Analysis
- max time kernel
6s - max time network
11s - platform
windows7_x64 - resource
win7v20201028 - submitted
04/03/2021, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi
- Size 995KB
- Sample210304-tl8fsv68be
- SHA256 e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916
- MD5 241e9717aefd985629e0896657cc4412
- SHA1 38bb53fdd2e1a8eda45240497cb6a3fad2ed3ed9
- SHA512 6656e74ad3d07e0f99d9a2691a3a9be33bfdff1c1a2de6d00057284d11deb488759485b48d0d9a285d045ad05f0a60527f76801742c9b676a5b70653512e147e
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1972 MsiExec.exe 1972 MsiExec.exe 1972 MsiExec.exe 1972 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI708E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI74D3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7522.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI782F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI786E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f747013.ipi msiexec.exe File opened for modification C:\Windows\Installer\f747011.msi msiexec.exe File created C:\Windows\Installer\f747013.ipi msiexec.exe File created C:\Windows\Installer\f747011.msi msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1148 msiexec.exe 1148 msiexec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 1940 msiexec.exe Token: SeIncreaseQuotaPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe Token: SeSecurityPrivilege 1148 msiexec.exe Token: SeCreateTokenPrivilege 1940 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1940 msiexec.exe Token: SeLockMemoryPrivilege 1940 msiexec.exe Token: SeIncreaseQuotaPrivilege 1940 msiexec.exe Token: SeMachineAccountPrivilege 1940 msiexec.exe Token: SeTcbPrivilege 1940 msiexec.exe Token: SeSecurityPrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeLoadDriverPrivilege 1940 msiexec.exe Token: SeSystemProfilePrivilege 1940 msiexec.exe Token: SeSystemtimePrivilege 1940 msiexec.exe Token: SeProfSingleProcessPrivilege 1940 msiexec.exe Token: SeIncBasePriorityPrivilege 1940 msiexec.exe Token: SeCreatePagefilePrivilege 1940 msiexec.exe Token: SeCreatePermanentPrivilege 1940 msiexec.exe Token: SeBackupPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeShutdownPrivilege 1940 msiexec.exe Token: SeDebugPrivilege 1940 msiexec.exe Token: SeAuditPrivilege 1940 msiexec.exe Token: SeSystemEnvironmentPrivilege 1940 msiexec.exe Token: SeChangeNotifyPrivilege 1940 msiexec.exe Token: SeRemoteShutdownPrivilege 1940 msiexec.exe Token: SeUndockPrivilege 1940 msiexec.exe Token: SeSyncAgentPrivilege 1940 msiexec.exe Token: SeEnableDelegationPrivilege 1940 msiexec.exe Token: SeManageVolumePrivilege 1940 msiexec.exe Token: SeImpersonatePrivilege 1940 msiexec.exe Token: SeCreateGlobalPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe Token: SeRestorePrivilege 1148 msiexec.exe Token: SeTakeOwnershipPrivilege 1148 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1940 msiexec.exe 1940 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1972 1148 msiexec.exe 27 PID 1148 wrote to memory of 1972 1148 msiexec.exe 27 PID 1148 wrote to memory of 1972 1148 msiexec.exe 27 PID 1148 wrote to memory of 1972 1148 msiexec.exe 27 PID 1148 wrote to memory of 1972 1148 msiexec.exe 27 PID 1148 wrote to memory of 1972 1148 msiexec.exe 27 PID 1148 wrote to memory of 1972 1148 msiexec.exe 27
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1940
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A32771510F580EE96EAD01DB95CE20522⤵
- Loads dropped DLL
PID:1972
-