Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

setupqw.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    349s
  • max time network
    312s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/02/2025, 06:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setupqw.msi

  • Size

    2.0MB

  • MD5

    05b777e864c9f032329acadbc747309b

  • SHA1

    e01e81d6103c13ce3a9399bb964f348dcdcf84d0

  • SHA256

    dd212ed802189751acb803e758e231747bc0506fc0161db615b52e7579cf840d

  • SHA512

    63af0bf4e924a8278f707006658413fb312c2f89907fa3740ed7604551724c4bc4cd9e1d249d0f91379ff45bca0d52da4f6a61dd041810785f5a07f353e3c2de

  • SSDEEP

    24576:Qt9cpVDh66xxNptbriMDYXrbxkxJ8ChMM5+Cy9Md9ymINKeRhV1IoAl+:PpRhzJptbriMDYXP2L8CC79hNKAVyf

Score
10/10
metastealerdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

metastealer

C2

kagkimuoakomksww.xyz

cwikwiiisuyqymso.xyz

qgimwqowkmuicoos.xyz

kuueskmwqmwoocuq.xyz

eaeueussigokssqg.xyz

eoyqkgcyoesysssk.xyz

ocmmqamiyucswwik.xyz

eimemucysaammomg.xyz

iwomsoekyisuymws.xyz

mqykiccmwokeumes.xyz

iqqcgqqseysecuum.xyz

iqmoyikmqymsmcwm.xyz

aseuqoqgaueaymyo.xyz

wycuamkomemmigmy.xyz

ceiyeqaoscmsamim.xyz

skcqkaykccckqyam.xyz

kaycmqwocuyyuqyg.xyz

mqssyaeoeeucegqy.xyz

ywqamawcqumaqiyq.xyz

skscsegicyqikqww.xyz
Attributes
  • dga_seed

    12914

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer
  • MetaStealer payload 1 IoCs
  • Metastealer family
    metastealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setupqw.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4968
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2D2924FDC1322579963E73D1C81B26C7
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-09ee9299-aaa6-4f9e-8801-490895d7adee\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:1704
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1416
      • C:\Users\Admin\AppData\Local\Temp\MW-09ee9299-aaa6-4f9e-8801-490895d7adee\files\setupqw.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-09ee9299-aaa6-4f9e-8801-490895d7adee\files\setupqw.exe" /VERYSILENT /VERYSILENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\search.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3232
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:3436
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3168
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3184
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2760
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3604
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3064
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\msl.msi"
      1⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      PID:3020

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Event Triggered Execution

    1
    T1546

    Installer Packages

    1
    T1546.016

    Privilege Escalation

    Event Triggered Execution

    1
    T1546

    Installer Packages

    1
    T1546.016

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    System Binary Proxy Execution

    1
    T1218

    Msiexec

    1
    T1218.007

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    2
    T1012

    System Information Discovery

    3
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
      Filesize

      10KB

      MD5

      71a6b59e08e25451e52675c842fae23c

      SHA1

      565a97673954a9209c7a05fba20b89d10b88025f

      SHA256

      5b96212d3d1347b76c8c1c64b2f7ef981242bedd3b84b766b543d56dbbf8dbd6

      SHA512

      5cc98eb2aa02e2e69165170451d89dd880893e6b07440bb84fbab6cf92cb558bd58c2235d8d64ff43d380c5e9869827800d310ee67950bb21b498d89fbb5aab3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MW-09ee9299-aaa6-4f9e-8801-490895d7adee\files.cab
      Filesize

      1.7MB

      MD5

      108bb7a5e54c105fe6df5ba63a689e1a

      SHA1

      4ca182f85da68209d10fc49009894758b27d4b8a

      SHA256

      af4d3965b0ff14d63243f60edff43b80621e78ce6241caa54a4a3b99474dbd45

      SHA512

      a7f9bfe198431565a16524c33f22f1778e85371b78201aed8d76ff21832ac6be5ce466e7c984185e4cb51a9a03084d42a3bdaa476f09081ddff04262d8546f32

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MW-09ee9299-aaa6-4f9e-8801-490895d7adee\msiwrapper.ini
      Filesize

