f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85

Analysis

max time kernel
76s
max time network
23s
platform
windows7_x64
resource
win7-en-20210916
submitted
19-09-2021 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi
Size

5.3MB
MD5

c7d18c4670aebfa94bfbe270f651f424
SHA1

4a1c48064167fc4ad5d943a54a34785b3682da92
SHA256

f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85
SHA512

a125054101e7f58e0ed4f48d635959493860c8d26abca8b5c80ba50cddc47a76e787fd65291a0f42f797b958ec133cc6677e76ed49986675b91ef4e90d54c018

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

VTNXSOV.exe

pid process

940 VTNXSOV.exe
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exeVTNXSOV.exe

pid process

1372 MsiExec.exe
1372 MsiExec.exe
1372 MsiExec.exe
1372 MsiExec.exe
940 VTNXSOV.exe

pid	process
940	VTNXSOV.exe

pid	process
1372	MsiExec.exe
1372	MsiExec.exe
1372	MsiExec.exe
1372	MsiExec.exe
940	VTNXSOV.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\2a17e.ipi	msiexec.exe
File created	C:\Windows\Installer\2a17c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA709.tmp	msiexec.exe
File created	C:\Windows\Installer\2a17e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB389.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\2a17c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA295.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6AB.tmp	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

332 msiexec.exe
332 msiexec.exe

pid	process
332	msiexec.exe
332	msiexec.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1084	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeSecurityPrivilege	332	msiexec.exe
Token: SeCreateTokenPrivilege	1084	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1084	msiexec.exe
Token: SeLockMemoryPrivilege	1084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1084	msiexec.exe
Token: SeMachineAccountPrivilege	1084	msiexec.exe
Token: SeTcbPrivilege	1084	msiexec.exe
Token: SeSecurityPrivilege	1084	msiexec.exe
Token: SeTakeOwnershipPrivilege	1084	msiexec.exe
Token: SeLoadDriverPrivilege	1084	msiexec.exe
Token: SeSystemProfilePrivilege	1084	msiexec.exe
Token: SeSystemtimePrivilege	1084	msiexec.exe
Token: SeProfSingleProcessPrivilege	1084	msiexec.exe
Token: SeIncBasePriorityPrivilege	1084	msiexec.exe
Token: SeCreatePagefilePrivilege	1084	msiexec.exe
Token: SeCreatePermanentPrivilege	1084	msiexec.exe
Token: SeBackupPrivilege	1084	msiexec.exe
Token: SeRestorePrivilege	1084	msiexec.exe
Token: SeShutdownPrivilege	1084	msiexec.exe
Token: SeDebugPrivilege	1084	msiexec.exe
Token: SeAuditPrivilege	1084	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1084	msiexec.exe
Token: SeChangeNotifyPrivilege	1084	msiexec.exe
Token: SeRemoteShutdownPrivilege	1084	msiexec.exe
Token: SeUndockPrivilege	1084	msiexec.exe
Token: SeSyncAgentPrivilege	1084	msiexec.exe
Token: SeEnableDelegationPrivilege	1084	msiexec.exe
Token: SeManageVolumePrivilege	1084	msiexec.exe
Token: SeImpersonatePrivilege	1084	msiexec.exe
Token: SeCreateGlobalPrivilege	1084	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe
Token: SeRestorePrivilege	332	msiexec.exe
Token: SeTakeOwnershipPrivilege	332	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1084 msiexec.exe
1084 msiexec.exe

pid	process
1084	msiexec.exe
1084	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 1372	332	msiexec.exe	MsiExec.exe
PID 332 wrote to memory of 940	332	msiexec.exe	VTNXSOV.exe
PID 332 wrote to memory of 940	332	msiexec.exe	VTNXSOV.exe
PID 332 wrote to memory of 940	332	msiexec.exe	VTNXSOV.exe
PID 332 wrote to memory of 940	332	msiexec.exe	VTNXSOV.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1084

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F5D0A399DC85BB05AD03CF1C24B6A7DF
  2⤵
  - Loads dropped DLL
  PID:1372
- C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\VTNXSOV.exe
  "C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\VTNXSOV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\Cooperativa.exe

