d83d640901e5249
-
SHA1
d27c7ace0079aaf1fd39abbc0e161aa84aa399a9
-
SHA256
6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47
-
SHA512
db06f8f0082fb45c97e35b3d959e513dc9defc8ed2ef15f4a937dee92c2a762ef0802dfcadb6a8741964e517eb0190bf40adca08c64bc0f9a976cbca57a2ede4
-
SSDEEP
24576:Qt9cpVDh7lt0nSRDxmR+UJ2jUvshD3rcxCEiPzRqe:PpRh7FDxzUSDFr7EKz9
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2348 ICACLS.EXE 2936 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f775e75.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f775e75.msi msiexec.exe File created C:\Windows\Installer\f775e76.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5F6F.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\f775e76.ipi msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 112 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3044 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2764 msiexec.exe 2764 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 3044 msiexec.exe Token: SeIncreaseQuotaPrivilege 3044 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeSecurityPrivilege 2764 msiexec.exe Token: SeCreateTokenPrivilege 3044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3044 msiexec.exe Token: SeLockMemoryPrivilege 3044 msiexec.exe Token: SeIncreaseQuotaPrivilege 3044 msiexec.exe Token: SeMachineAccountPrivilege 3044 msiexec.exe Token: SeTcbPrivilege 3044 msiexec.exe Token: SeSecurityPrivilege 3044 msiexec.exe Token: SeTakeOwnershipPrivilege 3044 msiexec.exe Token: SeLoadDriverPrivilege 3044 msiexec.exe Token: SeSystemProfilePrivilege 3044 msiexec.exe Token: SeSystemtimePrivilege 3044 msiexec.exe Token: SeProfSingleProcessPrivilege 3044 msiexec.exe Token: SeIncBasePriorityPrivilege 3044 msiexec.exe Token: SeCreatePagefilePrivilege 3044 msiexec.exe Token: SeCreatePermanentPrivilege 3044 msiexec.exe Token: SeBackupPrivilege 3044 msiexec.exe Token: SeRestorePrivilege 3044 msiexec.exe Token: SeShutdownPrivilege 3044 msiexec.exe Token: SeDebugPrivilege 3044 msiexec.exe Token: SeAuditPrivilege 3044 msiexec.exe Token: SeSystemEnvironmentPrivilege 3044 msiexec.exe Token: SeChangeNotifyPrivilege 3044 msiexec.exe Token: SeRemoteShutdownPrivilege 3044 msiexec.exe Token: SeUndockPrivilege 3044 msiexec.exe Token: SeSyncAgentPrivilege 3044 msiexec.exe Token: SeEnableDelegationPrivilege 3044 msiexec.exe Token: SeManageVolumePrivilege 3044 msiexec.exe Token: SeImpersonatePrivilege 3044 msiexec.exe Token: SeCreateGlobalPrivilege 3044 msiexec.exe Token: SeBackupPrivilege 2684 vssvc.exe Token: SeRestorePrivilege 2684 vssvc.exe Token: SeAuditPrivilege 2684 vssvc.exe Token: SeBackupPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2952 DrvInst.exe Token: SeLoadDriverPrivilege 2952 DrvInst.exe Token: SeLoadDriverPrivilege 2952 DrvInst.exe Token: SeLoadDriverPrivilege 2952 DrvInst.