      1KB

      MD5

      4b4b00a8a82e7541a7a6d07abb272a6f

      SHA1

      720ef166a68ff39cfc13183e05960b1bf06180fc

      SHA256

      93e07420e0ad63671e59552a05a5ce8f248dad0457dd3bc40dbf7c65a5220d69

      SHA512

      496899d2d3719f113b7d6c8e9dd06dbd5e486af3063843079f2fb71786449ce03316bf1f6e085b442d721544291a13725c58b16dcc215e7585520a7c588f9bf2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MW-09ee9299-aaa6-4f9e-8801-490895d7adee\msiwrapper.ini
      Filesize

      1KB

      MD5

      1b117802152440478e8a3dde8838ff64

      SHA1

      5e58abdba8c71b7acde9c8e34b27d6b3622965e2

      SHA256

      48929bba3bb745982c97651f4bcfdf2c6c821013612664378228f0fb740c9738

      SHA512

      991ae5e68bd81b3ef9e3955902df42e2e2894e88fefd93312b4ccf2d59633fb2afd3b456afef490571341928972f50cba83df883ec2429b8bd71116cf31b18eb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_belpjavr.lpx.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Windows\Installer\MSIEE09.tmp
      Filesize

      208KB

      MD5

      0c8921bbcc37c6efd34faf44cf3b0cb5

      SHA1

      dcfa71246157edcd09eecaf9d4c5e360b24b3e49

      SHA256

      fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

      SHA512

      ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      24.6MB

      MD5

      129ad62231c946100948fb2607010022

      SHA1

      6e60956c87437ceb08fe68ce6b48b6086dc45134

      SHA256

      b656be255ee88a495b99cad5b03cbf057bebeabf1289d773761d781afc2a0574

      SHA512

      def918cf57b16a9ea76ed66f3bd9dc5be66744b2b7177b655120f9128ebbf8ed0a1e39b20cc6bc9dae0798c915ac6454b30b28e30a2878fabf0cb7f8a6272e48

      Download Submit

    • \??\Volume{3f575a23-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{28bebd6d-7b65-4fea-84a7-71f6f304a77a}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      0a22c95b806cd4cc010d9ede69dac827

      SHA1

      3ab95c0b53e810d240873fe4b27e970671312a88

      SHA256

      e47bb74dd0d903800aeaf873fbe658739f4a0efaa243f42fabbae75e3bb3014a

      SHA512

      734c5d145cc27102e9a89c1c68d732b593e943d28e76ecbc8a1a3a645f16867aa35aece4750aefc5a9177fbd522934901207ba25c4283ef3e2890e1d873987d9

      Download Submit

    • memory/3084-115-0x0000000010000000-0x0000000010738000-memory.dmp

      Filesize

      7.2MB

      Download

    • memory/3184-10-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-9-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-11-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-12-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-6-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-7-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-0-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-97-0x0000025F02420000-0x0000025F02430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3184-89-0x0000025F02390000-0x0000025F023A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3184-8-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-1-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-2-0x0000025F6D380000-0x0000025F6D381000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3232-121-0x00000000051B0000-0x00000000057DA000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/3232-123-0x0000000005850000-0x00000000058B6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3232-124-0x00000000058C0000-0x0000000005926000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3232-122-0x0000000004F40000-0x0000000004F62000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3232-134-0x00000000059F0000-0x0000000005D47000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/3232-135-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3232-136-0x0000000005E10000-0x0000000005E5C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3232-138-0x000000006F330000-0x000000006F37C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3232-137-0x0000000006D90000-0x0000000006DC4000-memory.dmp

      Filesize

      208KB

      Download

    • memory/3232-147-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3232-148-0x0000000006DF0000-0x0000000006E94000-memory.dmp

      Filesize

      656KB

      Download

    • memory/3232-150-0x0000000007120000-0x000000000713A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3232-149-0x0000000007770000-0x0000000007DEA000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/3232-151-0x0000000007190000-0x000000000719A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3232-152-0x00000000073C0000-0x0000000007456000-memory.dmp

      Filesize

      600KB

      Download

    • memory/3232-153-0x0000000007330000-0x0000000007341000-memory.dmp

      Filesize

      68KB

      Download

    • memory/3232-154-0x0000000007370000-0x000000000737E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/3232-155-0x0000000007380000-0x0000000007395000-memory.dmp

      Filesize

      84KB

      Download

    • memory/3232-156-0x0000000007480000-0x000000000749A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3232-157-0x0000000007460000-0x0000000007468000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3232-120-0x00000000025C0000-0x00000000025F6000-memory.dmp

      Filesize

      216KB

      Download