Analysis
- max time kernel
70s - max time network
65s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/06/2021, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
938b2e065955369403bd5ed78c063b44.msi
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target 938b2e065955369403bd5ed78c063b44.msi
- Size 4.3MB
- Sample210624-cedwdgmhee
- SHA256 02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5
- MD5 938b2e065955369403bd5ed78c063b44
- SHA1 1e98ff12a5f4a390bbceae538e1177a65ad52dad
- SHA512 159eccba99a0eefbaf078561527bae998202e893724205e0350f20e1c7fd09ccebcc757b433765d223bfcad650f91870e7e2b29031868112636f4061aa0afeb3
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 2 2000 msiexec.exe 4 2000 msiexec.exe 7 556 msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 620 j_service.exe 1152 Register.exe - Loads dropped DLL 44 IoCs
pid Process 436 MsiExec.exe 2012 MsiExec.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 620 j_service.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 1152 Register.exe 620 j_service.exe 620 j_service.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Program Files directory 31 IoCs
description ioc Process File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\msvcp140.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\NSudo.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-multibyte-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libcrypto-1_1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libssl-1_1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libcurl.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\AccessibleHandler.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{B7FC664C-132B-401B-9170-ED3E538079BC}\Logo.ico msiexec.exe File opened for modification C:\Windows\Installer\f7408c8.ipi msiexec.exe File created C:\Windows\Installer\f7408c7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1119.tmp msiexec.exe File created C:\Windows\Installer\f7408ca.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE86.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB6.tmp msiexec.exe File created C:\Windows\Installer\wix{B7FC664C-132B-401B-9170-ED3E538079BC}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\{B7FC664C-132B-401B-9170-ED3E538079BC}\Logo.ico msiexec.exe File opened for modification C:\Windows\Installer\f7408c7.msi msiexec.exe File created C:\Windows\Installer\f7408c8.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\PackageName = "938b2e065955369403bd5ed78c063b44.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Version = "134217999" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188\C466CF7BB231B1041907DEE3350897CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C466CF7BB231B1041907DEE3350897CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C466CF7BB231B1041907DEE3350897CB\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\ProductName = "Oracle Java SE" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\PackageCode = "0F3EC1FE8AEFA504AA4C8350053D1A5C" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\ProductIcon = "C:\\Windows\\Installer\\{B7FC664C-132B-401B-9170-ED3E538079BC}\\Logo.ico" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 556 msiexec.exe 556 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2000 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeSecurityPrivilege 556 msiexec.exe Token: SeCreateTokenPrivilege 2000 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2000 msiexec.exe Token: SeLockMemoryPrivilege 2000 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 msiexec.exe Token: SeMachineAccountPrivilege 2000 msiexec.exe Token: SeTcbPrivilege 2000 msiexec.exe Token: SeSecurityPrivilege 2000 msiexec.exe Token: SeTakeOwnershipPrivilege 2000 msiexec.exe Token: SeLoadDriverPrivilege 2000 msiexec.exe Token: SeSystemProfilePrivilege 2000 msiexec.exe Token: SeSystemtimePrivilege 2000 msiexec.exe Token: SeProfSingleProcessPrivilege 2000 msiexec.exe Token: SeIncBasePriorityPrivilege 2000 msiexec.exe Token: SeCreatePagefilePrivilege 2000 msiexec.exe Token: SeCreatePermanentPrivilege 2000 msiexec.exe Token: SeBackupPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeShutdownPrivilege 2000 msiexec.exe Token: SeDebugPrivilege 2000 msiexec.exe Token: SeAuditPrivilege 2000 msiexec.exe Token: SeSystemEnvironmentPrivilege 2000 msiexec.exe Token: SeChangeNotifyPrivilege 2000 msiexec.exe Token: SeRemoteShutdownPrivilege 2000 msiexec.exe Token: SeUndockPrivilege 2000 msiexec.exe Token: SeSyncAgentPrivilege 2000 msiexec.exe Token: SeEnableDelegationPrivilege 2000 msiexec.exe Token: SeManageVolumePrivilege 2000 msiexec.exe Token: SeImpersonatePrivilege 2000 msiexec.exe Token: SeCreateGlobalPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeShutdownPrivilege 2012 MsiExec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe Token: SeTakeOwnershipPrivilege 556 msiexec.exe Token: SeRestorePrivilege 556 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2000 msiexec.exe 2000 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1152 Register.exe 1152 Register.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 436 556 msiexec.exe 30 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 2012 556 msiexec.exe 31 PID 556 wrote to memory of 1152 556 msiexec.exe 33 PID 556 wrote to memory of 1152 556 msiexec.exe 33 PID 556 wrote to memory of 1152 556 msiexec.exe 33 PID 556 wrote to memory of 1152 556 msiexec.exe 33
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\938b2e065955369403bd5ed78c063b44.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2000
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C734C1864EDCD7DB52D0BA29315486462⤵
- Loads dropped DLL
PID:436
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A569242EC0206BF3B25F15DDC268567A M Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1152
-
-
C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe"C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620