Analysis

  • max time kernel
    27s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    07-03-2021 11:30

Errors

Reason
Machine shutdown

General

  • Target

    XMLFC-NI_27.msi

  • Size

    267KB

  • MD5

    3ba27f796d18104606b2f58744fb017c

  • SHA1

    cc253e24ab868e61419a78fc161a5546ce878bd6

  • SHA256

    e2eaa5496cb25b7d2866507d4fc494173588897b4d589b8322fc9635bac71e02

  • SHA512

    30fa4108697a1f80a3164318d953e585dee98965477e7dcbaf45d1e2194f648c0e4398ee55d3540b09897dfdbd934abed9c48141adddb41d1765109d7806320f

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XMLFC-NI_27.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:776
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AD348124898EE13CC1007DA7C2DD52DC
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\System32\reg.exe" ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ãßìÉgÒßäÍßÜæñîàÚ.App.Refresh.System" /t REG_SZ /F /D "C:\ProgramData\Exported Files\ãßìÉgÒßäÍßÜæñîàÚ.App.Refresh.System.exe"
        3⤵
        • Adds Run key to start application
        PID:524
      • C:\WINDOWS\SysWOW64\shutdown.exe
        "C:\WINDOWS\system32\shutdown.exe" -r -t 1 -f
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1544
  • C:\Windows\system32\wlrmdr.exe
    -s -1 -f 2 -t You are about to be logged off -m Windows will shut down in less than a minute. -a 3
    1⤵
      PID:1888
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0
      1⤵
        PID:1760
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x1
        1⤵
          PID:2024

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        1
        T1112

        Discovery

        Query Registry

        1
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\MSI4033c.LOG
          MD5

          7dc429519b2ef5792646e41094301e8f

          SHA1

          bd74fb641dc43c524ac5f82eb65d7a7bafa4b575

          SHA256

          0ad438d527809fe7b2d920b0da0a62d78f84800597ff5bb31a885cf31c6b951f

          SHA512

          6c5cbecabd728fb48ff335b3058cdf7bd82c1e5a2cc0aa1d4e8fc526e42e27692ca577f5b7ec86fbb3b71f2f57a0dd5e676d6fc14ddfadda11010358c3ffc7f9

        • C:\Windows\Installer\MSI609.tmp
          MD5

          5c5bef05b6f3806106f8f3ce13401cc1

          SHA1

          6005fbe17f6e917ac45317552409d7a60976db14

          SHA256

          f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

          SHA512

          97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

        • C:\Windows\Installer\MSI7CF.tmp
          MD5

          5c5bef05b6f3806106f8f3ce13401cc1

          SHA1

          6005fbe17f6e917ac45317552409d7a60976db14

          SHA256

          f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

          SHA512

          97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

        • \Windows\Installer\MSI609.tmp
          MD5

          5c5bef05b6f3806106f8f3ce13401cc1

          SHA1

          6005fbe17f6e917ac45317552409d7a60976db14

          SHA256

          f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

          SHA512

          97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

        • \Windows\Installer\MSI7CF.tmp
          MD5

          5c5bef05b6f3806106f8f3ce13401cc1

          SHA1

          6005fbe17f6e917ac45317552409d7a60976db14

          SHA256

          f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

          SHA512

          97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

        • memory/524-13-0x0000000000000000-mapping.dmp
        • memory/776-17-0x0000000002260000-0x0000000002264000-memory.dmp
          Filesize

          16KB

        • memory/776-2-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp
          Filesize

          8KB

        • memory/1516-12-0x000007FEF6200000-0x000007FEF647A000-memory.dmp
          Filesize

          2.5MB

        • memory/1544-14-0x0000000000000000-mapping.dmp
        • memory/1756-11-0x00000000008E0000-0x00000000008E2000-memory.dmp
          Filesize

          8KB

        • memory/1756-6-0x0000000076071000-0x0000000076073000-memory.dmp
          Filesize

          8KB

        • memory/1756-5-0x0000000000000000-mapping.dmp
        • memory/1760-19-0x0000000002840000-0x0000000002841000-memory.dmp
          Filesize

          4KB

        • memory/1888-16-0x0000000000120000-0x0000000000121000-memory.dmp
          Filesize

          4KB

        • memory/2024-21-0x00000000027A0000-0x00000000027A1000-memory.dmp
          Filesize

          4KB