Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
25/10/2021, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
FORM_PIX XJTVCZG.msi
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FORM_PIX XJTVCZG.msi
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
FORM_PIX XJTVCZG.msi
-
Size
953KB
-
MD5
f2836216ca554dfdc8a300decb644911
-
SHA1
338829d2c88f430b0d00bfb03ad8a43649b4e1d8
-
SHA256
951c2f341e914601140aa9ead05895f6957d5cbfda80b81be99015d2be02d44f
-
SHA512
02148775c5db048566d0fb73e7d8da06597362a31934907ce356238bc1aa8ab4b319094d16d2a5881bf9b6797fde023c42a76846448a5436f4b72f067a668b1c
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 17 3232 MsiExec.exe 19 3232 MsiExec.exe -
Loads dropped DLL 6 IoCs
pid Process 3232 MsiExec.exe 3232 MsiExec.exe 3232 MsiExec.exe 3232 MsiExec.exe 3232 MsiExec.exe 3232 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA1A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\f759730.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9B28.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9F82.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9CA1.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1ABFB032-BECF-43CC-B18E-59968A7D23D2} msiexec.exe File opened for modification C:\Windows\Installer\MSI9F23.tmp msiexec.exe File created C:\Windows\Installer\f759730.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI97AD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B78.tmp msiexec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2940 msiexec.exe 2940 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 4040 msiexec.exe Token: SeIncreaseQuotaPrivilege 4040 msiexec.exe Token: SeSecurityPrivilege 2940 msiexec.exe Token: SeCreateTokenPrivilege 4040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4040 msiexec.exe Token: SeLockMemoryPrivilege 4040 msiexec.exe Token: SeIncreaseQuotaPrivilege 4040 msiexec.exe Token: SeMachineAccountPrivilege 4040 msiexec.exe Token: SeTcbPrivilege 4040 msiexec.exe Token: SeSecurityPrivilege 4040 msiexec.exe Token: SeTakeOwnershipPrivilege 4040 msiexec.exe Token: SeLoadDriverPrivilege 4040 msiexec.exe Token: SeSystemProfilePrivilege 4040 msiexec.exe Token: SeSystemtimePrivilege 4040 msiexec.exe Token: SeProfSingleProcessPrivilege 4040 msiexec.exe Token: SeIncBasePriorityPrivilege 4040 msiexec.exe Token: SeCreatePagefilePrivilege 4040 msiexec.exe Token: SeCreatePermanentPrivilege 4040 msiexec.exe Token: SeBackupPrivilege 4040 msiexec.exe Token: SeRestorePrivilege 4040 msiexec.exe Token: SeShutdownPrivilege 4040 msiexec.exe Token: SeDebugPrivilege 4040 msiexec.exe Token: SeAuditPrivilege 4040 msiexec.exe Token: SeSystemEnvironmentPrivilege 4040 msiexec.exe Token: SeChangeNotifyPrivilege 4040 msiexec.exe Token: SeRemoteShutdownPrivilege 4040 msiexec.exe Token: SeUndockPrivilege 4040 msiexec.exe Token: SeSyncAgentPrivilege 4040 msiexec.exe Token: SeEnableDelegationPrivilege 4040 msiexec.exe Token: SeManageVolumePrivilege 4040 msiexec.exe Token: SeImpersonatePrivilege 4040 msiexec.exe Token: SeCreateGlobalPrivilege 4040 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4040 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2940 wrote to memory of 3232 2940 msiexec.exe 70 PID 2940 wrote to memory of 3232 2940 msiexec.exe 70 PID 2940 wrote to memory of 3232 2940 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\FORM_PIX XJTVCZG.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4040
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C75F255D415FF83D03C9D3E068B202912⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3232
-