Analysis
- max time kernel
127s - max time network
149s - platform
windows10_x64 - resource
win10v200430 - submitted
10/07/2020, 13:06
Static task
static1
Behavioral task
behavioral1
Sample
Nota Fiscal Eletronica.msi
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Nota Fiscal Eletronica.msi
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Nota Fiscal Eletronica.msi
- Size 543KB
- Sample200710-1f5l4dlef6
- SHA256 533e5aced548178da1ba313246e0335fc73d228135ab56f40a1b4bc72fc0a134
- MD5 75b74d963f1f9975f1ab671dce6474d7
- SHA1 7d6720d57edf405a3e30c2d1d6bcbfe034ee5a15
- SHA512 946134eee66068221a1ba9faa1bc45feee637dc2f6875d1b07f8ae053b434e3d82b189683e14aa80be0f5d1d02363a259588f6eca5dce3270f55f666df5c7ea0
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 97 IoCs
description pid Process Token: SeShutdownPrivilege 1632 msiexec.exe Token: SeIncreaseQuotaPrivilege 1632 msiexec.exe Token: SeSecurityPrivilege 1884 msiexec.exe Token: SeCreateTokenPrivilege 1632 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1632 msiexec.exe Token: SeLockMemoryPrivilege 1632 msiexec.exe Token: SeIncreaseQuotaPrivilege 1632 msiexec.exe Token: SeMachineAccountPrivilege 1632 msiexec.exe Token: SeTcbPrivilege 1632 msiexec.exe Token: SeSecurityPrivilege 1632 msiexec.exe Token: SeTakeOwnershipPrivilege 1632 msiexec.exe Token: SeLoadDriverPrivilege 1632 msiexec.exe Token: SeSystemProfilePrivilege 1632 msiexec.exe Token: SeSystemtimePrivilege 1632 msiexec.exe Token: SeProfSingleProcessPrivilege 1632 msiexec.exe Token: SeIncBasePriorityPrivilege 1632 msiexec.exe Token: SeCreatePagefilePrivilege 1632 msiexec.exe Token: SeCreatePermanentPrivilege 1632 msiexec.exe Token: SeBackupPrivilege 1632 msiexec.exe Token: SeRestorePrivilege 1632 msiexec.exe Token: SeShutdownPrivilege 1632 msiexec.exe Token: SeDebugPrivilege 1632 msiexec.exe Token: SeAuditPrivilege 1632 msiexec.exe Token: SeSystemEnvironmentPrivilege 1632 msiexec.exe Token: SeChangeNotifyPrivilege 1632 msiexec.exe Token: SeRemoteShutdownPrivilege 1632 msiexec.exe Token: SeUndockPrivilege 1632 msiexec.exe Token: SeSyncAgentPrivilege 1632 msiexec.exe Token: SeEnableDelegationPrivilege 1632 msiexec.exe Token: SeManageVolumePrivilege 1632 msiexec.exe Token: SeImpersonatePrivilege 1632 msiexec.exe Token: SeCreateGlobalPrivilege 1632 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeShutdownPrivilege 3832 msiexec.exe Token: SeIncreaseQuotaPrivilege 3832 msiexec.exe Token: SeCreateTokenPrivilege 3832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3832 msiexec.exe Token: SeLockMemoryPrivilege 3832 msiexec.exe Token: SeIncreaseQuotaPrivilege 3832 msiexec.exe Token: SeMachineAccountPrivilege 3832 msiexec.exe Token: SeTcbPrivilege 3832 msiexec.exe Token: SeSecurityPrivilege 3832 msiexec.exe Token: SeTakeOwnershipPrivilege 3832 msiexec.exe Token: SeLoadDriverPrivilege 3832 msiexec.exe Token: SeSystemProfilePrivilege 3832 msiexec.exe Token: SeSystemtimePrivilege 3832 msiexec.exe Token: SeProfSingleProcessPrivilege 3832 msiexec.exe Token: SeIncBasePriorityPrivilege 3832 msiexec.exe Token: SeCreatePagefilePrivilege 3832 msiexec.exe Token: SeCreatePermanentPrivilege 3832 msiexec.exe Token: SeBackupPrivilege 3832 msiexec.exe Token: SeRestorePrivilege 3832 msiexec.exe Token: SeShutdownPrivilege 3832 msiexec.exe Token: SeDebugPrivilege 3832 msiexec.exe Token: SeAuditPrivilege 3832 msiexec.exe Token: SeSystemEnvironmentPrivilege 3832 msiexec.exe Token: SeChangeNotifyPrivilege 3832 msiexec.exe Token: SeRemoteShutdownPrivilege 3832 msiexec.exe Token: SeUndockPrivilege 3832 msiexec.exe Token: SeSyncAgentPrivilege 3832 msiexec.exe Token: SeEnableDelegationPrivilege 3832 msiexec.exe Token: SeManageVolumePrivilege 3832 msiexec.exe Token: SeImpersonatePrivilege 3832 msiexec.exe Token: SeCreateGlobalPrivilege 3832 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe - Blacklisted process makes network request 4 IoCs
