Analysis
- max time kernel
124s - max time network
126s - platform
windows7_x64 - resource
win7v20210410 - submitted
23/07/2021, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
3ebce3a4.msi
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3ebce3a4.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3ebce3a4.msi
- Size 1.4MB
- Sample210723-7dtmxc4e8n
- SHA256 b57002f28c58303d836bd8c28e2e8b8bcfafc14dffb3f7a76c1c4b6cdbe6d5d0
- MD5 63fc5924bf1c4efbca75ce4cbe41a8e1
- SHA1 e13f3b407871287c40965251046c778660a27fc5
- SHA512 2f6252807515a1e7fd5caea6a8d589dd5d4ff18a93af4eb5221537096775fd669fc748478c33bdec3dd1408f7d2195c6d83fd9d044d68cb30f5c80b08acedf6a
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe 1792 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\dbcode21mk.log msiexec.exe File created C:\Windows\setupact64.log msiexec.exe File created C:\Windows\Installer\f7414d8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1805.tmp msiexec.exe File created C:\Windows\Installer\f7414da.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI19BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f7414da.ipi msiexec.exe File opened for modification C:\Windows\Installer\f7414d8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1593.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI17A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1864.tmp msiexec.exe - Modifies data under HKEY_USERS 31 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2024 msiexec.exe 2024 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1756 msiexec.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 1756 msiexec.exe Token: SeIncreaseQuotaPrivilege 1756 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeSecurityPrivilege 2024 msiexec.exe Token: SeCreateTokenPrivilege 1756 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1756 msiexec.exe Token: SeLockMemoryPrivilege 1756 msiexec.exe Token: SeIncreaseQuotaPrivilege 1756 msiexec.exe Token: SeMachineAccountPrivilege 1756 msiexec.exe Token: SeTcbPrivilege 1756 msiexec.exe Token: SeSecurityPrivilege 1756 msiexec.exe Token: SeTakeOwnershipPrivilege 1756 msiexec.exe Token: SeLoadDriverPrivilege 1756 msiexec.exe Token: SeSystemProfilePrivilege 1756 msiexec.exe Token: SeSystemtimePrivilege 1756 msiexec.exe Token: SeProfSingleProcessPrivilege 1756 msiexec.exe Token: SeIncBasePriorityPrivilege 1756 msiexec.exe Token: SeCreatePagefilePrivilege 1756 msiexec.exe Token: SeCreatePermanentPrivilege 1756 msiexec.exe Token: SeBackupPrivilege 1756 msiexec.exe Token: SeRestorePrivilege 1756 msiexec.exe Token: SeShutdownPrivilege 1756 msiexec.exe Token: SeDebugPrivilege 1756 msiexec.exe Token: SeAuditPrivilege 1756 msiexec.exe Token: SeSystemEnvironmentPrivilege 1756 msiexec.exe Token: SeChangeNotifyPrivilege 1756 msiexec.exe Token: SeRemoteShutdownPrivilege 1756 msiexec.exe Token: SeUndockPrivilege 1756 msiexec.exe Token: SeSyncAgentPrivilege 1756 msiexec.exe Token: SeEnableDelegationPrivilege 1756 msiexec.exe Token: SeManageVolumePrivilege 1756 msiexec.exe Token: SeImpersonatePrivilege 1756 msiexec.exe Token: SeCreateGlobalPrivilege 1756 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1756 msiexec.exe - Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1792 2024 msiexec.exe 27 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 2024 wrote to memory of 1244 2024 msiexec.exe 28 PID 1244 wrote to memory of 892 1244 MsiExec.exe 29 PID 1244 wrote to memory of 892 1244 MsiExec.exe 29 PID 1244 wrote to memory of 892 1244 MsiExec.exe 29 PID 1244 wrote to memory of 892 1244 MsiExec.exe 29 PID 1244 wrote to memory of 664 1244 MsiExec.exe 31 PID 1244 wrote to memory of 664 1244 MsiExec.exe 31 PID 1244 wrote to memory of 664 1244 MsiExec.exe 31 PID 1244 wrote to memory of 664 1244 MsiExec.exe 31 PID 1244 wrote to memory of 1384 1244 MsiExec.exe 33 PID 1244 wrote to memory of 1384 1244 MsiExec.exe 33 PID 1244 wrote to memory of 1384 1244 MsiExec.exe 33 PID 1244 wrote to memory of 1384 1244 MsiExec.exe 33 PID 1244 wrote to memory of 768 1244 MsiExec.exe 35 PID 1244 wrote to memory of 768 1244 MsiExec.exe 35 PID 1244 wrote to memory of 768 1244 MsiExec.exe 35 PID 1244 wrote to memory of 768 1244 MsiExec.exe 35 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 40 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 40 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 40 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 40 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 42 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 42 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 42 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 42 PID 1244 wrote to memory of 836 1244 MsiExec.exe 44 PID 1244 wrote to memory of 836 1244 MsiExec.exe 44 PID 1244 wrote to memory of 836 1244 MsiExec.exe 44 PID 1244 wrote to memory of 836 1244 MsiExec.exe 44 PID 1244 wrote to memory of 1164 1244 MsiExec.exe 46 PID 1244 wrote to memory of 1164 1244 MsiExec.exe 46 PID 1244 wrote to memory of 1164 1244 MsiExec.exe 46 PID 1244 wrote to memory of 1164 1244 MsiExec.exe 46 PID 1244 wrote to memory of 1616 1244 MsiExec.exe 48 PID 1244 wrote to memory of 1616 1244 MsiExec.exe 48 PID 1244 wrote to memory of 1616 1244 MsiExec.exe 48 PID 1244 wrote to memory of 1616 1244 MsiExec.exe 48 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 51 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 51 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 51 PID 1244 wrote to memory of 1776 1244 MsiExec.exe 51 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 52 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 52 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 52 PID 1244 wrote to memory of 1212 1244 MsiExec.exe 52 PID 1244 wrote to memory of 836 1244 MsiExec.exe 54 PID 1244 wrote to memory of 836 1244 MsiExec.exe 54 PID 1244 wrote to memory of 836 1244 MsiExec.exe 54 PID 1244 wrote to memory of 836 1244 MsiExec.exe 54
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3ebce3a4.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1756
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8622C7BA2E0E5EA8B60518538AA55EDC2⤵
- Loads dropped DLL
PID:1792
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6176C427424682592971DCCFD7FC000F M Global\MSI00002⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" interface ipv6 install3⤵
- Modifies data under HKEY_USERS
PID:892
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye3⤵
- Modifies data under HKEY_USERS
PID:664
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter13⤵
- Modifies data under HKEY_USERS
PID:1384
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:768
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1776
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1212
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP3⤵
- Modifies data under HKEY_USERS
PID:836
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP3⤵
- Modifies data under HKEY_USERS
PID:1164
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP3⤵
- Modifies data under HKEY_USERS
PID:1616
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block3⤵
- Modifies data under HKEY_USERS
PID:1776
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion13⤵
- Modifies data under HKEY_USERS
PID:1212
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y3⤵
- Modifies data under HKEY_USERS
PID:836
-
-