Analysis
-
max time kernel
110s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:46
Static task
static1
Behavioral task
behavioral1
Sample
fbc28f1437e2cec8deb98be98bcf92d3b08fd07c57e9d2c317ca0621c24df46a.bin.msi
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fbc28f1437e2cec8deb98be98bcf92d3b08fd07c57e9d2c317ca0621c24df46a.bin.msi
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
fbc28f1437e2cec8deb98be98bcf92d3b08fd07c57e9d2c317ca0621c24df46a.bin.msi
-
Size
853KB
-
MD5
b3adaa086e1955851a4c6c4c7e9bf917
-
SHA1
3ba046e128441c5222502a85e2d0c46ef1cb532c
-
SHA256
fbc28f1437e2cec8deb98be98bcf92d3b08fd07c57e9d2c317ca0621c24df46a
-
SHA512
40dc76d080cfc5b0ae7fa1115d86947269a0581b234f415b5b3cabc6f8f60f26b66d9dfdaa2ca2d2b45d692ffc963b9a5edba68c598d3ed32b1d8f68b8162a3c
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1968 MsiExec.exe 1968 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1924 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 92 IoCs
description pid Process Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1564 msiexec.exe Token: SeTakeOwnershipPrivilege 1564 msiexec.exe Token: SeSecurityPrivilege 1564 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1968 1564 msiexec.exe 27 PID 1564 wrote to memory of 1968 1564 msiexec.exe 27 PID 1564 wrote to memory of 1968 1564 msiexec.exe 27 PID 1564 wrote to memory of 1968 1564 msiexec.exe 27 PID 1564 wrote to memory of 1968 1564 msiexec.exe 27 PID 1564 wrote to memory of 1968 1564 msiexec.exe 27 PID 1564 wrote to memory of 1968 1564 msiexec.exe 27
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fbc28f1437e2cec8deb98be98bcf92d3b08fd07c57e9d2c317ca0621c24df46a.bin.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5CDC20425627A5C0A046B14D43CADD24 C2⤵
- Loads dropped DLL
PID:1968
-