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe Token: SeRestorePrivilege 2764 msiexec.exe Token: SeTakeOwnershipPrivilege 2764 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3044 msiexec.exe 3044 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 2764 wrote to memory of 112 2764 msiexec.exe 34 PID 112 wrote to memory of 2348 112 MsiExec.exe 35 PID 112 wrote to memory of 2348 112 MsiExec.exe 35 PID 112 wrote to memory of 2348 112 MsiExec.exe 35 PID 112 wrote to memory of 2348 112 MsiExec.exe 35 PID 112 wrote to memory of 2108 112 MsiExec.exe 37 PID 112 wrote to memory of 2108 112 MsiExec.exe 37 PID 112 wrote to memory of 2108 112 MsiExec.exe 37 PID 112 wrote to memory of 2108 112 MsiExec.exe 37 PID 112 wrote to memory of 2164 112 MsiExec.exe 39 PID 112 wrote to memory of 2164 112 MsiExec.exe 39 PID 112 wrote to memory of 2164 112 MsiExec.exe 39 PID 112 wrote to memory of 2164 112 MsiExec.exe 39 PID 112 wrote to memory of 1068 112 MsiExec.exe 41 PID 112 wrote to memory of 1068 112 MsiExec.exe 41 PID 112 wrote to memory of 1068 112 MsiExec.exe 41 PID 112 wrote to memory of 1068 112 MsiExec.exe 41 PID 112 wrote to memory of 2936 112 MsiExec.exe 43 PID 112 wrote to memory of 2936 112 MsiExec.exe 43 PID 112 wrote to memory of 2936 112 MsiExec.exe 43 PID 112 wrote to memory of 2936 112 MsiExec.exe 43 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DC813459F527AD23C0CEDE76273C5FC62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5a8d75f9-8b1e-4a49-803c-1e0c18b559dd\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2348
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2108
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf3⤵
- System Location Discovery: System Language Discovery
PID:2164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-5a8d75f9-8b1e-4a49-803c-1e0c18b559dd\files"3⤵
- System Location Discovery: System Language Discovery
PID:1068
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5a8d75f9-8b1e-4a49-803c-1e0c18b559dd\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2936
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004E0" "00000000000003F4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5d0ecbe8399a46101b4e9d90b891deeb8
SHA11bcd3c5af8ab80e427402c92665e39a993a85b9a
SHA256639f888682c0526229cabecac2da894fddf3a90e899f20d48aad28563b2cd3fb
SHA5126986e33f3b3be73803a32d481f0987c3906bfadfe38a6fddf2b0df626f74bf9618e964aec9d091ad38f4253b0c5d2a242c8f4840c81e27464f537fc13730619f
-
Filesize
380B
MD5f5ddce1455118e26f5fb7307e3e0f40d
SHA1a5c49065c63739e599e6530df86655d8150f4623
SHA2569ee1eb263044cfe9ccd89690fc2e5e9133ae9bec490674276f84a75579e6fc8a
SHA512f2e86fda47fef2fecc5d7a9f3c29766a29f8a61f716ecab5eafa19a85380bc74a815b2035e7998e36585daf70c66b7ed5e804a780f93fcf95d61a3365c3f93b6
-
Filesize
610B
MD52925799134b0c0d60c6d79bcb61cfa97
SHA1c2be2137920c87af6c973caf35cc6c86cee80d05
SHA2560c2a94ef7c3d49d78856cfb31898ee614d06fc448f56fc60fadfdf6c1c3b9e64
SHA512e58980d6fad0aff301ad1b5e81f1606e005bc9352b7c668540e51ebdc8078c415cdf68bd17fb878ba65744826bfd6a0327ddd3f5d76d928fa2c7460c7bc7e63f
-
Filesize
1KB
MD5189e0898ae4040703bd257f97b9ee046
SHA189468fe3a4991a89912cf2402335b15491b03ba2
SHA256f5ac7e4356caf5c69f93c449da84c106b77c3344f2a97dd2ddbce7d4ccb737ef
SHA512b3b28d46e1d1eb97719faf94c88a0b5437edd5740db139bb086be2b8d72acfae8db6e0008853f45690604f9b463609f4cd9bfbdedf1301ebeded76d3411a72e6
-
Filesize
1KB
MD52a472835879449a0b09a2be227e7cd46
SHA172f8eca2a8e25a08e36042473391fddce48cf52e
SHA2565f5b0c9e448104117f83123e9ac01a2998c23a14a563cdc444e9f5988417d63e
SHA51205592ae283a2e93192c42da944799ae0e724c5750e229a6147f49b543597fb25e1bb419b857b754fbc8cda77d32ac491976a719eda9302d360730ea372f90f6e
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108