Analysis
- max time kernel
43s - max time network
124s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/08/2021, 12:37
Static task
static1
Behavioral task
behavioral1
Sample
factura1hyyghmjijfjshwbk.msi
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
factura1hyyghmjijfjshwbk.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target factura1hyyghmjijfjshwbk.msi
- Size 3.2MB
- Sample210830-fsapa7np7e
- SHA256 2f5958ef72eab8ecb7d91cba766ea7324502fc70797f7668afa9dcc9fa7ab431
- MD5 bf49a7b6064acb39450b5db212aa70f1
- SHA1 2d8af4c6d7bdd9d843566206af8e751cc10b9654
- SHA512 126eb1e369f47c85404fded1fafcd70af3699d4a9a63664683316b22ae184224eb3918b7c25421fdd9946583cb9c6280eb38bd9a29e04562374cb66b65599403
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 3920 MsiExec.exe 3920 MsiExec.exe 3920 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIAFDF.tmp msiexec.exe File created C:\Windows\Installer\f749d11.msi msiexec.exe File opened for modification C:\Windows\Installer\f749d11.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B9336F0D-359B-45BE-BF2A-8661F790585D} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9ED6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAABE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB157.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4088 msiexec.exe 4088 msiexec.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 516 msiexec.exe Token: SeIncreaseQuotaPrivilege 516 msiexec.exe Token: SeSecurityPrivilege 4088 msiexec.exe Token: SeCreateTokenPrivilege 516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 516 msiexec.exe Token: SeLockMemoryPrivilege 516 msiexec.exe Token: SeIncreaseQuotaPrivilege 516 msiexec.exe Token: SeMachineAccountPrivilege 516 msiexec.exe Token: SeTcbPrivilege 516 msiexec.exe Token: SeSecurityPrivilege 516 msiexec.exe Token: SeTakeOwnershipPrivilege 516 msiexec.exe Token: SeLoadDriverPrivilege 516 msiexec.exe Token: SeSystemProfilePrivilege 516 msiexec.exe Token: SeSystemtimePrivilege 516 msiexec.exe Token: SeProfSingleProcessPrivilege 516 msiexec.exe Token: SeIncBasePriorityPrivilege 516 msiexec.exe Token: SeCreatePagefilePrivilege 516 msiexec.exe Token: SeCreatePermanentPrivilege 516 msiexec.exe Token: SeBackupPrivilege 516 msiexec.exe Token: SeRestorePrivilege 516 msiexec.exe Token: SeShutdownPrivilege 516 msiexec.exe Token: SeDebugPrivilege 516 msiexec.exe Token: SeAuditPrivilege 516 msiexec.exe Token: SeSystemEnvironmentPrivilege 516 msiexec.exe Token: SeChangeNotifyPrivilege 516 msiexec.exe Token: SeRemoteShutdownPrivilege 516 msiexec.exe Token: SeUndockPrivilege 516 msiexec.exe Token: SeSyncAgentPrivilege 516 msiexec.exe Token: SeEnableDelegationPrivilege 516 msiexec.exe Token: SeManageVolumePrivilege 516 msiexec.exe Token: SeImpersonatePrivilege 516 msiexec.exe Token: SeCreateGlobalPrivilege 516 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe Token: SeRestorePrivilege 4088 msiexec.exe Token: SeTakeOwnershipPrivilege 4088 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 516 msiexec.exe 516 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4088 wrote to memory of 3920 4088 msiexec.exe 77 PID 4088 wrote to memory of 3920 4088 msiexec.exe 77 PID 4088 wrote to memory of 3920 4088 msiexec.exe 77
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\factura1hyyghmjijfjshwbk.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:516
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A69246A587CA7C5501E6DF6035D0479F2⤵
- Loads dropped DLL
PID:3920
-