Overview

overview

10

Static

static

11203780.msi

windows7_x64

10

11203780.msi

windows10_x64

8

Analysis

  • max time kernel
    65s
  • max time network
    62s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    30-06-2020 12:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    11203780.msi

  • Size

    444KB

  • MD5

    7d7c9f126169d3ad991f2b511b466e47

  • SHA1

    7795bbdef40832cee08256ebe1cca0c6df8bc740

  • SHA256

    75c0601db308796a7e8b5f045f908dd910a4a869cc53d544ed28726ad0eb0537

  • SHA512

    cf6e5d6dad7e345b435b91736dae86d6d66ebf726925fc7d843a6c6f773e2a20a10b50ce4533ddf154f48fbc4771f4ee693fb54b0c7106017e40d3649dd95f04

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\11203780.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3888
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3884
    • C:\Windows\Installer\MSI2C6C.tmp
      "C:\Windows\Installer\MSI2C6C.tmp"
      2⤵
      • Executes dropped EXE
      PID:496
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3896
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI2C6C.tmp
    MD5

    42013c93a1711781565cb1373a43f971

    SHA1

    15a6ee651a4d11d55c2c130295c0f53741a2be62

    SHA256

    dcbaf7178636323a226f048b4c8f64510b5b36fbfebcdf56df543eba07bc3bd1

    SHA512

    3b16826760380fd0cf10cd85d5cf9ded4c504e5bc9c8932e09ce88c02cc2dadf80d7198f14ff8f1dfdd52ab78a26ca7eca0c664f47ef8e790ae04cff0baf4bd9

    Download Submit
  • C:\Windows\Installer\MSI2C6C.tmp
    MD5

    42013c93a1711781565cb1373a43f971

    SHA1

    15a6ee651a4d11d55c2c130295c0f53741a2be62

    SHA256

    dcbaf7178636323a226f048b4c8f64510b5b36fbfebcdf56df543eba07bc3bd1

    SHA512

    3b16826760380fd0cf10cd85d5cf9ded4c504e5bc9c8932e09ce88c02cc2dadf80d7198f14ff8f1dfdd52ab78a26ca7eca0c664f47ef8e790ae04cff0baf4bd9

    Download Submit
  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    MD5

    e87a4b343cba210d6b16afd470f81b24

    SHA1

    24ef1897c0e9c4faeb941485ab2d4346f03f57b0

    SHA256

    32b10aa1adea27d346226dd7c46f70133c000b051e092045fb548e359d97bae0

    SHA512

    3cecf8a9a25ee714e0a176296c56e914b02fcf3e5cb2680d53625659cc4bb038d0fff2bc34fbcffaf7168da59d3e9d03c5bc871214d3d7584b929f34addf3ee5

    Download Submit
  • \??\Volume{9563bb1f-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{194a439e-19e4-4f2d-afa8-d3c3f94ff30f}_OnDiskSnapshotProp
    MD5

    909a271dace6d29efde2f847d4eade87

    SHA1

    89bbcb7d6593ea5d9e52377690601ab299c822c1

    SHA256

    3bb4c7a4bd4d0520b8ad1f418e61aea7d7f9f20a2e48412db4144b2a5e06a1e4

    SHA512

    5a0a57cd68130f5ec50ba419cc3e6eb0c2740eb66df75cd13379fd16f8c5bf0ae83cfeb28f7373578986bc258e9aea8c0a4fe72b85edded5447d9db6815ed6f9

    Download Submit
  • memory/496-3-0x0000000000000000-mapping.dmp
    Download
  • memory/3884-0-0x0000000000000000-mapping.dmp
    Download