Analysis
- max time kernel
12s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/03/2021, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi
- Size 995KB
- Sample210304-tl8fsv68be
- SHA256 e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916
- MD5 241e9717aefd985629e0896657cc4412
- SHA1 38bb53fdd2e1a8eda45240497cb6a3fad2ed3ed9
- SHA512 6656e74ad3d07e0f99d9a2691a3a9be33bfdff1c1a2de6d00057284d11deb488759485b48d0d9a285d045ad05f0a60527f76801742c9b676a5b70653512e147e
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 476 MsiExec.exe 476 MsiExec.exe 476 MsiExec.exe 476 MsiExec.exe 476 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f7445d8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI49C3.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A0582351-158B-4ABD-8C88-3456734EBEAB} msiexec.exe File opened for modification C:\Windows\Installer\MSI4B1C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B6B.tmp msiexec.exe File created C:\Windows\Installer\f7445d8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4665.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4879.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4936.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1512 msiexec.exe 1512 msiexec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 1032 msiexec.exe Token: SeIncreaseQuotaPrivilege 1032 msiexec.exe Token: SeSecurityPrivilege 1512 msiexec.exe Token: SeCreateTokenPrivilege 1032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1032 msiexec.exe Token: SeLockMemoryPrivilege 1032 msiexec.exe Token: SeIncreaseQuotaPrivilege 1032 msiexec.exe Token: SeMachineAccountPrivilege 1032 msiexec.exe Token: SeTcbPrivilege 1032 msiexec.exe Token: SeSecurityPrivilege 1032 msiexec.exe Token: SeTakeOwnershipPrivilege 1032 msiexec.exe Token: SeLoadDriverPrivilege 1032 msiexec.exe Token: SeSystemProfilePrivilege 1032 msiexec.exe Token: SeSystemtimePrivilege 1032 msiexec.exe Token: SeProfSingleProcessPrivilege 1032 msiexec.exe Token: SeIncBasePriorityPrivilege 1032 msiexec.exe Token: SeCreatePagefilePrivilege 1032 msiexec.exe Token: SeCreatePermanentPrivilege 1032 msiexec.exe Token: SeBackupPrivilege 1032 msiexec.exe Token: SeRestorePrivilege 1032 msiexec.exe Token: SeShutdownPrivilege 1032 msiexec.exe Token: SeDebugPrivilege 1032 msiexec.exe Token: SeAuditPrivilege 1032 msiexec.exe Token: SeSystemEnvironmentPrivilege 1032 msiexec.exe Token: SeChangeNotifyPrivilege 1032 msiexec.exe Token: SeRemoteShutdownPrivilege 1032 msiexec.exe Token: SeUndockPrivilege 1032 msiexec.exe Token: SeSyncAgentPrivilege 1032 msiexec.exe Token: SeEnableDelegationPrivilege 1032 msiexec.exe Token: SeManageVolumePrivilege 1032 msiexec.exe Token: SeImpersonatePrivilege 1032 msiexec.exe Token: SeCreateGlobalPrivilege 1032 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe Token: SeRestorePrivilege 1512 msiexec.exe Token: SeTakeOwnershipPrivilege 1512 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1032 msiexec.exe 1032 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1512 wrote to memory of 476 1512 msiexec.exe 77 PID 1512 wrote to memory of 476 1512 msiexec.exe 77 PID 1512 wrote to memory of 476 1512 msiexec.exe 77
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e8bbbdadb67d7e6046a13a4c88ff17d2fa524b782409d0c9b368fa0d7a774916.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1032
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A19440050D3FE38F21BFF2EFF4E1388D2⤵
- Loads dropped DLL
PID:476
-