Overview

overview

10

Static

static

load.msi

windows7_x64

10

load.msi

windows10_x64

10

Analysis

  • max time kernel
    832s
  • max time network
    1553s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-10-2021 17:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    load.msi

  • Size

    548KB

  • MD5

    13173913da1f35728d84e78a3de983c9

  • SHA1

    9a1437af2d653fc265472a47edab9f22d49b1941

  • SHA256

    0e6451e1f0eadb89390f4360e2a49a2ffb66e92e8b3ae75400095e75f4dd6abb

  • SHA512

    3627ec46eb5b8cbdfd28015b38de6cd2279ff15be67e1a5d0c58a86fc1c165a39f4dd2d664977f7ce8a4ded9d2d678ce09c6fa3962e1b93f8543049313527a52

Score
10/10
mirrorblastloaderpersistencesuricata

Malware Config

Signatures

  • MirrorBlast

    MirrorBlast is a script acting as loader for FlawedGrace RAT.

    loadermirrorblast
  • suricata: ET MALWARE MirrorBlast CnC Activity M2

    suricata: ET MALWARE MirrorBlast CnC Activity M2

    suricata
  • suricata: ET MALWARE MirrorBlast CnC Activity M3

    suricata: ET MALWARE MirrorBlast CnC Activity M3

    suricata
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\load.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:652
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1536
    • C:\ProgramData\Local\Google\rebol-view-278-3-1.exe
      "C:\ProgramData\Local\Google\rebol-view-278-3-1.exe" -w -i -s C:/ProgramData/Local/Google/exemple.rb
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c echo %USERDOMAIN%\%USERNAME% > name && for /f "tokens=4-5 delims=. " %i in ('ver') do echo %i.%j > os && echo %PROCESSOR_ARCHITECTURE% > arch
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          4⤵
            PID:2884
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4052
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1316

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Local\Google\arch
      MD5

      8a882b4a938846d19520af8484f09012

      SHA1

      4ba6aa85fc2d9c1f087fd0573ed818af71c4b6fe

      SHA256

      1009573fa6f897afcc5055f52a2216bfe7fcb308d6cab15922a5b3668df7f34b

      SHA512

      299aa6f6d42b8be1a827b8a2543b89de4c324a050d3aa34cf74b7550774586aeec60cccf83782c69569a0fb81a171e3ea6de0c56c11ec6f563b1fe1864452543

      Download Submit

    • C:\ProgramData\Local\Google\exemple.rb
      MD5

      73002084795612b74c26e7c4db0ef48f

      SHA1

      366337f7f7088f3accd78d6385216dbfaa6af42e

      SHA256

      8c1eb0ac7b5dbee43746828bfa4ddaaebeb46290d9161674027d80ef99bb243e

      SHA512

      d0377e3c1353596bbd37f58632d363faafe8fd5df62e5026ef1e76b611a771de7b2f1e42fe283c97637e48417c37eaf1a5dd66b800a914d307cfc695d25dd431

      Download Submit

    • C:\ProgramData\Local\Google\name
      MD5

      0b644b2a65c6141fc40441b708531056

      SHA1

      7cc45d2cb31329a792392bf2c5d3023fff9feb9e

      SHA256

      140cab2330a306eb882d44b6ee9881f1b7f3b699ac33d14194d56913ade18285

      SHA512

      65970af226c9113dd3aef625bbd668ece13aca1a3ebe9a9340795a5d7b51b598ec43105e9784e230c93863ab1b00eb50dc6ae2439001db12d085b7e642a8b968

      Download Submit

    • C:\ProgramData\Local\Google\os
      MD5

      83228b44ffe10b0d443969580b022f44

      SHA1

      1ebe8668b8ce8d9524cc539ab9c6af022e861d60

      SHA256

      b57eac3cb43c42d7f2cc137b372a9271fe3906444bd9a9ed4b16c20ee3e9e70d

      SHA512

      cc7c82779ffce41b68bb21a48c9872c27177353eac12d9f0364d98abbefda106af05486cf8a246a6192754d077d19fed46ce4e0018b7eb1ef724b1f15b397660

      Download Submit

    • C:\ProgramData\Local\Google\rebol-view-278-3-1.exe
      MD5

      aa2f4fd92fe00de85428f39a6e0e9cfd

      SHA1

      1def65dde53ab24c122da6c76646a36d7d910790

      SHA256

      215e28f9660472b6271a9902573c9d190e4d7ccca33fcf8d6054941d52a3ab85

      SHA512

      952b500e4a291a8bd58810529c1fcc17d969b082d29f00460aba6ada44a30ddc41595f8b0fe71e568ecba803df69985840f10f0a9e478c796c73dc5659ce314e

      Download Submit

    • C:\ProgramData\Local\Google\rebol-view-278-3-1.exe
      MD5

      aa2f4fd92fe00de85428f39a6e0e9cfd

      SHA1

      1def65dde53ab24c122da6c76646a36d7d910790

      SHA256

      215e28f9660472b6271a9902573c9d190e4d7ccca33fcf8d6054941d52a3ab85

      SHA512

      952b500e4a291a8bd58810529c1fcc17d969b082d29f00460aba6ada44a30ddc41595f8b0fe71e568ecba803df69985840f10f0a9e478c796c73dc5659ce314e

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      MD5

      d26c191a4db15838da63798e6daf74ac

      SHA1

      5537327628413e8434f28c392d9b4473dbf682b3

      SHA256

      2ca23a68307f52e963005fb62d0b15ab8301ed15ddea0aeaf79bc8d47ade61f0

      SHA512

      8da2f72eb981da8456b82a85aff59b3a050576cd7e175cc7af4830e7f4313d8173685b6232b83299517f916b222fdd7c03ad5b2bbfac1cd14572497469751cd2

      Download Submit

    • \??\Volume{d05cfc4a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{88655ec3-e2fc-4e7a-8a9a-b6f5b9caeae7}_OnDiskSnapshotProp
      MD5

      92fdc7d5beff03811dd529c8db06fe09

      SHA1

      afc0a4b6e48995af2aaee6f6f6581580c74bccc6

      SHA256

      62c61c5d6482922fe1e612705b30d6e310a97eaf4646c05c2127c5628c7f0e0a

      SHA512

      a19431b64502a3ac0f2d190053ddbd496cba9b6190ac463384ee724685f1e1f7e2f004a1217a5aafcc64123762612899ba6892a5af5586040fc1e2749cb486a4

      Download Submit

    • memory/1536-118-0x0000000000000000-mapping.dmp

      Download

    • memory/2104-120-0x0000000000000000-mapping.dmp

      Download

    • memory/2504-125-0x0000000000000000-mapping.dmp

      Download

    • memory/2884-126-0x0000000000000000-mapping.dmp

      Download