Analysis
-
max time kernel
76s -
max time network
23s -
platform
windows7_x64 -
resource
win7-en-20210916 -
submitted
19-09-2021 11:55
Static task
static1
Behavioral task
behavioral1
Sample
f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
General
-
Target
f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi
-
Size
5.3MB
-
MD5
c7d18c4670aebfa94bfbe270f651f424
-
SHA1
4a1c48064167fc4ad5d943a54a34785b3682da92
-
SHA256
f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85
-
SHA512
a125054101e7f58e0ed4f48d635959493860c8d26abca8b5c80ba50cddc47a76e787fd65291a0f42f797b958ec133cc6677e76ed49986675b91ef4e90d54c018
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 940 VTNXSOV.exe -
Loads dropped DLL 5 IoCs
pid Process 1372 MsiExec.exe 1372 MsiExec.exe 1372 MsiExec.exe 1372 MsiExec.exe 940 VTNXSOV.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\2a17e.ipi msiexec.exe File created C:\Windows\Installer\2a17c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA709.tmp msiexec.exe File created C:\Windows\Installer\2a17e.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAC0A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB389.tmp msiexec.exe File opened for modification C:\Windows\Installer\2a17c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA295.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA6AB.tmp msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 332 msiexec.exe 332 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 1084 msiexec.exe Token: SeIncreaseQuotaPrivilege 1084 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeSecurityPrivilege 332 msiexec.exe Token: SeCreateTokenPrivilege 1084 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1084 msiexec.exe Token: SeLockMemoryPrivilege 1084 msiexec.exe Token: SeIncreaseQuotaPrivilege 1084 msiexec.exe Token: SeMachineAccountPrivilege 1084 msiexec.exe Token: SeTcbPrivilege 1084 msiexec.exe Token: SeSecurityPrivilege 1084 msiexec.exe Token: SeTakeOwnershipPrivilege 1084 msiexec.exe Token: SeLoadDriverPrivilege 1084 msiexec.exe Token: SeSystemProfilePrivilege 1084 msiexec.exe Token: SeSystemtimePrivilege 1084 msiexec.exe Token: SeProfSingleProcessPrivilege 1084 msiexec.exe Token: SeIncBasePriorityPrivilege 1084 msiexec.exe Token: SeCreatePagefilePrivilege 1084 msiexec.exe Token: SeCreatePermanentPrivilege 1084 msiexec.exe Token: SeBackupPrivilege 1084 msiexec.exe Token: SeRestorePrivilege 1084 msiexec.exe Token: SeShutdownPrivilege 1084 msiexec.exe Token: SeDebugPrivilege 1084 msiexec.exe Token: SeAuditPrivilege 1084 msiexec.exe Token: SeSystemEnvironmentPrivilege 1084 msiexec.exe Token: SeChangeNotifyPrivilege 1084 msiexec.exe Token: SeRemoteShutdownPrivilege 1084 msiexec.exe Token: SeUndockPrivilege 1084 msiexec.exe Token: SeSyncAgentPrivilege 1084 msiexec.exe Token: SeEnableDelegationPrivilege 1084 msiexec.exe Token: SeManageVolumePrivilege 1084 msiexec.exe Token: SeImpersonatePrivilege 1084 msiexec.exe Token: SeCreateGlobalPrivilege 1084 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe Token: SeRestorePrivilege 332 msiexec.exe Token: SeTakeOwnershipPrivilege 332 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1084 msiexec.exe 1084 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 1372 332 msiexec.exe 29 PID 332 wrote to memory of 940 332 msiexec.exe 31 PID 332 wrote to memory of 940 332 msiexec.exe 31 PID 332 wrote to memory of 940 332 msiexec.exe 31 PID 332 wrote to memory of 940 332 msiexec.exe 31
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1084
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F5D0A399DC85BB05AD03CF1C24B6A7DF2⤵
- Loads dropped DLL
PID:1372
-
-
C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\VTNXSOV.exe"C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\VTNXSOV.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940
-