Analysis
- max time kernel
141s - max time network
142s - platform
windows10_x64 - resource
win10v200722 - submitted
25/08/2020, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
717113_AYL.msi
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target 717113_AYL.msi
- Size 1015KB
- Sample200825-ahws9ddtf2
- SHA256 80b767be044fed7b482d96625401d23cee2a881d3a1c8d2ab06179deae99d345
- MD5 214eba6d65c6a6ad1a077409fa895e85
- SHA1 0dd9ee7d416973e3c083fea9ae002aa30c4dc348
- SHA512 a0d0bd0971246a67867fa4546d730cf0fb728952edbd85434ec9b4c8bb6447ad89f73f0b5a174e3f56cc9dfea65a3416d746817b05de96cf87286097d60f4914
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blacklisted process makes network request 1 IoCs
flow pid Process 2 904 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 904 MsiExec.exe 904 MsiExec.exe 904 MsiExec.exe 904 MsiExec.exe 904 MsiExec.exe 904 MsiExec.exe - Enumerates connected drives 3 TTPs
- Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI318A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3EDE.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0CA19748-D9CD-4603-BF42-06F430CB1A84} msiexec.exe File created C:\Windows\Installer\13071.msi msiexec.exe File opened for modification C:\Windows\Installer\13071.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3B5F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3C1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3C8A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3E8E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4057.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3196 msiexec.exe 3196 msiexec.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3888 msiexec.exe Token: SeIncreaseQuotaPrivilege 3888 msiexec.exe Token: SeSecurityPrivilege 3196 msiexec.exe Token: SeCreateTokenPrivilege 3888 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3888 msiexec.exe Token: SeLockMemoryPrivilege 3888 msiexec.exe Token: SeIncreaseQuotaPrivilege 3888 msiexec.exe Token: SeMachineAccountPrivilege 3888 msiexec.exe Token: SeTcbPrivilege 3888 msiexec.exe Token: SeSecurityPrivilege 3888 msiexec.exe Token: SeTakeOwnershipPrivilege 3888 msiexec.exe Token: SeLoadDriverPrivilege 3888 msiexec.exe Token: SeSystemProfilePrivilege 3888 msiexec.exe Token: SeSystemtimePrivilege 3888 msiexec.exe Token: SeProfSingleProcessPrivilege 3888 msiexec.exe Token: SeIncBasePriorityPrivilege 3888 msiexec.exe Token: SeCreatePagefilePrivilege 3888 msiexec.exe Token: SeCreatePermanentPrivilege 3888 msiexec.exe Token: SeBackupPrivilege 3888 msiexec.exe Token: SeRestorePrivilege 3888 msiexec.exe Token: SeShutdownPrivilege 3888 msiexec.exe Token: SeDebugPrivilege 3888 msiexec.exe Token: SeAuditPrivilege 3888 msiexec.exe Token: SeSystemEnvironmentPrivilege 3888 msiexec.exe Token: SeChangeNotifyPrivilege 3888 msiexec.exe Token: SeRemoteShutdownPrivilege 3888 msiexec.exe Token: SeUndockPrivilege 3888 msiexec.exe Token: SeSyncAgentPrivilege 3888 msiexec.exe Token: SeEnableDelegationPrivilege 3888 msiexec.exe Token: SeManageVolumePrivilege 3888 msiexec.exe Token: SeImpersonatePrivilege 3888 msiexec.exe Token: SeCreateGlobalPrivilege 3888 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3888 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3196 wrote to memory of 904 3196 msiexec.exe 68 PID 3196 wrote to memory of 904 3196 msiexec.exe 68 PID 3196 wrote to memory of 904 3196 msiexec.exe 68
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\717113_AYL.msi1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3888
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FDF4EE1FE40AA0D6EF5014B678F794B32⤵
- Blacklisted process makes network request
- Loads dropped DLL
PID:904
-