Analysis
-
max time kernel
27s -
max time network
24s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-03-2021 19:50
Behavioral task
behavioral1
Sample
XMLFC-NI_91.msi
Resource
win7v20201028
Behavioral task
behavioral2
Sample
XMLFC-NI_91.msi
Resource
win10v20201028
Errors
General
-
Target
XMLFC-NI_91.msi
-
Size
268KB
-
MD5
ea216c4397537df9d792c82c852796fa
-
SHA1
c9706304fa18ff3640f4f4db414f026b4de4cbee
-
SHA256
eb1cc652821c6f0665e79abe6dffee13461ffd001a331ffc6752460b7e2d073d
-
SHA512
32c00bf837c78c4e4c6e14fd57ee658100547231255aa08cafd4ff9e65455c79e6c405e3b2574da2f422253a32f5a185d41edaad1d0e33c08744514e84cf7e1a
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
MsiExec.exeflow pid process 5 1964 MsiExec.exe 7 1964 MsiExec.exe 9 1964 MsiExec.exe 11 1964 MsiExec.exe -
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 1964 MsiExec.exe 1964 MsiExec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ÙÔÜgîâÞßÚæåÅvæÞ×.App.Refresh.System = "C:\\ProgramData\\Exported Files\\ÙÔÜgîâÞßÚæåÅvæÞ×.App.Refresh.System.exe" reg.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Program Files directory 8 IoCs
Processes:
MsiExec.exedescription ioc process File created C:\PROGRA~3\EXPORT~1\build1 MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\build1 MsiExec.exe File created C:\PROGRA~3\EXPORT~1\msvcp120.dll MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\msvcp120.dll MsiExec.exe File created C:\PROGRA~3\EXPORT~1\msvcr120.dll MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\msvcr120.dll MsiExec.exe File created C:\PROGRA~3\EXPORT~1\Avira.OE.NativeCore.dll MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\Avira.OE.NativeCore.dll MsiExec.exe -
Drops file in Windows directory 8 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE16.tmp msiexec.exe File opened for modification C:\Windows\Installer\f74063a.ipi msiexec.exe File created C:\Windows\Installer\f740638.msi msiexec.exe File opened for modification C:\Windows\Installer\f740638.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6D4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B9.tmp msiexec.exe File created C:\Windows\Installer\f74063a.ipi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1420 msiexec.exe 1420 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
msiexec.exemsiexec.exeshutdown.exedescription pid process Token: SeShutdownPrivilege 1336 msiexec.exe Token: SeIncreaseQuotaPrivilege 1336 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeSecurityPrivilege 1420 msiexec.exe Token: SeCreateTokenPrivilege 1336 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1336 msiexec.exe Token: SeLockMemoryPrivilege 1336 msiexec.exe Token: SeIncreaseQuotaPrivilege 1336 msiexec.exe Token: SeMachineAccountPrivilege 1336 msiexec.exe Token: SeTcbPrivilege 1336 msiexec.exe Token: SeSecurityPrivilege 1336 msiexec.exe Token: SeTakeOwnershipPrivilege 1336 msiexec.exe Token: SeLoadDriverPrivilege 1336 msiexec.exe Token: SeSystemProfilePrivilege 1336 msiexec.exe Token: SeSystemtimePrivilege 1336 msiexec.exe Token: SeProfSingleProcessPrivilege 1336 msiexec.exe Token: SeIncBasePriorityPrivilege 1336 msiexec.exe Token: SeCreatePagefilePrivilege 1336 msiexec.exe Token: SeCreatePermanentPrivilege 1336 msiexec.exe Token: SeBackupPrivilege 1336 msiexec.exe Token: SeRestorePrivilege 1336 msiexec.exe Token: SeShutdownPrivilege 1336 msiexec.exe Token: SeDebugPrivilege 1336 msiexec.exe Token: SeAuditPrivilege 1336 msiexec.exe Token: SeSystemEnvironmentPrivilege 1336 msiexec.exe Token: SeChangeNotifyPrivilege 1336 msiexec.exe Token: SeRemoteShutdownPrivilege 1336 msiexec.exe Token: SeUndockPrivilege 1336 msiexec.exe Token: SeSyncAgentPrivilege 1336 msiexec.exe Token: SeEnableDelegationPrivilege 1336 msiexec.exe Token: SeManageVolumePrivilege 1336 msiexec.exe Token: SeImpersonatePrivilege 1336 msiexec.exe Token: SeCreateGlobalPrivilege 1336 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeShutdownPrivilege 736 shutdown.exe Token: SeRemoteShutdownPrivilege 736 shutdown.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1336 msiexec.exe 1336 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid process target process PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1420 wrote to memory of 1964 1420 msiexec.exe MsiExec.exe PID 1964 wrote to memory of 1468 1964 MsiExec.exe reg.exe PID 1964 wrote to memory of 1468 1964 MsiExec.exe reg.exe PID 1964 wrote to memory of 1468 1964 MsiExec.exe reg.exe PID 1964 wrote to memory of 1468 1964 MsiExec.exe reg.exe PID 1964 wrote to memory of 736 1964 MsiExec.exe shutdown.exe PID 1964 wrote to memory of 736 1964 MsiExec.exe shutdown.exe PID 1964 wrote to memory of 736 1964 MsiExec.exe shutdown.exe PID 1964 wrote to memory of 736 1964 MsiExec.exe shutdown.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XMLFC-NI_91.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F886F3D089AA85FC4227DE57F5BD4DB72⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ÙÔÜgîâÞßÚæåÅvæÞ×.App.Refresh.System" /t REG_SZ /F /D "C:\ProgramData\Exported Files\ÙÔÜgîâÞßÚæåÅvæÞ×.App.Refresh.System.exe"3⤵
- Adds Run key to start application
-
C:\WINDOWS\SysWOW64\shutdown.exe"C:\WINDOWS\system32\shutdown.exe" -r -t 1 -f3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wlrmdr.exe-s -1 -f 2 -t You are about to be logged off -m Windows will shut down in less than a minute. -a 31⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI40406.LOGMD5
7ef2249da99028b9502d53ba1fe13a41
SHA1bc5d30a2b23b1fee0b7dc3dbb115b9a9b97cd6c3
SHA2564004429a3347970f81150aa3392c749ecb3dc046c05736f45430183d7dcbe9f8
SHA5127ae6c299c0aa0f5d184bfb82514f41b187811f9eaf6b98de2c770eda4f08716419fe810323aedbf42fba48bf4e85c00eac39b4640245057d88a7cc65070dd3db
-
C:\Windows\Installer\MSI6D4.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
C:\Windows\Installer\MSI8B9.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
\Windows\Installer\MSI6D4.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
\Windows\Installer\MSI8B9.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
memory/736-13-0x0000000000000000-mapping.dmp
-
memory/924-11-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB
-
memory/1076-17-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1336-16-0x0000000002090000-0x0000000002094000-memory.dmpFilesize
16KB
-
memory/1336-2-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmpFilesize
8KB
-
memory/1468-12-0x0000000000000000-mapping.dmp
-
memory/1684-18-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/1964-6-0x0000000075DE1000-0x0000000075DE3000-memory.dmpFilesize
8KB
-
memory/1964-5-0x0000000000000000-mapping.dmp
-
memory/1992-20-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB