Analysis
- max time kernel
130s - max time network
139s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/10/2021, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
9774f27d6d24e923fc427ffa1a13b843.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9774f27d6d24e923fc427ffa1a13b843.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 9774f27d6d24e923fc427ffa1a13b843.msi
- Size 264KB
- Sample211005-tpm98saag9
- SHA256 8b906b8a552f85d6d5cc79f2416adec2cb935607b4ab27636f23cddd53320cf4
- MD5 9774f27d6d24e923fc427ffa1a13b843
- SHA1 23038588cbaeec99dffca57bd16612032dad31c8
- SHA512 163c1834dec401a658de4066206d0f658b1f63ae4ca537ceae51bf7472c7cd5321249661e0ff1c1f326309f6e5c952a763a0592c7c6b8eabb66b909a1f7032f3
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 2 3012 MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 2824 NRfho.exe - Loads dropped DLL 6 IoCs
pid Process 3012 MsiExec.exe 3012 MsiExec.exe 2824 NRfho.exe 2824 NRfho.exe 2908 iexplore.exe 2908 iexplore.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin-_YY6cu = "\"C:\\Users\\Admin\\Saved Games\\Admin OaBYz\\NRfho.exe\"" iexplore.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\14e98.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIE442.tmp msiexec.exe File opened for modification C:\Windows\Installer\14e98.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4FC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5D10.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{873CE769-E2A7-46DE-971D-73451437AD62} msiexec.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString iexplore.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 iexplore.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion iexplore.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\(Padrão) 3 = "C:\\Users\\Admin\\Saved Games\\Admin OaBYz\\" NRfho.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\(Padrão) 2 = "NRfho" NRfho.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 msiexec.exe 1768 msiexec.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe 2908 iexplore.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4044 msiexec.exe Token: SeIncreaseQuotaPrivilege 4044 msiexec.exe Token: SeSecurityPrivilege 1768 msiexec.exe Token: SeCreateTokenPrivilege 4044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4044 msiexec.exe Token: SeLockMemoryPrivilege 4044 msiexec.exe Token: SeIncreaseQuotaPrivilege 4044 msiexec.exe Token: SeMachineAccountPrivilege 4044 msiexec.exe Token: SeTcbPrivilege 4044 msiexec.exe Token: SeSecurityPrivilege 4044 msiexec.exe Token: SeTakeOwnershipPrivilege 4044 msiexec.exe Token: SeLoadDriverPrivilege 4044 msiexec.exe Token: SeSystemProfilePrivilege 4044 msiexec.exe Token: SeSystemtimePrivilege 4044 msiexec.exe Token: SeProfSingleProcessPrivilege 4044 msiexec.exe Token: SeIncBasePriorityPrivilege 4044 msiexec.exe Token: SeCreatePagefilePrivilege 4044 msiexec.exe Token: SeCreatePermanentPrivilege 4044 msiexec.exe Token: SeBackupPrivilege 4044 msiexec.exe Token: SeRestorePrivilege 4044 msiexec.exe Token: SeShutdownPrivilege 4044 msiexec.exe Token: SeDebugPrivilege 4044 msiexec.exe Token: SeAuditPrivilege 4044 msiexec.exe Token: SeSystemEnvironmentPrivilege 4044 msiexec.exe Token: SeChangeNotifyPrivilege 4044 msiexec.exe Token: SeRemoteShutdownPrivilege 4044 msiexec.exe Token: SeUndockPrivilege 4044 msiexec.exe Token: SeSyncAgentPrivilege 4044 msiexec.exe Token: SeEnableDelegationPrivilege 4044 msiexec.exe Token: SeManageVolumePrivilege 4044 msiexec.exe Token: SeImpersonatePrivilege 4044 msiexec.exe Token: SeCreateGlobalPrivilege 4044 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeIncreaseQuotaPrivilege 1616 WMIC.exe Token: SeSecurityPrivilege 1616 WMIC.exe Token: SeTakeOwnershipPrivilege 1616 WMIC.exe Token: SeLoadDriverPrivilege 1616 WMIC.exe Token: SeSystemProfilePrivilege 1616 WMIC.exe Token: SeSystemtimePrivilege 1616 WMIC.exe Token: SeProfSingleProcessPrivilege 1616 WMIC.exe Token: SeIncBasePriorityPrivilege 1616 WMIC.exe Token: SeCreatePagefilePrivilege 1616 WMIC.exe Token: SeBackupPrivilege 1616 WMIC.exe Token: SeRestorePrivilege 1616 WMIC.exe Token: SeShutdownPrivilege 1616 WMIC.exe Token: SeDebugPrivilege 1616 WMIC.exe Token: SeSystemEnvironmentPrivilege 1616 WMIC.exe Token: SeRemoteShutdownPrivilege 1616 WMIC.exe Token: SeUndockPrivilege 1616 WMIC.exe Token: SeManageVolumePrivilege 1616 WMIC.exe Token: 33 1616 WMIC.exe Token: 34 1616 WMIC.exe Token: 35 1616 WMIC.exe Token: 36 1616 WMIC.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeIncreaseQuotaPrivilege 1616 WMIC.exe Token: SeSecurityPrivilege 1616 WMIC.exe Token: SeTakeOwnershipPrivilege 1616 WMIC.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4044 msiexec.exe 3012 MsiExec.exe 4044 msiexec.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1768 wrote to memory of 3012 1768 msiexec.exe 70 PID 1768 wrote to memory of 3012 1768 msiexec.exe 70 PID 1768 wrote to memory of 3012 1768 msiexec.exe 70 PID 3012 wrote to memory of 1616 3012 MsiExec.exe 73 PID 3012 wrote to memory of 1616 3012 MsiExec.exe 73 PID 3012 wrote to memory of 1616 3012 MsiExec.exe 73 PID 2824 wrote to memory of 2908 2824 NRfho.exe 76 PID 2824 wrote to memory of 2908 2824 NRfho.exe 76 PID 2824 wrote to memory of 2908 2824 NRfho.exe 76 PID 2824 wrote to memory of 2908 2824 NRfho.exe 76
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9774f27d6d24e923fc427ffa1a13b843.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A534115D03DF4267724BBA4B03C020D12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\Saved Games\Admin OaBYz\NRfho.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
-
C:\Users\Admin\Saved Games\Admin OaBYz\NRfho.exe"C:\Users\Admin\Saved Games\Admin OaBYz\NRfho.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Internet explorer\iexplore.exe"C:\Program Files (x86)\Internet explorer\iexplore.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2908
-