Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
29-05-2020 19:59
Static task
static1
Behavioral task
behavioral1
Sample
mRemoteNG-Installer-1.77.1.27654.msi
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
mRemoteNG-Installer-1.77.1.27654.msi
-
Size
41.9MB
-
MD5
96fdcc54ed76dd471e319f9fc065efc1
-
SHA1
df4dc518681e08ff7a845502279141857dc76e53
-
SHA256
dfb42f65ae6654e316a9e069a7cfca759434cd3e450a76714162507d95200332
-
SHA512
496693707cbdfd929ae0767881c52076bff06d46b24f999014081109d57d464533ec32eb23df25bbb6c8414a3d93ff645e6cc06a8c67eef3433a8144b5c7110f
Malware Config
Signatures
-
Blacklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 2 2916 msiexec.exe 4 2916 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid process target process PID 636 wrote to memory of 1080 636 msiexec.exe MsiExec.exe PID 636 wrote to memory of 1080 636 msiexec.exe MsiExec.exe PID 636 wrote to memory of 1080 636 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1340 1080 MsiExec.exe rundll32.exe PID 1080 wrote to memory of 1340 1080 MsiExec.exe rundll32.exe PID 1080 wrote to memory of 1340 1080 MsiExec.exe rundll32.exe -
Enumerates connected drives 3 TTPs
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1708 1340 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe -
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c06200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c5300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2916 msiexec.exe 2916 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 93 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2916 msiexec.exe Token: SeIncreaseQuotaPrivilege 2916 msiexec.exe Token: SeSecurityPrivilege 636 msiexec.exe Token: SeCreateTokenPrivilege 2916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2916 msiexec.exe Token: SeLockMemoryPrivilege 2916 msiexec.exe Token: SeIncreaseQuotaPrivilege 2916 msiexec.exe Token: SeMachineAccountPrivilege 2916 msiexec.exe Token: SeTcbPrivilege 2916 msiexec.exe Token: SeSecurityPrivilege 2916 msiexec.exe Token: SeTakeOwnershipPrivilege 2916 msiexec.exe Token: SeLoadDriverPrivilege 2916 msiexec.exe Token: SeSystemProfilePrivilege 2916 msiexec.exe Token: SeSystemtimePrivilege 2916 msiexec.exe Token: SeProfSingleProcessPrivilege 2916 msiexec.exe Token: SeIncBasePriorityPrivilege 2916 msiexec.exe Token: SeCreatePagefilePrivilege 2916 msiexec.exe Token: SeCreatePermanentPrivilege 2916 msiexec.exe Token: SeBackupPrivilege 2916 msiexec.exe Token: SeRestorePrivilege 2916 msiexec.exe Token: SeShutdownPrivilege 2916 msiexec.exe Token: SeDebugPrivilege 2916 msiexec.exe Token: SeAuditPrivilege 2916 msiexec.exe Token: SeSystemEnvironmentPrivilege 2916 msiexec.exe Token: SeChangeNotifyPrivilege 2916 msiexec.exe Token: SeRemoteShutdownPrivilege 2916 msiexec.exe Token: SeUndockPrivilege 2916 msiexec.exe Token: SeSyncAgentPrivilege 2916 msiexec.exe Token: SeEnableDelegationPrivilege 2916 msiexec.exe Token: SeManageVolumePrivilege 2916 msiexec.exe Token: SeImpersonatePrivilege 2916 msiexec.exe Token: SeCreateGlobalPrivilege 2916 msiexec.exe Token: SeCreateTokenPrivilege 2916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2916 msiexec.exe Token: SeLockMemoryPrivilege 2916 msiexec.exe Token: SeIncreaseQuotaPrivilege 2916 msiexec.exe Token: SeMachineAccountPrivilege 2916 msiexec.exe Token: SeTcbPrivilege 2916 msiexec.exe Token: SeSecurityPrivilege 2916 msiexec.exe Token: SeTakeOwnershipPrivilege 2916 msiexec.exe Token: SeLoadDriverPrivilege 2916 msiexec.exe Token: SeSystemProfilePrivilege 2916 msiexec.exe Token: SeSystemtimePrivilege 2916 msiexec.exe Token: SeProfSingleProcessPrivilege 2916 msiexec.exe Token: SeIncBasePriorityPrivilege 2916 msiexec.exe Token: SeCreatePagefilePrivilege 2916 msiexec.exe Token: SeCreatePermanentPrivilege 2916 msiexec.exe Token: SeBackupPrivilege 2916 msiexec.exe Token: SeRestorePrivilege 2916 msiexec.exe Token: SeShutdownPrivilege 2916 msiexec.exe Token: SeDebugPrivilege 2916 msiexec.exe Token: SeAuditPrivilege 2916 msiexec.exe Token: SeSystemEnvironmentPrivilege 2916 msiexec.exe Token: SeChangeNotifyPrivilege 2916 msiexec.exe Token: SeRemoteShutdownPrivilege 2916 msiexec.exe Token: SeUndockPrivilege 2916 msiexec.exe Token: SeSyncAgentPrivilege 2916 msiexec.exe Token: SeEnableDelegationPrivilege 2916 msiexec.exe Token: SeManageVolumePrivilege 2916 msiexec.exe Token: SeImpersonatePrivilege 2916 msiexec.exe Token: SeCreateGlobalPrivilege 2916 msiexec.exe Token: SeCreateTokenPrivilege 2916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2916 msiexec.exe Token: SeLockMemoryPrivilege 2916 msiexec.exe -
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exerundll32.exepid process 1080 MsiExec.exe 1340 rundll32.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\mRemoteNG-Installer-1.77.1.27654.msi1⤵
- Blacklisted process makes network request
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F472712B5F17C4BD49CB915E0AA93866 C2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI915E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_105031 1 CustomActions!CustomActions.CustomActions.IsLegacyVersionInstalled3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 9604⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI915E.tmp
-
\Users\Admin\AppData\Local\Temp\MSI915E.tmp
-
\Users\Admin\AppData\Local\Temp\MSI915E.tmp
-
memory/1708-4-0x00000000042F0000-0x00000000042F1000-memory.dmpFilesize
4KB
-
memory/1708-5-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/2916-0-0x0000027CB6D40000-0x0000027CB6D44000-memory.dmpFilesize
16KB