Analysis
- max time kernel
148s - max time network
125s - platform
windows10_x64 - resource
win10 - submitted
01/10/2020, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
011_Factura-873510.msi
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
011_Factura-873510.msi
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 011_Factura-873510.msi
- Size 9.8MB
- Sample201001-8acyelnsmn
- SHA256 dddaa72573b6b7c2fa0559290c70ee18c5a0236bf43d99bd1c7fb866929ea6e8
- MD5 e693ea2651e98c36ac807c65f8642eef
- SHA1 6c03499655ec99d78bcd5ab0179a5a6620a2f2be
- SHA512 17261d47110e58ebf4e13aef653e3c6b6082cd1e87ba923fde1fd5aac22136b9883ab5bbcbd5774382152f9de99bdac96cead346ba8d723fcdac13235198554f
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blacklisted process makes network request 2 IoCs
flow pid Process 10 1060 MsiExec.exe 12 1060 MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 2800 axampp50.exe - Loads dropped DLL 4 IoCs
pid Process 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run axampp50.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\pickinvest = "C:\\Users\\Admin\\AppData\\Local\\Nvnowod\\axampp50.exe" axampp50.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B9336F0D-359B-45BE-BF2A-8661F790585D} msiexec.exe File opened for modification C:\Windows\Installer\MSIF9CF.tmp msiexec.exe File opened for modification C:\Windows\Installer\f73f5a5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF651.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF894.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF99F.tmp msiexec.exe File created C:\Windows\Installer\f73f5a5.msi msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 740 msiexec.exe 740 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2800 axampp50.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2896 msiexec.exe Token: SeIncreaseQuotaPrivilege 2896 msiexec.exe Token: SeSecurityPrivilege 740 msiexec.exe Token: SeCreateTokenPrivilege 2896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2896 msiexec.exe Token: SeLockMemoryPrivilege 2896 msiexec.exe Token: SeIncreaseQuotaPrivilege 2896 msiexec.exe Token: SeMachineAccountPrivilege 2896 msiexec.exe Token: SeTcbPrivilege 2896 msiexec.exe Token: SeSecurityPrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeLoadDriverPrivilege 2896 msiexec.exe Token: SeSystemProfilePrivilege 2896 msiexec.exe Token: SeSystemtimePrivilege 2896 msiexec.exe Token: SeProfSingleProcessPrivilege 2896 msiexec.exe Token: SeIncBasePriorityPrivilege 2896 msiexec.exe Token: SeCreatePagefilePrivilege 2896 msiexec.exe Token: SeCreatePermanentPrivilege 2896 msiexec.exe Token: SeBackupPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeShutdownPrivilege 2896 msiexec.exe Token: SeDebugPrivilege 2896 msiexec.exe Token: SeAuditPrivilege 2896 msiexec.exe Token: SeSystemEnvironmentPrivilege 2896 msiexec.exe Token: SeChangeNotifyPrivilege 2896 msiexec.exe Token: SeRemoteShutdownPrivilege 2896 msiexec.exe Token: SeUndockPrivilege 2896 msiexec.exe Token: SeSyncAgentPrivilege 2896 msiexec.exe Token: SeEnableDelegationPrivilege 2896 msiexec.exe Token: SeManageVolumePrivilege 2896 msiexec.exe Token: SeImpersonatePrivilege 2896 msiexec.exe Token: SeCreateGlobalPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2896 msiexec.exe 2896 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 740 wrote to memory of 1060 740 msiexec.exe 75 PID 740 wrote to memory of 1060 740 msiexec.exe 75 PID 740 wrote to memory of 1060 740 msiexec.exe 75 PID 1060 wrote to memory of 2800 1060 MsiExec.exe 79 PID 1060 wrote to memory of 2800 1060 MsiExec.exe 79 PID 1060 wrote to memory of 2800 1060 MsiExec.exe 79
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\011_Factura-873510.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2896
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 94C5C2BE598ECE3724F0D3F93EF62FDE2⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Nvnowod\axampp50.exe"C:\Users\Admin\AppData\Local\Nvnowod\axampp50.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:2800
-
-