Analysis
- max time kernel
111s - max time network
100s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/02/2021, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
windows86.msi
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
windows86.msi
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target windows86.msi
- Size 2.3MB
- Sample210223-n1dht8rdsa
- SHA256 e9200c8a5ccb0bca2e40d3f618b056a552fbd7247396904a0d8ea70164fee886
- MD5 349f4c200aee313f5dcca2accc86d82c
- SHA1 ef8a7f1bb9c2bdebcc693718cb2b10311db2d1da
- SHA512 8711d70c41d013fef8de7d2e8d89a715075e648322e566367c8f8901633ddf29670fe5d82025c4b94ea1bbbfe5dfd6e6504b81f64d252928dfedc62e826f7615
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2528 MSI5918.tmp 3520 windows10.exe 3216 windows86.exe 668 FEJOUGPAQPSXIX.exe - Loads dropped DLL 5 IoCs
pid Process 360 MsiExec.exe 360 MsiExec.exe 360 MsiExec.exe 360 MsiExec.exe 668 FEJOUGPAQPSXIX.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win86 = "C:\\Users\\Admin\\AppData\\Local\\windows86.msi /quiet" msiexec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f7453e2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI5693.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5750.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5918.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI587A.tmp msiexec.exe File created C:\Windows\Installer\f7453e2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5450.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI56F1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{8983D347-EEF0-46EF-AC29-89B1CEAF8700} msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 416 msiexec.exe 416 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 668 FEJOUGPAQPSXIX.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1112 msiexec.exe Token: SeIncreaseQuotaPrivilege 1112 msiexec.exe Token: SeSecurityPrivilege 416 msiexec.exe Token: SeCreateTokenPrivilege 1112 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1112 msiexec.exe Token: SeLockMemoryPrivilege 1112 msiexec.exe Token: SeIncreaseQuotaPrivilege 1112 msiexec.exe Token: SeMachineAccountPrivilege 1112 msiexec.exe Token: SeTcbPrivilege 1112 msiexec.exe Token: SeSecurityPrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeLoadDriverPrivilege 1112 msiexec.exe Token: SeSystemProfilePrivilege 1112 msiexec.exe Token: SeSystemtimePrivilege 1112 msiexec.exe Token: SeProfSingleProcessPrivilege 1112 msiexec.exe Token: SeIncBasePriorityPrivilege 1112 msiexec.exe Token: SeCreatePagefilePrivilege 1112 msiexec.exe Token: SeCreatePermanentPrivilege 1112 msiexec.exe Token: SeBackupPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeShutdownPrivilege 1112 msiexec.exe Token: SeDebugPrivilege 1112 msiexec.exe Token: SeAuditPrivilege 1112 msiexec.exe Token: SeSystemEnvironmentPrivilege 1112 msiexec.exe Token: SeChangeNotifyPrivilege 1112 msiexec.exe Token: SeRemoteShutdownPrivilege 1112 msiexec.exe Token: SeUndockPrivilege 1112 msiexec.exe Token: SeSyncAgentPrivilege 1112 msiexec.exe Token: SeEnableDelegationPrivilege 1112 msiexec.exe Token: SeManageVolumePrivilege 1112 msiexec.exe Token: SeImpersonatePrivilege 1112 msiexec.exe Token: SeCreateGlobalPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeRestorePrivilege 416 msiexec.exe Token: SeTakeOwnershipPrivilege 416 msiexec.exe Token: SeDebugPrivilege 3216 windows86.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1112 msiexec.exe 1112 msiexec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 416 wrote to memory of 360 416 msiexec.exe 77 PID 416 wrote to memory of 360 416 msiexec.exe 77 PID 416 wrote to memory of 360 416 msiexec.exe 77 PID 416 wrote to memory of 2528 416 msiexec.exe 79 PID 416 wrote to memory of 2528 416 msiexec.exe 79 PID 416 wrote to memory of 2528 416 msiexec.exe 79 PID 3520 wrote to memory of 3216 3520 windows10.exe 81 PID 3520 wrote to memory of 3216 3520 windows10.exe 81 PID 3520 wrote to memory of 3216 3520 windows10.exe 81 PID 3216 wrote to memory of 668 3216 windows86.exe 84 PID 3216 wrote to memory of 668 3216 windows86.exe 84 PID 3216 wrote to memory of 668 3216 windows86.exe 84 PID 3216 wrote to memory of 668 3216 windows86.exe 84 PID 3216 wrote to memory of 668 3216 windows86.exe 84 PID 3216 wrote to memory of 668 3216 windows86.exe 84 PID 3216 wrote to memory of 668 3216 windows86.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\windows86.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1112
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FBE1EEB18E22A37602CBBA6159590C122⤵
- Loads dropped DLL
PID:360
-
-
C:\Windows\Installer\MSI5918.tmp"C:\Windows\Installer\MSI5918.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Local\" windows10.exe -pSnh2301**2⤵
- Executes dropped EXE
PID:2528
-
-
C:\Users\Admin\AppData\Local\windows10.exe"C:\Users\Admin\AppData\Local\windows10.exe" -pSnh2301**1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\windows86.exe"C:\Users\Admin\AppData\Local\windows86.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\FEJOUGPAQPSXIX.exe"C:\Users\Admin\AppData\Local\\FEJOUGPAQPSXIX.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:668
-
-