Analysis
- max time kernel
63s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/09/2021, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
msi.msi
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
General
- Target msi.msi
- Size 11.4MB
- Sample210919-mteekabhe5
- SHA256 f98b15b7d9550610415c55202d067c0ab6d59c50e55d6a299d7127ead6f6151a
- MD5 dfff3efb5cb31f71c9f23944d8d8dbd2
- SHA1 7579ca56e549f57d558de90ac255e13d693ab9da
- SHA512 e1a47094969eaa6712b84883005e127858d673a82a6a14e2405b6a329393c9610fe6551e1b44e0ae6687944f92d95abd21a64ab4cc92d445b3dde4fbc1309777
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 3 396 msiexec.exe 5 396 msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 1876 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 396 msiexec.exe Token: SeIncreaseQuotaPrivilege 396 msiexec.exe Token: SeSecurityPrivilege 1368 msiexec.exe Token: SeCreateTokenPrivilege 396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 396 msiexec.exe Token: SeLockMemoryPrivilege 396 msiexec.exe Token: SeIncreaseQuotaPrivilege 396 msiexec.exe Token: SeMachineAccountPrivilege 396 msiexec.exe Token: SeTcbPrivilege 396 msiexec.exe Token: SeSecurityPrivilege 396 msiexec.exe Token: SeTakeOwnershipPrivilege 396 msiexec.exe Token: SeLoadDriverPrivilege 396 msiexec.exe Token: SeSystemProfilePrivilege 396 msiexec.exe Token: SeSystemtimePrivilege 396 msiexec.exe Token: SeProfSingleProcessPrivilege 396 msiexec.exe Token: SeIncBasePriorityPrivilege 396 msiexec.exe Token: SeCreatePagefilePrivilege 396 msiexec.exe Token: SeCreatePermanentPrivilege 396 msiexec.exe Token: SeBackupPrivilege 396 msiexec.exe Token: SeRestorePrivilege 396 msiexec.exe Token: SeShutdownPrivilege 396 msiexec.exe Token: SeDebugPrivilege 396 msiexec.exe Token: SeAuditPrivilege 396 msiexec.exe Token: SeSystemEnvironmentPrivilege 396 msiexec.exe Token: SeChangeNotifyPrivilege 396 msiexec.exe Token: SeRemoteShutdownPrivilege 396 msiexec.exe Token: SeUndockPrivilege 396 msiexec.exe Token: SeSyncAgentPrivilege 396 msiexec.exe Token: SeEnableDelegationPrivilege 396 msiexec.exe Token: SeManageVolumePrivilege 396 msiexec.exe Token: SeImpersonatePrivilege 396 msiexec.exe Token: SeCreateGlobalPrivilege 396 msiexec.exe Token: SeCreateTokenPrivilege 396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 396 msiexec.exe Token: SeLockMemoryPrivilege 396 msiexec.exe Token: SeIncreaseQuotaPrivilege 396 msiexec.exe Token: SeMachineAccountPrivilege 396 msiexec.exe Token: SeTcbPrivilege 396 msiexec.exe Token: SeSecurityPrivilege 396 msiexec.exe Token: SeTakeOwnershipPrivilege 396 msiexec.exe Token: SeLoadDriverPrivilege 396 msiexec.exe Token: SeSystemProfilePrivilege 396 msiexec.exe Token: SeSystemtimePrivilege 396 msiexec.exe Token: SeProfSingleProcessPrivilege 396 msiexec.exe Token: SeIncBasePriorityPrivilege 396 msiexec.exe Token: SeCreatePagefilePrivilege 396 msiexec.exe Token: SeCreatePermanentPrivilege 396 msiexec.exe Token: SeBackupPrivilege 396 msiexec.exe Token: SeRestorePrivilege 396 msiexec.exe Token: SeShutdownPrivilege 396 msiexec.exe Token: SeDebugPrivilege 396 msiexec.exe Token: SeAuditPrivilege 396 msiexec.exe Token: SeSystemEnvironmentPrivilege 396 msiexec.exe Token: SeChangeNotifyPrivilege 396 msiexec.exe Token: SeRemoteShutdownPrivilege 396 msiexec.exe Token: SeUndockPrivilege 396 msiexec.exe Token: SeSyncAgentPrivilege 396 msiexec.exe Token: SeEnableDelegationPrivilege 396 msiexec.exe Token: SeManageVolumePrivilege 396 msiexec.exe Token: SeImpersonatePrivilege 396 msiexec.exe Token: SeCreateGlobalPrivilege 396 msiexec.exe Token: SeCreateTokenPrivilege 396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 396 msiexec.exe Token: SeLockMemoryPrivilege 396 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 396 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1876 1368 msiexec.exe 70 PID 1368 wrote to memory of 1876 1368 msiexec.exe 70 PID 1368 wrote to memory of 1876 1368 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\msi.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:396
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E2821F11E27F2B8F616A62060A06753 C2⤵
- Loads dropped DLL
PID:1876
-