Analysis
- max time kernel
20s - max time network
71s - platform
windows10_x64 - resource
win10v20210408 - submitted
23/07/2021, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
3ebce3a4.msi
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3ebce3a4.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3ebce3a4.msi
- Size 1.4MB
- Sample210723-7dtmxc4e8n
- SHA256 b57002f28c58303d836bd8c28e2e8b8bcfafc14dffb3f7a76c1c4b6cdbe6d5d0
- MD5 63fc5924bf1c4efbca75ce4cbe41a8e1
- SHA1 e13f3b407871287c40965251046c778660a27fc5
- SHA512 2f6252807515a1e7fd5caea6a8d589dd5d4ff18a93af4eb5221537096775fd669fc748478c33bdec3dd1408f7d2195c6d83fd9d044d68cb30f5c80b08acedf6a
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 2948 MsiExec.exe 2948 MsiExec.exe 2948 MsiExec.exe 2948 MsiExec.exe 2948 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6C3D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI748C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7539.tmp msiexec.exe File created C:\Windows\Installer\f746b52.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI777D.tmp msiexec.exe File opened for modification C:\Windows\Installer\f746b52.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI74DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{80395032-1630-4C4B-A997-0A7CCB72C75B} msiexec.exe File opened for modification C:\Windows\Installer\MSI73CF.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\dbcode21mk.log msiexec.exe File created C:\Windows\setupact64.log msiexec.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4060 msiexec.exe 4060 msiexec.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 652 msiexec.exe Token: SeIncreaseQuotaPrivilege 652 msiexec.exe Token: SeSecurityPrivilege 4060 msiexec.exe Token: SeCreateTokenPrivilege 652 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 652 msiexec.exe Token: SeLockMemoryPrivilege 652 msiexec.exe Token: SeIncreaseQuotaPrivilege 652 msiexec.exe Token: SeMachineAccountPrivilege 652 msiexec.exe Token: SeTcbPrivilege 652 msiexec.exe Token: SeSecurityPrivilege 652 msiexec.exe Token: SeTakeOwnershipPrivilege 652 msiexec.exe Token: SeLoadDriverPrivilege 652 msiexec.exe Token: SeSystemProfilePrivilege 652 msiexec.exe Token: SeSystemtimePrivilege 652 msiexec.exe Token: SeProfSingleProcessPrivilege 652 msiexec.exe Token: SeIncBasePriorityPrivilege 652 msiexec.exe Token: SeCreatePagefilePrivilege 652 msiexec.exe Token: SeCreatePermanentPrivilege 652 msiexec.exe Token: SeBackupPrivilege 652 msiexec.exe Token: SeRestorePrivilege 652 msiexec.exe Token: SeShutdownPrivilege 652 msiexec.exe Token: SeDebugPrivilege 652 msiexec.exe Token: SeAuditPrivilege 652 msiexec.exe Token: SeSystemEnvironmentPrivilege 652 msiexec.exe Token: SeChangeNotifyPrivilege 652 msiexec.exe Token: SeRemoteShutdownPrivilege 652 msiexec.exe Token: SeUndockPrivilege 652 msiexec.exe Token: SeSyncAgentPrivilege 652 msiexec.exe Token: SeEnableDelegationPrivilege 652 msiexec.exe Token: SeManageVolumePrivilege 652 msiexec.exe Token: SeImpersonatePrivilege 652 msiexec.exe Token: SeCreateGlobalPrivilege 652 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe Token: SeRestorePrivilege 4060 msiexec.exe Token: SeTakeOwnershipPrivilege 4060 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 652 msiexec.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4060 wrote to memory of 2948 4060 msiexec.exe 77 PID 4060 wrote to memory of 2948 4060 msiexec.exe 77 PID 4060 wrote to memory of 2948 4060 msiexec.exe 77 PID 4060 wrote to memory of 1604 4060 msiexec.exe 78 PID 4060 wrote to memory of 1604 4060 msiexec.exe 78 PID 4060 wrote to memory of 1604 4060 msiexec.exe 78 PID 1604 wrote to memory of 3504 1604 MsiExec.exe 79 PID 1604 wrote to memory of 3504 1604 MsiExec.exe 79 PID 1604 wrote to memory of 3504 1604 MsiExec.exe 79 PID 1604 wrote to memory of 4028 1604 MsiExec.exe 81 PID 1604 wrote to memory of 4028 1604 MsiExec.exe 81 PID 1604 wrote to memory of 4028 1604 MsiExec.exe 81 PID 1604 wrote to memory of 3144 1604 MsiExec.exe 83 PID 1604 wrote to memory of 3144 1604 MsiExec.exe 83 PID 1604 wrote to memory of 3144 1604 MsiExec.exe 83 PID 1604 wrote to memory of 3488 1604 MsiExec.exe 85 PID 1604 wrote to memory of 3488 1604 MsiExec.exe 85 PID 1604 wrote to memory of 3488 1604 MsiExec.exe 85 PID 1604 wrote to memory of 2324 1604 MsiExec.exe 87 PID 1604 wrote to memory of 2324 1604 MsiExec.exe 87 PID 1604 wrote to memory of 2324 1604 MsiExec.exe 87 PID 1604 wrote to memory of 3512 1604 MsiExec.exe 89 PID 1604 wrote to memory of 3512 1604 MsiExec.exe 89 PID 1604 wrote to memory of 3512 1604 MsiExec.exe 89 PID 1604 wrote to memory of 3860 1604 MsiExec.exe 91 PID 1604 wrote to memory of 3860 1604 MsiExec.exe 91 PID 1604 wrote to memory of 3860 1604 MsiExec.exe 91 PID 1604 wrote to memory of 4028 1604 MsiExec.exe 93 PID 1604 wrote to memory of 4028 1604 MsiExec.exe 93 PID 1604 wrote to memory of 4028 1604 MsiExec.exe 93 PID 1604 wrote to memory of 2840 1604 MsiExec.exe 97 PID 1604 wrote to memory of 2840 1604 MsiExec.exe 97 PID 1604 wrote to memory of 2840 1604 MsiExec.exe 97 PID 1604 wrote to memory of 2296 1604 MsiExec.exe 100 PID 1604 wrote to memory of 2296 1604 MsiExec.exe 100 PID 1604 wrote to memory of 2296 1604 MsiExec.exe 100 PID 1604 wrote to memory of 3512 1604 MsiExec.exe 101 PID 1604 wrote to memory of 3512 1604 MsiExec.exe 101 PID 1604 wrote to memory of 3512 1604 MsiExec.exe 101 PID 1604 wrote to memory of 344 1604 MsiExec.exe 103 PID 1604 wrote to memory of 344 1604 MsiExec.exe 103 PID 1604 wrote to memory of 344 1604 MsiExec.exe 103
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3ebce3a4.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:652
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9005927DD74B2EFA99A97C47649814032⤵
- Loads dropped DLL
PID:2948
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C1E09681EB55B7B2C0A2E5A516465E6A E Global\MSI00002⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" interface ipv6 install3⤵PID:3504
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye3⤵PID:4028
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter13⤵PID:3144
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP3⤵PID:3488
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP3⤵PID:2324
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP3⤵PID:3512
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP3⤵PID:3860
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP3⤵PID:4028
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP3⤵PID:2840
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block3⤵PID:2296
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion13⤵PID:3512
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y3⤵PID:344
-
-