flow pid Process 4 2512 MsiExec.exe 6 2512 MsiExec.exe 8 2512 MsiExec.exe 10 2512 MsiExec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3252 MsiExec.exe -
resource yara_rule behavioral2/files/0x0002000000015616-15.dat office_xlm_macros - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\win68 = "C:\\Users\\Public\\owzmotqa.msi /quiet" MsiExec.exe - Enumerates connected drives 3 TTPs
- Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI431.tmp msiexec.exe File opened for modification C:\Windows\Installer\1f674.msi msiexec.exe File created C:\Windows\Installer\SourceHash{7F0666E5-9A6B-4F70-9E81-530C35837E3F} msiexec.exe File opened for modification C:\Windows\Installer\MSI15BD.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF7C8.tmp msiexec.exe File created C:\Windows\Installer\1f674.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFFC8.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{D0E6582A-7575-4D15-BB3B-CE4D96BB7599} msiexec.exe File opened for modification C:\Windows\Installer\MSI3E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI12EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1453.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI14D1.tmp msiexec.exe File created C:\Windows\Installer\1f671.msi msiexec.exe File opened for modification C:\Windows\Installer\1f671.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI160C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI13D5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI75.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI132.tmp msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1632 msiexec.exe 1632 msiexec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2512 1884 msiexec.exe 70 PID 1884 wrote to memory of 2512 1884 msiexec.exe 70 PID 1884 wrote to memory of 2512 1884 msiexec.exe 70 PID 2512 wrote to memory of 3832 2512 MsiExec.exe 71 PID 2512 wrote to memory of 3832 2512 MsiExec.exe 71 PID 2512 wrote to memory of 3832 2512 MsiExec.exe 71 PID 1884 wrote to memory of 3252 1884 msiexec.exe 73 PID 1884 wrote to memory of 3252 1884 msiexec.exe 73 PID 1884 wrote to memory of 3252 1884 msiexec.exe 73 - Loads dropped DLL 12 IoCs
pid Process 2512 MsiExec.exe 2512 MsiExec.exe 2512 MsiExec.exe 2512 MsiExec.exe 2512 MsiExec.exe 2512 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe 3252 MsiExec.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1884 msiexec.exe 1884 msiexec.exe 1884 msiexec.exe 1884 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Nota Fiscal Eletronica.msi"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1632
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1884 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C396042C2323A9AEB3C8A455212968B82⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:2512 -
C:\Windows\syswow64\msiexec.exemsiexec.exe /i C:\Users\Public\\owzmotqa.msi /quiet3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 42DE09956FD87F4C822B108980632AF62⤵
- Suspicious behavior: GetForegroundWindowSpam
- Adds Run entry to start application
- Loads dropped DLL
PID:3252
-