Analysis
-
max time kernel
150s -
max time network
29s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
Adobe-Indesign-Business-Plan-Template-Free.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
Adobe-Indesign-Business-Plan-Template-Free.msi
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 968 msiexec.exe 4 968 msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 984 MSID074.tmp 596 MSID074.tmp -
Loads dropped DLL 14 IoCs
pid Process 984 MSID074.tmp 912 MsiExec.exe 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 596 MSID074.tmp 912 MsiExec.exe 1480 MsiExec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1012 powershell.exe 1480 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 968 msiexec.exe Token: SeIncreaseQuotaPrivilege 968 msiexec.exe Token: SeRestorePrivilege 768 msiexec.exe Token: SeTakeOwnershipPrivilege 768 msiexec.exe Token: SeSecurityPrivilege 768 msiexec.exe Token: SeCreateTokenPrivilege 968 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 968 msiexec.exe Token: SeLockMemoryPrivilege 968 msiexec.exe Token: SeIncreaseQuotaPrivilege 968 msiexec.exe Token: SeMachineAccountPrivilege 968 msiexec.exe Token: SeTcbPrivilege 968 msiexec.exe Token: SeSecurityPrivilege 968 msiexec.exe Token: SeTakeOwnershipPrivilege 968 msiexec.exe Token: SeLoadDriverPrivilege 968 msiexec.exe Token: SeSystemProfilePrivilege 968 msiexec.exe Token: SeSystemtimePrivilege 968 msiexec.exe Token: SeProfSingleProcessPrivilege 968 msiexec.exe Token: SeIncBasePriorityPrivilege 968 msiexec.exe Token: SeCreatePagefilePrivilege 968 msiexec.exe Token: SeCreatePermanentPrivilege 968 msiexec.exe Token: SeBackupPrivilege 968 msiexec.exe Token: SeRestorePrivilege 968 msiexec.exe Token: SeShutdownPrivilege 968 msiexec.exe Token: SeDebugPrivilege 968 msiexec.exe Token: SeAuditPrivilege 968 msiexec.exe Token: SeSystemEnvironmentPrivilege 968 msiexec.exe Token: SeChangeNotifyPrivilege 968 msiexec.exe Token: SeRemoteShutdownPrivilege 968 msiexec.exe Token: SeUndockPrivilege 968 msiexec.exe Token: SeSyncAgentPrivilege 968 msiexec.exe Token: SeEnableDelegationPrivilege 968 msiexec.exe Token: SeManageVolumePrivilege 968 msiexec.exe Token: SeImpersonatePrivilege 968 msiexec.exe Token: SeCreateGlobalPrivilege 968 msiexec.exe Token: SeCreateTokenPrivilege 968 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 968 msiexec.exe Token: SeLockMemoryPrivilege 968 msiexec.exe Token: SeIncreaseQuotaPrivilege 968 msiexec.exe Token: SeMachineAccountPrivilege 968 msiexec.exe Token: SeTcbPrivilege 968 msiexec.exe Token: SeSecurityPrivilege 968 msiexec.exe Token: SeTakeOwnershipPrivilege 968 msiexec.exe Token: SeLoadDriverPrivilege 968 msiexec.exe Token: SeSystemProfilePrivilege 968 msiexec.exe Token: SeSystemtimePrivilege 968 msiexec.exe Token: SeProfSingleProcessPrivilege 968 msiexec.exe Token: SeIncBasePriorityPrivilege 968 msiexec.exe Token: SeCreatePagefilePrivilege 968 msiexec.exe Token: SeCreatePermanentPrivilege 968 msiexec.exe Token: SeBackupPrivilege 968 msiexec.exe Token: SeRestorePrivilege 968 msiexec.exe Token: SeShutdownPrivilege 968 msiexec.exe Token: SeDebugPrivilege 968 msiexec.exe Token: SeAuditPrivilege 968 msiexec.exe Token: SeSystemEnvironmentPrivilege 968 msiexec.exe Token: SeChangeNotifyPrivilege 968 msiexec.exe Token: SeRemoteShutdownPrivilege 968 msiexec.exe Token: SeUndockPrivilege 968 msiexec.exe Token: SeSyncAgentPrivilege 968 msiexec.exe Token: SeEnableDelegationPrivilege 968 msiexec.exe Token: SeManageVolumePrivilege 968 msiexec.exe Token: SeImpersonatePrivilege 968 msiexec.exe Token: SeCreateGlobalPrivilege 968 msiexec.exe Token: SeCreateTokenPrivilege 968 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 968 msiexec.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 768 wrote to memory of 912 768 msiexec.exe 28 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 968 wrote to memory of 984 968 msiexec.exe 29 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 984 wrote to memory of 596 984 MSID074.tmp 30 PID 912 wrote to memory of 1012 912 MsiExec.exe 31 PID 912 wrote to memory of 1012 912 MsiExec.exe 31 PID 912 wrote to memory of 1012 912 MsiExec.exe 31 PID 912 wrote to memory of 1012 912 MsiExec.exe 31 PID 768 wrote to memory of 1480 768 msiexec.exe 33 PID 768 wrote to memory of 1480 768 msiexec.exe 33 PID 768 wrote to memory of 1480 768 msiexec.exe 33 PID 768 wrote to memory of 1480 768 msiexec.exe 33 PID 768 wrote to memory of 1480 768 msiexec.exe 33 PID 768 wrote to memory of 1480 768 msiexec.exe 33 PID 768 wrote to memory of 1480 768 msiexec.exe 33
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Adobe-Indesign-Business-Plan-Template-Free.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\MSID074.tmp"C:\Users\Admin\AppData\Local\Temp\MSID074.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\Temp\{AE72E311-0897-4B71-A72E-A67359D69859}\.cr\MSID074.tmp"C:\Windows\Temp\{AE72E311-0897-4B71-A72E-A67359D69859}\.cr\MSID074.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MSID074.tmp" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5EA81B05D07DF3177271DC52D7DF206E C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD480.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiD44E.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrD44F.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrD450.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1012
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38BAA0A4C0E98CFD271CD0DF0D2DB1CE C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1480
-