Analysis
- max time kernel
5s - max time network
66s - platform
windows7_x64 - resource
win7v20210410 - submitted
09/08/2021, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
110fc287b499bea670dc2060d8a828727f350e9be446879ecfc7f71732ee15ed.msi
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target 110fc287b499bea670dc2060d8a828727f350e9be446879ecfc7f71732ee15ed.msi
- Size 3.9MB
- Sample210809-aeh4apdh4e
- SHA256 110fc287b499bea670dc2060d8a828727f350e9be446879ecfc7f71732ee15ed
- MD5 fe55aa33d7e0b4ef1cb72e61a0a7e581
- SHA1 7b2f0e87f283d1ec4a756b380666a21e303579b0
- SHA512 6b60973f47eddd07a556de3b573902c077830ebbda6e7c4f83f6baa66a0414a6998f3a570b7e559ed9cfd399e9febd7c93cf4454b7cfd59ab4863849f4c5123b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 2 788 msiexec.exe 4 788 msiexec.exe 5 828 msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 1448 Register.exe - Loads dropped DLL 2 IoCs
pid Process 1452 MsiExec.exe 340 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\patch_service.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\SyncMonitor.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-multibyte-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140_1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\f740b86.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\wix{5E1365FD-D1C2-4924-8047-C3F942C8D3CE}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\{5E1365FD-D1C2-4924-8047-C3F942C8D3CE}\Logo.ico msiexec.exe File opened for modification C:\Windows\Installer\f740b86.ipi msiexec.exe File created C:\Windows\Installer\f740b85.msi msiexec.exe File opened for modification C:\Windows\Installer\f740b85.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI139F.tmp msiexec.exe File created C:\Windows\Installer\f740b88.msi msiexec.exe File created C:\Windows\Installer\{5E1365FD-D1C2-4924-8047-C3F942C8D3CE}\Logo.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI10BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI10EF.tmp msiexec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26 msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\PackageCode = "9D60AB34E1F9AF540951EAB0CA4EB4A5" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FBCC74C87B72DBB4D9341F2781E101FD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList\PackageName = "110fc287b499bea670dc2060d8a828727f350e9be446879ecfc7f71732ee15ed.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF5631E52C1D429408743C9F248C3DEC\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\ProductIcon = "C:\\Windows\\Installer\\{5E1365FD-D1C2-4924-8047-C3F942C8D3CE}\\Logo.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FBCC74C87B72DBB4D9341F2781E101FD\DF5631E52C1D429408743C9F248C3DEC msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\ProductName = "Java SE" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF5631E52C1D429408743C9F248C3DEC msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF5631E52C1D429408743C9F248C3DEC\Version = "134349182" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 828 msiexec.exe 828 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 788 msiexec.exe Token: SeIncreaseQuotaPrivilege 788 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeSecurityPrivilege 828 msiexec.exe Token: SeCreateTokenPrivilege 788 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 788 msiexec.exe Token: SeLockMemoryPrivilege 788 msiexec.exe Token: SeIncreaseQuotaPrivilege 788 msiexec.exe Token: SeMachineAccountPrivilege 788 msiexec.exe Token: SeTcbPrivilege 788 msiexec.exe Token: SeSecurityPrivilege 788 msiexec.exe Token: SeTakeOwnershipPrivilege 788 msiexec.exe Token: SeLoadDriverPrivilege 788 msiexec.exe Token: SeSystemProfilePrivilege 788 msiexec.exe Token: SeSystemtimePrivilege 788 msiexec.exe Token: SeProfSingleProcessPrivilege 788 msiexec.exe Token: SeIncBasePriorityPrivilege 788 msiexec.exe Token: SeCreatePagefilePrivilege 788 msiexec.exe Token: SeCreatePermanentPrivilege 788 msiexec.exe Token: SeBackupPrivilege 788 msiexec.exe Token: SeRestorePrivilege 788 msiexec.exe Token: SeShutdownPrivilege 788 msiexec.exe Token: SeDebugPrivilege 788 msiexec.exe Token: SeAuditPrivilege 788 msiexec.exe Token: SeSystemEnvironmentPrivilege 788 msiexec.exe Token: SeChangeNotifyPrivilege 788 msiexec.exe Token: SeRemoteShutdownPrivilege 788 msiexec.exe Token: SeUndockPrivilege 788 msiexec.exe Token: SeSyncAgentPrivilege 788 msiexec.exe Token: SeEnableDelegationPrivilege 788 msiexec.exe Token: SeManageVolumePrivilege 788 msiexec.exe Token: SeImpersonatePrivilege 788 msiexec.exe Token: SeCreateGlobalPrivilege 788 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeShutdownPrivilege 340 MsiExec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe Token: SeTakeOwnershipPrivilege 828 msiexec.exe Token: SeRestorePrivilege 828 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 788 msiexec.exe 788 msiexec.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 1452 828 msiexec.exe 30 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 340 828 msiexec.exe 31 PID 828 wrote to memory of 1448 828 msiexec.exe 32 PID 828 wrote to memory of 1448 828 msiexec.exe 32 PID 828 wrote to memory of 1448 828 msiexec.exe 32 PID 828 wrote to memory of 1448 828 msiexec.exe 32
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\110fc287b499bea670dc2060d8a828727f350e9be446879ecfc7f71732ee15ed.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:788
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F363A015D0BB53C71B24AABA294D86272⤵
- Loads dropped DLL
PID:1452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15DCAD0E85545E7D464E05CFF1A532DA M Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:340
-
-
C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"2⤵
- Executes dropped EXE
PID:1448
-