Overview

overview

10

Static

static

10

SecuriteIn...29.msi

windows7_x64

6

SecuriteIn...29.msi

windows10_x64

8

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 21:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Java.Ratty.2.28609.8429.msi

  • Size

    382KB

  • MD5

    a4a64df68cf763c840552dd9d1c9b302

  • SHA1

    f9f23930dc79896dcc8b92dc6297edacabe093ce

  • SHA256

    fe81df4b16db8f18ec02d2de8f5249a0f65e9bcfff2ecc32d22b8cc7bea81f9a

  • SHA512

    19c9d7120446ae678d258148917cf3e56381deb0e1499ff007b45a178f997d3e83c9cda3e2096af4e4a2e808f2468f0bdfa16f2e3c1f607059831c08137c84a5

Score
6/10
persistence

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 147 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Modifies data under HKEY_USERS 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.28609.8429.msi
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:932
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Modifies service
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1752
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    PID:1376
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005B8" "00000000000005B0"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    MD5

    f16297e14801310a45dcf8b21aa544de

    SHA1

    52585fade637b25592977646c69007bff487441e

    SHA256

    9c37e96fe815dccba70adfcb99cdb53298fa73de8cf7556732fc983667c9c3ea

    SHA512

    72578ad0d1b8ff54c4884cfa18ad144ff84b0ec1ed3f8ff270a9195bc7e581684a5a6fe4a93374f00928934690ddfcce6873acc2ce9ed776c7f0513058840db7

    Download Submit

  • memory/932-0-0x0000000004130000-0x0000000004134000-memory.dmp

    Filesize

    16KB

    Download

  • memory/932-1-0x0000000005130000-0x0000000005134000-memory.dmp

    Filesize

    16KB

    Download

  • memory/932-3-0x0000000005250000-0x0000000005254000-memory.dmp

    Filesize

    16KB

    Download

  • memory/932-2-0x0000000005250000-0x0000000005254000-memory.dmp

    Filesize

    16KB

    Download

  • memory/932-4-0x0000000005250000-0x0000000005254000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1752-5-0x0000000000630000-0x0000000000632000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1752-8-0x0000000000F10000-0x0000000000F12000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1752-13-0x00000000015B0000-0x00000000015B4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1752-14-0x0000000001300000-0x0000000001304000-memory.dmp

    Filesize

    16KB

    Download