Analysis
- max time kernel
152s - max time network
162s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/10/2021, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
c4014e5100cc2d2f126c135d5bc4b0c1.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c4014e5100cc2d2f126c135d5bc4b0c1.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target c4014e5100cc2d2f126c135d5bc4b0c1.msi
- Size 264KB
- Sample211007-t3qbrachfk
- SHA256 2d98f7646e2b5d8ed1ab74c42ba6a5fa1187752c24abff099f4d271cad85829f
- MD5 c4014e5100cc2d2f126c135d5bc4b0c1
- SHA1 c6513e9e49cd1cd587d7a833937f5d56fbe4ced9
- SHA512 0bfd3ec6c017eff571352121f34ee1112aaf587fcdc16f260b8263039f62419bfd547a58ddc0fa3fe2386392b66390281ad0cef4806da10582d78a14fc3c22cc
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 21 3568 MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 1580 iXNfl.exe - Loads dropped DLL 6 IoCs
pid Process 3568 MsiExec.exe 3568 MsiExec.exe 1580 iXNfl.exe 1580 iXNfl.exe 3624 iexplore.exe 3624 iexplore.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin-_8wMRW9w4vB = "\"C:\\Users\\Admin\\Saved Games\\Admin JeCjy\\iXNfl.exe\"" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{79B78871-5994-4E47-B764-CBA3DD4FBC5E} msiexec.exe File opened for modification C:\Windows\Installer\MSI283.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI75C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7EBC.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\f7474c8.msi msiexec.exe File opened for modification C:\Windows\Installer\f7474c8.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString iexplore.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName iexplore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion iexplore.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\(Padrão) 2 = "iXNfl" iXNfl.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\(Padrão) 3 = "C:\\Users\\Admin\\Saved Games\\Admin JeCjy\\" iXNfl.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4036 msiexec.exe 4036 msiexec.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe 3624 iexplore.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 784 msiexec.exe Token: SeIncreaseQuotaPrivilege 784 msiexec.exe Token: SeSecurityPrivilege 4036 msiexec.exe Token: SeCreateTokenPrivilege 784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 784 msiexec.exe Token: SeLockMemoryPrivilege 784 msiexec.exe Token: SeIncreaseQuotaPrivilege 784 msiexec.exe Token: SeMachineAccountPrivilege 784 msiexec.exe Token: SeTcbPrivilege 784 msiexec.exe Token: SeSecurityPrivilege 784 msiexec.exe Token: SeTakeOwnershipPrivilege 784 msiexec.exe Token: SeLoadDriverPrivilege 784 msiexec.exe Token: SeSystemProfilePrivilege 784 msiexec.exe Token: SeSystemtimePrivilege 784 msiexec.exe Token: SeProfSingleProcessPrivilege 784 msiexec.exe Token: SeIncBasePriorityPrivilege 784 msiexec.exe Token: SeCreatePagefilePrivilege 784 msiexec.exe Token: SeCreatePermanentPrivilege 784 msiexec.exe Token: SeBackupPrivilege 784 msiexec.exe Token: SeRestorePrivilege 784 msiexec.exe Token: SeShutdownPrivilege 784 msiexec.exe Token: SeDebugPrivilege 784 msiexec.exe Token: SeAuditPrivilege 784 msiexec.exe Token: SeSystemEnvironmentPrivilege 784 msiexec.exe Token: SeChangeNotifyPrivilege 784 msiexec.exe Token: SeRemoteShutdownPrivilege 784 msiexec.exe Token: SeUndockPrivilege 784 msiexec.exe Token: SeSyncAgentPrivilege 784 msiexec.exe Token: SeEnableDelegationPrivilege 784 msiexec.exe Token: SeManageVolumePrivilege 784 msiexec.exe Token: SeImpersonatePrivilege 784 msiexec.exe Token: SeCreateGlobalPrivilege 784 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3476 WMIC.exe Token: SeSecurityPrivilege 3476 WMIC.exe Token: SeTakeOwnershipPrivilege 3476 WMIC.exe Token: SeLoadDriverPrivilege 3476 WMIC.exe Token: SeSystemProfilePrivilege 3476 WMIC.exe Token: SeSystemtimePrivilege 3476 WMIC.exe Token: SeProfSingleProcessPrivilege 3476 WMIC.exe Token: SeIncBasePriorityPrivilege 3476 WMIC.exe Token: SeCreatePagefilePrivilege 3476 WMIC.exe Token: SeBackupPrivilege 3476 WMIC.exe Token: SeRestorePrivilege 3476 WMIC.exe Token: SeShutdownPrivilege 3476 WMIC.exe Token: SeDebugPrivilege 3476 WMIC.exe Token: SeSystemEnvironmentPrivilege 3476 WMIC.exe Token: SeRemoteShutdownPrivilege 3476 WMIC.exe Token: SeUndockPrivilege 3476 WMIC.exe Token: SeManageVolumePrivilege 3476 WMIC.exe Token: 33 3476 WMIC.exe Token: 34 3476 WMIC.exe Token: 35 3476 WMIC.exe Token: 36 3476 WMIC.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 784 msiexec.exe 3568 MsiExec.exe 784 msiexec.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4036 wrote to memory of 3568 4036 msiexec.exe 74 PID 4036 wrote to memory of 3568 4036 msiexec.exe 74 PID 4036 wrote to memory of 3568 4036 msiexec.exe 74 PID 3568 wrote to memory of 3476 3568 MsiExec.exe 77 PID 3568 wrote to memory of 3476 3568 MsiExec.exe 77 PID 3568 wrote to memory of 3476 3568 MsiExec.exe 77 PID 1580 wrote to memory of 3624 1580 iXNfl.exe 81 PID 1580 wrote to memory of 3624 1580 iXNfl.exe 81 PID 1580 wrote to memory of 3624 1580 iXNfl.exe 81 PID 1580 wrote to memory of 3624 1580 iXNfl.exe 81
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c4014e5100cc2d2f126c135d5bc4b0c1.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:784
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3C9AE2CC7FD303ABFC0B36CF5B8B2DF12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\Saved Games\Admin JeCjy\iXNfl.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
-
C:\Users\Admin\Saved Games\Admin JeCjy\iXNfl.exe"C:\Users\Admin\Saved Games\Admin JeCjy\iXNfl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files (x86)\Internet explorer\iexplore.exe"C:\Program Files (x86)\Internet explorer\iexplore.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3624
-