Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22/10/2021, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
ed3edf8fdb2cd2f027127f4fb1fe7019.msi
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ed3edf8fdb2cd2f027127f4fb1fe7019.msi
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
ed3edf8fdb2cd2f027127f4fb1fe7019.msi
-
Size
264KB
-
MD5
ed3edf8fdb2cd2f027127f4fb1fe7019
-
SHA1
e876622ade868b5c8461b80a9b8e4961e9427b2e
-
SHA256
ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3
-
SHA512
051d9ff3bc18233ee3174113b566a1bbd653588b9070563f9627c51315cd0e39bc6151a92f5df91cc8c809cd021ae79ab43ac0b88013930f7da7864c68a10d42
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 15 1160 MsiExec.exe -
Loads dropped DLL 2 IoCs
pid Process 1160 MsiExec.exe 1160 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Installer\f75dcd4.msi msiexec.exe File opened for modification C:\Windows\Installer\f75dcd4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIDD32.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDFA4.tmp msiexec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeSecurityPrivilege 1604 msiexec.exe Token: SeCreateTokenPrivilege 2044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2044 msiexec.exe Token: SeLockMemoryPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeMachineAccountPrivilege 2044 msiexec.exe Token: SeTcbPrivilege 2044 msiexec.exe Token: SeSecurityPrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeLoadDriverPrivilege 2044 msiexec.exe Token: SeSystemProfilePrivilege 2044 msiexec.exe Token: SeSystemtimePrivilege 2044 msiexec.exe Token: SeProfSingleProcessPrivilege 2044 msiexec.exe Token: SeIncBasePriorityPrivilege 2044 msiexec.exe Token: SeCreatePagefilePrivilege 2044 msiexec.exe Token: SeCreatePermanentPrivilege 2044 msiexec.exe Token: SeBackupPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeDebugPrivilege 2044 msiexec.exe Token: SeAuditPrivilege 2044 msiexec.exe Token: SeSystemEnvironmentPrivilege 2044 msiexec.exe Token: SeChangeNotifyPrivilege 2044 msiexec.exe Token: SeRemoteShutdownPrivilege 2044 msiexec.exe Token: SeUndockPrivilege 2044 msiexec.exe Token: SeSyncAgentPrivilege 2044 msiexec.exe Token: SeEnableDelegationPrivilege 2044 msiexec.exe Token: SeManageVolumePrivilege 2044 msiexec.exe Token: SeImpersonatePrivilege 2044 msiexec.exe Token: SeCreateGlobalPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 1604 msiexec.exe Token: SeTakeOwnershipPrivilege 1604 msiexec.exe Token: SeRestorePrivilege 1604 msiexec.exe Token: SeTakeOwnershipPrivilege 1604 msiexec.exe Token: SeRestorePrivilege 1604 msiexec.exe Token: SeTakeOwnershipPrivilege 1604 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2044 msiexec.exe 2044 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1604 wrote to memory of 1160 1604 msiexec.exe 71 PID 1604 wrote to memory of 1160 1604 msiexec.exe 71 PID 1604 wrote to memory of 1160 1604 msiexec.exe 71
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ed3edf8fdb2cd2f027127f4fb1fe7019.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47A4CDF4074D42F1FB7E6C92AC0211012⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1160
-