MD5
e39592c0b83c040fda60c5bad8cc65c5

SHA1
65684b3d962fb3483766f9e4a9c047c0e27f055e

SHA256
fbfdd5b8449d08e0d82fc942ed39a0e280dba2d39c3e9e537f97b760d4fbcb52

SHA512
e8bc1589ce0119c331abc81ddbeb374edf5d3c82bc1b36f4522fb4b2a03eb64e3fdfc635bc9f5305daa1174298a4ff917fbd0bf1394fe2c3e7b4769a0ec3e82d

Download Submit
C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\OLEACC

MD5
477cd985ef24ce7d3d02994f2da789e7

SHA1
130b59f6056ec83633cc1e0190aed64308dd85ac

SHA256
13500f1851482d91d9be27736aa41ba2102c3807a2901220f2e8eef5947bc148

SHA512
3fc9db101d240dbf45d54c6db8a118942c553860128700c142ff616e10993154147d2da1429b770f5c49b824bad6a754e42953f4cba918b64b0ecf9d104a0670

Download Submit
C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\OLEACC.dll

MD5
31e44e62ff0c27115e5297e259c7a9f0

SHA1
12ac138134b65941d0bb1fb50100a8d8e97fe4da

SHA256
339bd1a013f0985113fb94905397fccf5407508e0a1847789c226540d9305053

SHA512
17980e99c8e4a199c941338ebd2113d0145666fd0b6fc8b68793035856af91eb16673b63c3e2d5cbecf9ef6b61e6449abe95e8324afa94320036615c226d306c

Download Submit
C:\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\VTNXSOV.exe

MD5
e39592c0b83c040fda60c5bad8cc65c5

SHA1
65684b3d962fb3483766f9e4a9c047c0e27f055e

SHA256
fbfdd5b8449d08e0d82fc942ed39a0e280dba2d39c3e9e537f97b760d4fbcb52

SHA512
e8bc1589ce0119c331abc81ddbeb374edf5d3c82bc1b36f4522fb4b2a03eb64e3fdfc635bc9f5305daa1174298a4ff917fbd0bf1394fe2c3e7b4769a0ec3e82d

Download Submit
C:\Windows\Installer\MSIA295.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSIA6AB.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSIA709.tmp

MD5
7e68b9d86ff8fafe995fc9ea0a2bff44

SHA1
06afc5448037dc419013c3055f61836875bc5e02

SHA256
fb4ff113ee64dd8d9aa92a3b5c1d1cd0896a1cc8b4c3768d1cacde2f52f41d58

SHA512
6e22afd350f376969de823b033394324d3c2433c196515624a84b8e5160ea228fdaac0699e76466ae1f30155fc44f61697efb9e1eca9a67670aff25e6ee67a5c

Download Submit
C:\Windows\Installer\MSIAC0A.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Users\Admin\AppData\Roaming\SLZKQ\AYTDYTZEVV\Oleacc.dll

MD5
31e44e62ff0c27115e5297e259c7a9f0

SHA1
12ac138134b65941d0bb1fb50100a8d8e97fe4da

SHA256
339bd1a013f0985113fb94905397fccf5407508e0a1847789c226540d9305053

SHA512
17980e99c8e4a199c941338ebd2113d0145666fd0b6fc8b68793035856af91eb16673b63c3e2d5cbecf9ef6b61e6449abe95e8324afa94320036615c226d306c

Download Submit
\Windows\Installer\MSIA295.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSIA6AB.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSIA709.tmp

MD5
7e68b9d86ff8fafe995fc9ea0a2bff44

SHA1
06afc5448037dc419013c3055f61836875bc5e02

SHA256
fb4ff113ee64dd8d9aa92a3b5c1d1cd0896a1cc8b4c3768d1cacde2f52f41d58

SHA512
6e22afd350f376969de823b033394324d3c2433c196515624a84b8e5160ea228fdaac0699e76466ae1f30155fc44f61697efb9e1eca9a67670aff25e6ee67a5c

Download Submit
\Windows\Installer\MSIAC0A.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
memory/940-66-0x0000000000000000-mapping.dmp

Download
memory/1084-53-0x000007FEFBA11000-0x000007FEFBA13000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1372-55-0x0000000000000000-mapping.dmp

Download