Overview

overview

8

Static

static

Mosef.msi

windows7_x64

8

Mosef.msi

windows10_x64

8

Analysis

  • max time kernel
    71s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05/08/2021, 05:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Mosef.msi
  • Size 1.8MB
  • Sample210805-byap2d2mj2
  • SHA256 ed4544f9e5b144199882d21bf0fd0aeed19f3277b2f1a4c0e3be785cf4397d41
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 25 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 16 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Mosef.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:528
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E76DA27BB5E3AAB4B73BCD2E9AEA0F87 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3844
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6130.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259286609 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        PID:184
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3520
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding AF84998F6418E6CC24274B3E865EFAD7
        2⤵
        • Loads dropped DLL
        PID:2196
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 81AEACC3D561D7F8E60405DC1ABA6CA7 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:3208
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:2964
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
        1⤵
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:2656
      • C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.ClientService.exe
        "C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-is1nzn-relay.screenconnect.com&p=443&s=7f5b61ab-92ef-4a40-bbb3-97b909806e4c&k=BgIAAACkAABSU0ExAAgAAAEAAQBlkNEsf%2fWOhTpMjWFUyUY%2f%2bIvnGSFaxC1KZBc%2bszEV6uLMKnJTIRJJ18rzBbnTEbsDtc7UsZ96BrRZWRqnvbdYtkft9l1jBJpv7k%2fQIuVTiDC8HK7jcZXXIHZrryW1uFdKaMDAhDzGSe8wua007tbeyhjBU%2b2M7Aadvgk8Lrf9rrqXyGvfA7F3BBC9SEq8msMDHtz8g8AlXcShfIzhuRcRfbB8t7zm%2bCSKWS8ZuTf%2fxZ0USuft9SURqE45BHP0tZT4CsDxUXlmoJoQgH3Q8XYGOqWE2RbV09a2iUVN4Yx3fZohWHc%2bWgZzz6BKsgfphiWU%2fPPwles961xrHD42ABWx&t=&c=stc&c=khaled&c=stc&c=pc&c=&c=&c=&c="
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe" "RunRole" "59c43399-5546-432c-b8d6-cbe41fe0f3c1" "User"
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:196
        • C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe" "RunRole" "f06c4f52-2b9c-462b-b323-c74459fe18e9" "System"
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          PID:656

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/184-134-0x0000000006EA0000-0x0000000006EA1000-memory.dmp
            Download

            memory/184-140-0x0000000006D74000-0x0000000006D76000-memory.dmp
            Download

            memory/184-137-0x0000000006F20000-0x0000000006F21000-memory.dmp
            Download

            memory/184-127-0x0000000006D70000-0x0000000006D71000-memory.dmp
            Download

            memory/184-128-0x0000000006D71000-0x0000000006D72000-memory.dmp
            Download

            memory/184-139-0x0000000006D73000-0x0000000006D74000-memory.dmp
            Download

            memory/184-131-0x0000000006E60000-0x0000000006E61000-memory.dmp
            Download

            memory/184-141-0x0000000006D76000-0x0000000006D77000-memory.dmp
            Download

            memory/196-198-0x000000001B1C0000-0x000000001B1C1000-memory.dmp
            Download

            memory/196-195-0x0000000000150000-0x0000000000151000-memory.dmp
            Download

            memory/196-209-0x000000001B6A0000-0x000000001B6A2000-memory.dmp
            Download

            memory/196-200-0x00000000009D0000-0x00000000009D8000-memory.dmp
            Download

            memory/196-199-0x000000001B460000-0x000000001B461000-memory.dmp
            Download

            memory/196-197-0x000000001AF90000-0x000000001AF91000-memory.dmp
            Download

            memory/196-196-0x00000000022A0000-0x00000000022A1000-memory.dmp
            Download

            memory/656-210-0x000000001BA40000-0x000000001BA42000-memory.dmp
            Download

            memory/1340-178-0x0000000001133000-0x0000000001135000-memory.dmp
            Download

            memory/1340-183-0x0000000003B50000-0x0000000003B51000-memory.dmp
            Download

            memory/1340-171-0x0000000003960000-0x0000000003961000-memory.dmp
            Download

            memory/1340-177-0x0000000001132000-0x0000000001133000-memory.dmp
            Download

            memory/1340-189-0x0000000004180000-0x0000000004181000-memory.dmp
            Download

            memory/1340-182-0x0000000003C30000-0x0000000003C31000-memory.dmp
            Download

            memory/1340-188-0x00000000041F0000-0x00000000041F1000-memory.dmp
            Download

            memory/1340-176-0x0000000001130000-0x0000000001131000-memory.dmp
            Download

            memory/1340-164-0x00000000010A0000-0x00000000010A1000-memory.dmp
            Download