Analysis
- max time kernel
145s - max time network
147s - platform
windows7_x64 - resource
win7v200722 - submitted
25/08/2020, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
717113_AYL.msi
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target 717113_AYL.msi
- Size 1015KB
- Sample200825-ahws9ddtf2
- SHA256 80b767be044fed7b482d96625401d23cee2a881d3a1c8d2ab06179deae99d345
- MD5 214eba6d65c6a6ad1a077409fa895e85
- SHA1 0dd9ee7d416973e3c083fea9ae002aa30c4dc348
- SHA512 a0d0bd0971246a67867fa4546d730cf0fb728952edbd85434ec9b4c8bb6447ad89f73f0b5a174e3f56cc9dfea65a3416d746817b05de96cf87286097d60f4914
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blacklisted process makes network request 1 IoCs
flow pid Process 4 1864 MsiExec.exe - Loads dropped DLL 5 IoCs
pid Process 1864 MsiExec.exe 1864 MsiExec.exe 1864 MsiExec.exe 1864 MsiExec.exe 1864 MsiExec.exe - Enumerates connected drives 3 TTPs
- Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI61DF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI657A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6666.tmp msiexec.exe File created C:\Windows\Installer\156f5.msi msiexec.exe File opened for modification C:\Windows\Installer\156f5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5791.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6152.tmp msiexec.exe File created C:\Windows\Installer\156f7.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI652B.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1324 msiexec.exe 1324 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1516 msiexec.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 1516 msiexec.exe Token: SeIncreaseQuotaPrivilege 1516 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeSecurityPrivilege 1324 msiexec.exe Token: SeCreateTokenPrivilege 1516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1516 msiexec.exe Token: SeLockMemoryPrivilege 1516 msiexec.exe Token: SeIncreaseQuotaPrivilege 1516 msiexec.exe Token: SeMachineAccountPrivilege 1516 msiexec.exe Token: SeTcbPrivilege 1516 msiexec.exe Token: SeSecurityPrivilege 1516 msiexec.exe Token: SeTakeOwnershipPrivilege 1516 msiexec.exe Token: SeLoadDriverPrivilege 1516 msiexec.exe Token: SeSystemProfilePrivilege 1516 msiexec.exe Token: SeSystemtimePrivilege 1516 msiexec.exe Token: SeProfSingleProcessPrivilege 1516 msiexec.exe Token: SeIncBasePriorityPrivilege 1516 msiexec.exe Token: SeCreatePagefilePrivilege 1516 msiexec.exe Token: SeCreatePermanentPrivilege 1516 msiexec.exe Token: SeBackupPrivilege 1516 msiexec.exe Token: SeRestorePrivilege 1516 msiexec.exe Token: SeShutdownPrivilege 1516 msiexec.exe Token: SeDebugPrivilege 1516 msiexec.exe Token: SeAuditPrivilege 1516 msiexec.exe Token: SeSystemEnvironmentPrivilege 1516 msiexec.exe Token: SeChangeNotifyPrivilege 1516 msiexec.exe Token: SeRemoteShutdownPrivilege 1516 msiexec.exe Token: SeUndockPrivilege 1516 msiexec.exe Token: SeSyncAgentPrivilege 1516 msiexec.exe Token: SeEnableDelegationPrivilege 1516 msiexec.exe Token: SeManageVolumePrivilege 1516 msiexec.exe Token: SeImpersonatePrivilege 1516 msiexec.exe Token: SeCreateGlobalPrivilege 1516 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1516 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1864 1324 msiexec.exe 25 PID 1324 wrote to memory of 1864 1324 msiexec.exe 25 PID 1324 wrote to memory of 1864 1324 msiexec.exe 25 PID 1324 wrote to memory of 1864 1324 msiexec.exe 25 PID 1324 wrote to memory of 1864 1324 msiexec.exe 25 PID 1324 wrote to memory of 1864 1324 msiexec.exe 25 PID 1324 wrote to memory of 1864 1324 msiexec.exe 25
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\717113_AYL.msi1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1516
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 498122811251005CCEAD42031B4357D02⤵
- Blacklisted process makes network request
- Loads dropped DLL
PID:1864
-