Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
23/02/2021, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
windows86.msi
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
windows86.msi
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target windows86.msi
- Size 2.3MB
- Sample210223-n1dht8rdsa
- SHA256 e9200c8a5ccb0bca2e40d3f618b056a552fbd7247396904a0d8ea70164fee886
- MD5 349f4c200aee313f5dcca2accc86d82c
- SHA1 ef8a7f1bb9c2bdebcc693718cb2b10311db2d1da
- SHA512 8711d70c41d013fef8de7d2e8d89a715075e648322e566367c8f8901633ddf29670fe5d82025c4b94ea1bbbfe5dfd6e6504b81f64d252928dfedc62e826f7615
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1776 MSI78FC.tmp 1696 windows10.exe 804 windows86.exe 1568 PVLJRRPHAFDXIX.exe - Loads dropped DLL 9 IoCs
pid Process 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1696 windows10.exe 1696 windows10.exe 1696 windows10.exe 1696 windows10.exe 804 windows86.exe 1568 PVLJRRPHAFDXIX.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win86 = "C:\\Users\\Admin\\AppData\\Local\\windows86.msi /quiet" msiexec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI75DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI784E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f7470fd.ipi msiexec.exe File created C:\Windows\Installer\f7470fb.msi msiexec.exe File opened for modification C:\Windows\Installer\f7470fb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI71F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI757F.tmp msiexec.exe File created C:\Windows\Installer\f7470fd.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI78FC.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2004 msiexec.exe 2004 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1568 PVLJRRPHAFDXIX.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 528 msiexec.exe Token: SeIncreaseQuotaPrivilege 528 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 2004 msiexec.exe Token: SeCreateTokenPrivilege 528 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 528 msiexec.exe Token: SeLockMemoryPrivilege 528 msiexec.exe Token: SeIncreaseQuotaPrivilege 528 msiexec.exe Token: SeMachineAccountPrivilege 528 msiexec.exe Token: SeTcbPrivilege 528 msiexec.exe Token: SeSecurityPrivilege 528 msiexec.exe Token: SeTakeOwnershipPrivilege 528 msiexec.exe Token: SeLoadDriverPrivilege 528 msiexec.exe Token: SeSystemProfilePrivilege 528 msiexec.exe Token: SeSystemtimePrivilege 528 msiexec.exe Token: SeProfSingleProcessPrivilege 528 msiexec.exe Token: SeIncBasePriorityPrivilege 528 msiexec.exe Token: SeCreatePagefilePrivilege 528 msiexec.exe Token: SeCreatePermanentPrivilege 528 msiexec.exe Token: SeBackupPrivilege 528 msiexec.exe Token: SeRestorePrivilege 528 msiexec.exe Token: SeShutdownPrivilege 528 msiexec.exe Token: SeDebugPrivilege 528 msiexec.exe Token: SeAuditPrivilege 528 msiexec.exe Token: SeSystemEnvironmentPrivilege 528 msiexec.exe Token: SeChangeNotifyPrivilege 528 msiexec.exe Token: SeRemoteShutdownPrivilege 528 msiexec.exe Token: SeUndockPrivilege 528 msiexec.exe Token: SeSyncAgentPrivilege 528 msiexec.exe Token: SeEnableDelegationPrivilege 528 msiexec.exe Token: SeManageVolumePrivilege 528 msiexec.exe Token: SeImpersonatePrivilege 528 msiexec.exe Token: SeCreateGlobalPrivilege 528 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeDebugPrivilege 804 windows86.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 528 msiexec.exe 528 msiexec.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1976 2004 msiexec.exe 27 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 2004 wrote to memory of 1776 2004 msiexec.exe 28 PID 1696 wrote to memory of 804 1696 windows10.exe 30 PID 1696 wrote to memory of 804 1696 windows10.exe 30 PID 1696 wrote to memory of 804 1696 windows10.exe 30 PID 1696 wrote to memory of 804 1696 windows10.exe 30 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34 PID 804 wrote to memory of 1568 804 windows86.exe 34
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\windows86.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:528
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B66E54D0F49685C9DC0E5952D0F381AD2⤵
- Loads dropped DLL
PID:1976
-
-
C:\Windows\Installer\MSI78FC.tmp"C:\Windows\Installer\MSI78FC.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Local\" windows10.exe -pSnh2301**2⤵
- Executes dropped EXE
PID:1776
-
-
C:\Users\Admin\AppData\Local\windows10.exe"C:\Users\Admin\AppData\Local\windows10.exe" -pSnh2301**1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\windows86.exe"C:\Users\Admin\AppData\Local\windows86.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\PVLJRRPHAFDXIX.exe"C:\Users\Admin\AppData\Local\\PVLJRRPHAFDXIX.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1568
-
-