Analysis
-
max time kernel
22s -
max time network
22s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-03-2021 13:49
Behavioral task
behavioral1
Sample
4_2342234575679328584.msi
Resource
win7v20201028
Behavioral task
behavioral2
Sample
4_2342234575679328584.msi
Resource
win10v20201028
Errors
General
-
Target
4_2342234575679328584.msi
-
Size
266KB
-
MD5
7c07a45d87cc4651a1fd84ec84a26305
-
SHA1
a2c9403bd3c9482cf666bfef2261e0625d1b5132
-
SHA256
53cacd3f0415f660597b5636056c0303fb9559ce5a8d9197930ef94c273be306
-
SHA512
e60e20bdd286bde8828679a8176695119c7bb4d9e679d2ba746f272e1cf868e1a35eb2afb4e0eef15e33cf3927293110e4544d111f5c5c3dbdecea4101414684
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
MsiExec.exeflow pid process 5 1820 MsiExec.exe 6 1820 MsiExec.exe -
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 1820 MsiExec.exe 1820 MsiExec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\mÈçlëgìÝàäåÚáÜçâ.App.Refresh.System = "C:\\ProgramData\\Exported Files\\mÈçlëgìÝàäåÚáÜçâ.App.Refresh.System.exe" reg.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Program Files directory 8 IoCs
Processes:
MsiExec.exedescription ioc process File opened for modification C:\PROGRA~3\EXPORT~1\msvcr120.dll MsiExec.exe File created C:\PROGRA~3\EXPORT~1\Avira.OE.NativeCore.dll MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\Avira.OE.NativeCore.dll MsiExec.exe File created C:\PROGRA~3\EXPORT~1\build1 MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\build1 MsiExec.exe File created C:\PROGRA~3\EXPORT~1\msvcp120.dll MsiExec.exe File opened for modification C:\PROGRA~3\EXPORT~1\msvcp120.dll MsiExec.exe File created C:\PROGRA~3\EXPORT~1\msvcr120.dll MsiExec.exe -
Drops file in Windows directory 8 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI3008.tmp msiexec.exe File opened for modification C:\Windows\Installer\f742ba4.ipi msiexec.exe File created C:\Windows\Installer\f742ba2.msi msiexec.exe File opened for modification C:\Windows\Installer\f742ba2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2C1F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DC5.tmp msiexec.exe File created C:\Windows\Installer\f742ba4.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1144 msiexec.exe 1144 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
msiexec.exemsiexec.exeshutdown.exedescription pid process Token: SeShutdownPrivilege 1068 msiexec.exe Token: SeIncreaseQuotaPrivilege 1068 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeSecurityPrivilege 1144 msiexec.exe Token: SeCreateTokenPrivilege 1068 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1068 msiexec.exe Token: SeLockMemoryPrivilege 1068 msiexec.exe Token: SeIncreaseQuotaPrivilege 1068 msiexec.exe Token: SeMachineAccountPrivilege 1068 msiexec.exe Token: SeTcbPrivilege 1068 msiexec.exe Token: SeSecurityPrivilege 1068 msiexec.exe Token: SeTakeOwnershipPrivilege 1068 msiexec.exe Token: SeLoadDriverPrivilege 1068 msiexec.exe Token: SeSystemProfilePrivilege 1068 msiexec.exe Token: SeSystemtimePrivilege 1068 msiexec.exe Token: SeProfSingleProcessPrivilege 1068 msiexec.exe Token: SeIncBasePriorityPrivilege 1068 msiexec.exe Token: SeCreatePagefilePrivilege 1068 msiexec.exe Token: SeCreatePermanentPrivilege 1068 msiexec.exe Token: SeBackupPrivilege 1068 msiexec.exe Token: SeRestorePrivilege 1068 msiexec.exe Token: SeShutdownPrivilege 1068 msiexec.exe Token: SeDebugPrivilege 1068 msiexec.exe Token: SeAuditPrivilege 1068 msiexec.exe Token: SeSystemEnvironmentPrivilege 1068 msiexec.exe Token: SeChangeNotifyPrivilege 1068 msiexec.exe Token: SeRemoteShutdownPrivilege 1068 msiexec.exe Token: SeUndockPrivilege 1068 msiexec.exe Token: SeSyncAgentPrivilege 1068 msiexec.exe Token: SeEnableDelegationPrivilege 1068 msiexec.exe Token: SeManageVolumePrivilege 1068 msiexec.exe Token: SeImpersonatePrivilege 1068 msiexec.exe Token: SeCreateGlobalPrivilege 1068 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeShutdownPrivilege 1764 shutdown.exe Token: SeRemoteShutdownPrivilege 1764 shutdown.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe Token: SeRestorePrivilege 1144 msiexec.exe Token: SeTakeOwnershipPrivilege 1144 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1068 msiexec.exe 1068 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid process target process PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1144 wrote to memory of 1820 1144 msiexec.exe MsiExec.exe PID 1820 wrote to memory of 1492 1820 MsiExec.exe reg.exe PID 1820 wrote to memory of 1492 1820 MsiExec.exe reg.exe PID 1820 wrote to memory of 1492 1820 MsiExec.exe reg.exe PID 1820 wrote to memory of 1492 1820 MsiExec.exe reg.exe PID 1820 wrote to memory of 1764 1820 MsiExec.exe shutdown.exe PID 1820 wrote to memory of 1764 1820 MsiExec.exe shutdown.exe PID 1820 wrote to memory of 1764 1820 MsiExec.exe shutdown.exe PID 1820 wrote to memory of 1764 1820 MsiExec.exe shutdown.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4_2342234575679328584.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD17E9DF71C17DE1F5155603F3A1DC962⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "mÈçlëgìÝàäåÚáÜçâ.App.Refresh.System" /t REG_SZ /F /D "C:\ProgramData\Exported Files\mÈçlëgìÝàäåÚáÜçâ.App.Refresh.System.exe"3⤵
- Adds Run key to start application
-
C:\WINDOWS\SysWOW64\shutdown.exe"C:\WINDOWS\system32\shutdown.exe" -r -t 1 -f3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wlrmdr.exe-s -1 -f 2 -t You are about to be logged off -m Windows will shut down in less than a minute. -a 31⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI42887.LOGMD5
7cca4032fe6dfa381f335b330cbd9e87
SHA1585e335c75d279353371253b370f151c76553cd8
SHA256f240e36ad6f9f3a7bd2ac5af5837ba36ed7d73b6553ae3d22a313475b21adb82
SHA5125b08c3f968d1c18ba977b52e8fdfbb91f38a366ccb8d3d138915046f2fa64583ac1ad404a934f1268a94c3a315af05fd6df50dccda324b661a8eb31da30d540b
-
C:\Windows\Installer\MSI2C1F.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
C:\Windows\Installer\MSI2DC5.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
\Windows\Installer\MSI2C1F.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
\Windows\Installer\MSI2DC5.tmpMD5
5c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
memory/744-12-0x000007FEF77D0000-0x000007FEF7A4A000-memory.dmpFilesize
2.5MB
-
memory/1068-16-0x00000000021E0000-0x00000000021E4000-memory.dmpFilesize
16KB
-
memory/1068-2-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmpFilesize
8KB
-
memory/1344-17-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1492-13-0x0000000000000000-mapping.dmp
-
memory/1628-19-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/1764-14-0x0000000000000000-mapping.dmp
-
memory/1820-6-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1820-11-0x0000000000540000-0x0000000000542000-memory.dmpFilesize
8KB
-
memory/1820-5-0x0000000000000000-mapping.dmp
-
memory/2024-21-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB