Analysis
- max time kernel
102s - max time network
104s - platform
windows10_x64 - resource
win10v20210408 - submitted
20/09/2021, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
Correos_Pedido-2Q00BQR71JHUUSG.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Correos_Pedido-2Q00BQR71JHUUSG.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target Correos_Pedido-2Q00BQR71JHUUSG.msi
- Size 6.1MB
- Sample210920-t4vmvseeh5
- SHA256 8544a136a8dbeab83a3151d9e2b8c12c708aca0274f981af99f9aa1121f2d9de
- MD5 f30c7ec6b9359aeaeb0618277705b1a9
- SHA1 5b503d8d48f649943a2caed89e1eb664c41b7bc2
- SHA512 cf0d5298c94747f9c67657451c9870ec894a03c1a5209ae6111db0fb3d4cf6a6612189a7030a6e8633874fd1c455596db81381dbe98ae7a13ae49fa1f7661917
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1404 MsiExec.exe 1404 MsiExec.exe 1404 MsiExec.exe 1404 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B9336F0D-359B-45BE-BF2A-8661F790585D} msiexec.exe File opened for modification C:\Windows\Installer\MSI59F4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5705.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5A34.tmp msiexec.exe File created C:\Windows\Installer\14ed6.msi msiexec.exe File opened for modification C:\Windows\Installer\14ed6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4FA1.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1012 msiexec.exe 1012 msiexec.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 740 msiexec.exe Token: SeIncreaseQuotaPrivilege 740 msiexec.exe Token: SeSecurityPrivilege 1012 msiexec.exe Token: SeCreateTokenPrivilege 740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 740 msiexec.exe Token: SeLockMemoryPrivilege 740 msiexec.exe Token: SeIncreaseQuotaPrivilege 740 msiexec.exe Token: SeMachineAccountPrivilege 740 msiexec.exe Token: SeTcbPrivilege 740 msiexec.exe Token: SeSecurityPrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeLoadDriverPrivilege 740 msiexec.exe Token: SeSystemProfilePrivilege 740 msiexec.exe Token: SeSystemtimePrivilege 740 msiexec.exe Token: SeProfSingleProcessPrivilege 740 msiexec.exe Token: SeIncBasePriorityPrivilege 740 msiexec.exe Token: SeCreatePagefilePrivilege 740 msiexec.exe Token: SeCreatePermanentPrivilege 740 msiexec.exe Token: SeBackupPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeShutdownPrivilege 740 msiexec.exe Token: SeDebugPrivilege 740 msiexec.exe Token: SeAuditPrivilege 740 msiexec.exe Token: SeSystemEnvironmentPrivilege 740 msiexec.exe Token: SeChangeNotifyPrivilege 740 msiexec.exe Token: SeRemoteShutdownPrivilege 740 msiexec.exe Token: SeUndockPrivilege 740 msiexec.exe Token: SeSyncAgentPrivilege 740 msiexec.exe Token: SeEnableDelegationPrivilege 740 msiexec.exe Token: SeManageVolumePrivilege 740 msiexec.exe Token: SeImpersonatePrivilege 740 msiexec.exe Token: SeCreateGlobalPrivilege 740 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe Token: SeRestorePrivilege 1012 msiexec.exe Token: SeTakeOwnershipPrivilege 1012 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 740 msiexec.exe 740 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1012 wrote to memory of 1404 1012 msiexec.exe 70 PID 1012 wrote to memory of 1404 1012 msiexec.exe 70 PID 1012 wrote to memory of 1404 1012 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Correos_Pedido-2Q00BQR71JHUUSG.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:740
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5B309ACA6B921A7ECD2C89803DAA85092⤵
- Loads dropped DLL
PID:1404
-