Analysis
- max time kernel
15s - max time network
121s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/09/2021, 07:32
Static task
static1
Behavioral task
behavioral1
Sample
factura-rgzddptxuxhmeextjkknfl.msi
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
factura-rgzddptxuxhmeextjkknfl.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target factura-rgzddptxuxhmeextjkknfl.msi
- Size 3.4MB
- Sample210907-jczgmafdfl
- SHA256 2fc55fe4e660a65b3a7021b5fa7048628e58c335d1fc3db0a4b62bdfc9a26e67
- MD5 8bd22ed363da24198868f08c939a0d33
- SHA1 ab41362452b398d0c4d8549de37c9bbc5a67fed3
- SHA512 a08afffeff240bf1f1ba3b2a50ae2e58f5861f178ff5cf77555cca9960172106ce62c94904ca70f39abb42ed8cc67a74b521f6a9f77fbb6e9ff56f5d4f821748
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 1460 MsiExec.exe 1460 MsiExec.exe 1460 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{B9336F0D-359B-45BE-BF2A-8661F790585D} msiexec.exe File opened for modification C:\Windows\Installer\MSIA34C.tmp msiexec.exe File created C:\Windows\Installer\f749e1a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9F24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA157.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA3BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\f749e1a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3984 msiexec.exe 3984 msiexec.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 636 msiexec.exe Token: SeIncreaseQuotaPrivilege 636 msiexec.exe Token: SeSecurityPrivilege 3984 msiexec.exe Token: SeCreateTokenPrivilege 636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 636 msiexec.exe Token: SeLockMemoryPrivilege 636 msiexec.exe Token: SeIncreaseQuotaPrivilege 636 msiexec.exe Token: SeMachineAccountPrivilege 636 msiexec.exe Token: SeTcbPrivilege 636 msiexec.exe Token: SeSecurityPrivilege 636 msiexec.exe Token: SeTakeOwnershipPrivilege 636 msiexec.exe Token: SeLoadDriverPrivilege 636 msiexec.exe Token: SeSystemProfilePrivilege 636 msiexec.exe Token: SeSystemtimePrivilege 636 msiexec.exe Token: SeProfSingleProcessPrivilege 636 msiexec.exe Token: SeIncBasePriorityPrivilege 636 msiexec.exe Token: SeCreatePagefilePrivilege 636 msiexec.exe Token: SeCreatePermanentPrivilege 636 msiexec.exe Token: SeBackupPrivilege 636 msiexec.exe Token: SeRestorePrivilege 636 msiexec.exe Token: SeShutdownPrivilege 636 msiexec.exe Token: SeDebugPrivilege 636 msiexec.exe Token: SeAuditPrivilege 636 msiexec.exe Token: SeSystemEnvironmentPrivilege 636 msiexec.exe Token: SeChangeNotifyPrivilege 636 msiexec.exe Token: SeRemoteShutdownPrivilege 636 msiexec.exe Token: SeUndockPrivilege 636 msiexec.exe Token: SeSyncAgentPrivilege 636 msiexec.exe Token: SeEnableDelegationPrivilege 636 msiexec.exe Token: SeManageVolumePrivilege 636 msiexec.exe Token: SeImpersonatePrivilege 636 msiexec.exe Token: SeCreateGlobalPrivilege 636 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 636 msiexec.exe 636 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3984 wrote to memory of 1460 3984 msiexec.exe 77 PID 3984 wrote to memory of 1460 3984 msiexec.exe 77 PID 3984 wrote to memory of 1460 3984 msiexec.exe 77
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\factura-rgzddptxuxhmeextjkknfl.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:636
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 13E696BC4401E4F9EF58F660118C4A902⤵
- Loads dropped DLL
PID:1460
-