Analysis
- max time kernel
152s - max time network
135s - platform
windows10_x64 - resource
win10-en - submitted
09/09/2021, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
Extrato=nf51622.MQEQHEGNIKÜ.msi
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Extrato=nf51622.MQEQHEGNIKÜ.msi
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target Extrato=nf51622.MQEQHEGNIKÜ.msi
- Size 2.7MB
- Sample210909-rhw8fsbdfp
- SHA256 7a48104f08293c577c5a0d0fb9febbe68e2446b0466c7a8b962b13feb6cb2a37
- MD5 297ddf63e0cfe2cbc805c5529b882c1f
- SHA1 e3f88984ce262e2ea52810b1e213c15e58092f00
- SHA512 af36f47c9890f8b0a4205a5e1d4307bccd6c35ee227669513b5d7267695be4907c936749295c2a17d8fd20381bfd99bc8093a6e6211eb5edf770258492a1b55b
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Blocklisted process makes network request 4 IoCs
flow pid Process 12 3028 MsiExec.exe 14 3028 MsiExec.exe 16 3028 MsiExec.exe 18 3028 MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 2172 Avira.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Avira.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Avira.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SztEmRKCtwBojbcrZfXSweBsTjuUiJNVkLRfhAZGn.lnk MsiExec.exe - Loads dropped DLL 5 IoCs
pid Process 3028 MsiExec.exe 3028 MsiExec.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe -
resource yara_rule behavioral2/files/0x000400000001ab08-166.dat themida behavioral2/files/0x000400000001ab08-171.dat themida behavioral2/memory/2172-175-0x000000006D720000-0x000000006F3E0000-memory.dmp themida - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\j2u1b2m7 = "C:\\Users\\Admin\\AppData\\Roaming\\Loogs\\Avira.exe" Avira.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run Avira.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\G7y4Q7U1 = "C:\\Users\\Admin\\AppData\\Roaming\\Loogs\\Avira.exe" Avira.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Avira.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2172 Avira.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{46D87D49-73AF-4FBB-9DCA-D41A171A4613} msiexec.exe File opened for modification C:\Windows\Installer\MSI9AB.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC5C.tmp msiexec.exe File created C:\Windows\Installer\f7406eb.msi msiexec.exe File opened for modification C:\Windows\Installer\f7406eb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI768.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2140 msiexec.exe 2140 msiexec.exe 2680 powershell.exe 2680 powershell.exe 2680 powershell.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe 2172 Avira.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 3548 msiexec.exe Token: SeIncreaseQuotaPrivilege 3548 msiexec.exe Token: SeSecurityPrivilege 2140 msiexec.exe Token: SeCreateTokenPrivilege 3548 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3548 msiexec.exe Token: SeLockMemoryPrivilege 3548 msiexec.exe Token: SeIncreaseQuotaPrivilege 3548 msiexec.exe Token: SeMachineAccountPrivilege 3548 msiexec.exe Token: SeTcbPrivilege 3548 msiexec.exe Token: SeSecurityPrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeLoadDriverPrivilege 3548 msiexec.exe Token: SeSystemProfilePrivilege 3548 msiexec.exe Token: SeSystemtimePrivilege 3548 msiexec.exe Token: SeProfSingleProcessPrivilege 3548 msiexec.exe Token: SeIncBasePriorityPrivilege 3548 msiexec.exe Token: SeCreatePagefilePrivilege 3548 msiexec.exe Token: SeCreatePermanentPrivilege 3548 msiexec.exe Token: SeBackupPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeShutdownPrivilege 3548 msiexec.exe Token: SeDebugPrivilege 3548 msiexec.exe Token: SeAuditPrivilege 3548 msiexec.exe Token: SeSystemEnvironmentPrivilege 3548 msiexec.exe Token: SeChangeNotifyPrivilege 3548 msiexec.exe Token: SeRemoteShutdownPrivilege 3548 msiexec.exe Token: SeUndockPrivilege 3548 msiexec.exe Token: SeSyncAgentPrivilege 3548 msiexec.exe Token: SeEnableDelegationPrivilege 3548 msiexec.exe Token: SeManageVolumePrivilege 3548 msiexec.exe Token: SeImpersonatePrivilege 3548 msiexec.exe Token: SeCreateGlobalPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeDebugPrivilege 2680 powershell.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3548 msiexec.exe 3028 MsiExec.exe 3548 msiexec.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3028 MsiExec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2140 wrote to memory of 3028 2140 msiexec.exe 78 PID 2140 wrote to memory of 3028 2140 msiexec.exe 78 PID 2140 wrote to memory of 3028 2140 msiexec.exe 78 PID 3028 wrote to memory of 2680 3028 MsiExec.exe 82 PID 3028 wrote to memory of 2680 3028 MsiExec.exe 82 PID 3028 wrote to memory of 2680 3028 MsiExec.exe 82 PID 2680 wrote to memory of 2172 2680 powershell.exe 86 PID 2680 wrote to memory of 2172 2680 powershell.exe 86 PID 2680 wrote to memory of 2172 2680 powershell.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Extrato=nf51622.MQEQHEGNIKÜ.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3548
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D6F8ECCF8741942D52F886368369D5852⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cd\;cd 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup';Start-Sleep -s 60;Invoke-Item 'SztEmRKCtwBojbcrZfXSweBsTjuUiJNVkLRfhAZGn.lnk'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Roaming\Loogs\Avira.exe"C:\Users\Admin\AppData\Roaming\Loogs\Avira.exe"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
-