Analysis
- max time kernel
123s - max time network
121s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
08/10/2021, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
a33eac573d7e3e71a2b6729769bd117f.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a33eac573d7e3e71a2b6729769bd117f.msi
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target a33eac573d7e3e71a2b6729769bd117f.msi
- Size 264KB
- Sample211008-e8th2adbf9
- SHA256 5ae1647516e23de4444c2bc2b04e1357f02c572421ecfefc82f3c2222c3ee5b4
- MD5 a33eac573d7e3e71a2b6729769bd117f
- SHA1 24a6a3dde4541f00cddd5e08cd9c0f7859ffadab
- SHA512 24523aa85a1e8df3455962b9c250508a74084f7460c15916d140fb716425305cf054dea76eabc5efb8b83d2d8b0996eb05d46a69ad321cd5077cf8d773cd8157
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 17 1208 MsiExec.exe - Loads dropped DLL 2 IoCs
pid Process 1208 MsiExec.exe 1208 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f75ac1f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAD38.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB4BB.tmp msiexec.exe File created C:\Windows\Installer\f75ac1f.msi msiexec.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 3144 msiexec.exe Token: SeIncreaseQuotaPrivilege 3144 msiexec.exe Token: SeSecurityPrivilege 3896 msiexec.exe Token: SeCreateTokenPrivilege 3144 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3144 msiexec.exe Token: SeLockMemoryPrivilege 3144 msiexec.exe Token: SeIncreaseQuotaPrivilege 3144 msiexec.exe Token: SeMachineAccountPrivilege 3144 msiexec.exe Token: SeTcbPrivilege 3144 msiexec.exe Token: SeSecurityPrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeLoadDriverPrivilege 3144 msiexec.exe Token: SeSystemProfilePrivilege 3144 msiexec.exe Token: SeSystemtimePrivilege 3144 msiexec.exe Token: SeProfSingleProcessPrivilege 3144 msiexec.exe Token: SeIncBasePriorityPrivilege 3144 msiexec.exe Token: SeCreatePagefilePrivilege 3144 msiexec.exe Token: SeCreatePermanentPrivilege 3144 msiexec.exe Token: SeBackupPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeShutdownPrivilege 3144 msiexec.exe Token: SeDebugPrivilege 3144 msiexec.exe Token: SeAuditPrivilege 3144 msiexec.exe Token: SeSystemEnvironmentPrivilege 3144 msiexec.exe Token: SeChangeNotifyPrivilege 3144 msiexec.exe Token: SeRemoteShutdownPrivilege 3144 msiexec.exe Token: SeUndockPrivilege 3144 msiexec.exe Token: SeSyncAgentPrivilege 3144 msiexec.exe Token: SeEnableDelegationPrivilege 3144 msiexec.exe Token: SeManageVolumePrivilege 3144 msiexec.exe Token: SeImpersonatePrivilege 3144 msiexec.exe Token: SeCreateGlobalPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3144 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3896 wrote to memory of 1208 3896 msiexec.exe 72 PID 3896 wrote to memory of 1208 3896 msiexec.exe 72 PID 3896 wrote to memory of 1208 3896 msiexec.exe 72
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a33eac573d7e3e71a2b6729769bd117f.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3144
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8E105E6F6F03DF954C79230DFA210E5E2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1208
-