Analysis
- max time kernel
149s - max time network
118s - platform
windows10_x64 - resource
win10v200722 - submitted
05/08/2020, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
factura.msi
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
factura.msi
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target factura.msi
- Size 4.3MB
- Sample200805-gr2px3w4p2
- SHA256 76eab867aae0dcb9ec96ed5fca30fc051ac776981fa997c0b2b0e09905932aa6
- MD5 7e3a4783e580584bdf3114b762aef690
- SHA1 0900b145f524ed6d18180720346fa208968f0f6e
- SHA512 6167675b6b01477266cdc5a0705b0b5f9bdf1c32bc9fc244a311e192d96c90f59f79ad0e4f4afc9b46f98ce24f024e8710d6963ded91b420dbfca0f33681a519
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 892 wrote to memory of 1484 892 msiexec.exe 69 PID 892 wrote to memory of 1484 892 msiexec.exe 69 PID 892 wrote to memory of 1484 892 msiexec.exe 69 PID 1484 wrote to memory of 2096 1484 MsiExec.exe 70 PID 1484 wrote to memory of 2096 1484 MsiExec.exe 70 PID 1484 wrote to memory of 2096 1484 MsiExec.exe 70 - Loads dropped DLL 3 IoCs
pid Process 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 2096 ugqvhozczb.exe - Enumerates connected drives 3 TTPs
- Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\17eef.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8008.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A2C.tmp msiexec.exe File created C:\Windows\Installer\17eef.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI87AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B9336F0D-359B-45BE-BF2A-8661F790585D} msiexec.exe File opened for modification C:\Windows\Installer\MSI8A6B.tmp msiexec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run ugqvhozczb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\ugqvhozczb = "C:\\Users\\Admin\\AppData\\Local\\ALUwCBROUW\\ugqvhozczb.exe" ugqvhozczb.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 732 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 892 msiexec.exe 892 msiexec.exe - Blacklisted process makes network request 2 IoCs
flow pid Process 1 1484 MsiExec.exe 2 1484 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 732 msiexec.exe Token: SeIncreaseQuotaPrivilege 732 msiexec.exe Token: SeSecurityPrivilege 892 msiexec.exe Token: SeCreateTokenPrivilege 732 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 732 msiexec.exe Token: SeLockMemoryPrivilege 732 msiexec.exe Token: SeIncreaseQuotaPrivilege 732 msiexec.exe Token: SeMachineAccountPrivilege 732 msiexec.exe Token: SeTcbPrivilege 732 msiexec.exe Token: SeSecurityPrivilege 732 msiexec.exe Token: SeTakeOwnershipPrivilege 732 msiexec.exe Token: SeLoadDriverPrivilege 732 msiexec.exe Token: SeSystemProfilePrivilege 732 msiexec.exe Token: SeSystemtimePrivilege 732 msiexec.exe Token: SeProfSingleProcessPrivilege 732 msiexec.exe Token: SeIncBasePriorityPrivilege 732 msiexec.exe Token: SeCreatePagefilePrivilege 732 msiexec.exe Token: SeCreatePermanentPrivilege 732 msiexec.exe Token: SeBackupPrivilege 732 msiexec.exe Token: SeRestorePrivilege 732 msiexec.exe Token: SeShutdownPrivilege 732 msiexec.exe Token: SeDebugPrivilege 732 msiexec.exe Token: SeAuditPrivilege 732 msiexec.exe Token: SeSystemEnvironmentPrivilege 732 msiexec.exe Token: SeChangeNotifyPrivilege 732 msiexec.exe Token: SeRemoteShutdownPrivilege 732 msiexec.exe Token: SeUndockPrivilege 732 msiexec.exe Token: SeSyncAgentPrivilege 732 msiexec.exe Token: SeEnableDelegationPrivilege 732 msiexec.exe Token: SeManageVolumePrivilege 732 msiexec.exe Token: SeImpersonatePrivilege 732 msiexec.exe Token: SeCreateGlobalPrivilege 732 msiexec.exe Token: SeRestorePrivilege 892 msiexec.exe Token: SeTakeOwnershipPrivilege 892 msiexec.exe Token: SeRestorePrivilege 892 msiexec.exe Token: SeTakeOwnershipPrivilege 892 msiexec.exe Token: SeRestorePrivilege 892 msiexec.exe Token: SeTakeOwnershipPrivilege 892 msiexec.exe Token: SeRestorePrivilege 892 msiexec.exe Token: SeTakeOwnershipPrivilege 892 msiexec.exe Token: SeRestorePrivilege 892 msiexec.exe Token: SeTakeOwnershipPrivilege 892 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\factura.msi1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
PID:732
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6C58280437EDCC81A75674904A9494AD2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Blacklisted process makes network request
PID:1484 -
C:\Users\Admin\AppData\Local\ALUwCBROUW\ugqvhozczb.exe"C:\Users\Admin\AppData\Local\ALUwCBROUW\ugqvhozczb.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2096
-
-