Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
22/11/2021, 07:55
Static task
static1
Behavioral task
behavioral1
Sample
ee408fa74fbfe568a05b0bbeff2e4339.msi
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee408fa74fbfe568a05b0bbeff2e4339.msi
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
ee408fa74fbfe568a05b0bbeff2e4339.msi
-
Size
4.0MB
-
MD5
ee408fa74fbfe568a05b0bbeff2e4339
-
SHA1
0e8e7da9769102123a1bd8ad0d22e48338d20495
-
SHA256
abe6b696965b8e856ccb20587f8a2fc8327169557e0083cebeab58e14a9d0560
-
SHA512
290d475b870da3d3e436d67b6aed192e1f68be592ee2b9eb70b2731596c8ce13be7c0bfd0192d63b57d4d103cca4f5a6d781ccf8dba17234f73c247de21162ac
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 836 MsiExec.exe -
Loads dropped DLL 3 IoCs
pid Process 836 MsiExec.exe 836 MsiExec.exe 836 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Installer\f75b683.msi msiexec.exe File opened for modification C:\Windows\Installer\f75b683.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB6E1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB81A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB878.tmp msiexec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeSecurityPrivilege 1104 msiexec.exe Token: SeCreateTokenPrivilege 768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 768 msiexec.exe Token: SeLockMemoryPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeMachineAccountPrivilege 768 msiexec.exe Token: SeTcbPrivilege 768 msiexec.exe Token: SeSecurityPrivilege 768 msiexec.exe Token: SeTakeOwnershipPrivilege 768 msiexec.exe Token: SeLoadDriverPrivilege 768 msiexec.exe Token: SeSystemProfilePrivilege 768 msiexec.exe Token: SeSystemtimePrivilege 768 msiexec.exe Token: SeProfSingleProcessPrivilege 768 msiexec.exe Token: SeIncBasePriorityPrivilege 768 msiexec.exe Token: SeCreatePagefilePrivilege 768 msiexec.exe Token: SeCreatePermanentPrivilege 768 msiexec.exe Token: SeBackupPrivilege 768 msiexec.exe Token: SeRestorePrivilege 768 msiexec.exe Token: SeShutdownPrivilege 768 msiexec.exe Token: SeDebugPrivilege 768 msiexec.exe Token: SeAuditPrivilege 768 msiexec.exe Token: SeSystemEnvironmentPrivilege 768 msiexec.exe Token: SeChangeNotifyPrivilege 768 msiexec.exe Token: SeRemoteShutdownPrivilege 768 msiexec.exe Token: SeUndockPrivilege 768 msiexec.exe Token: SeSyncAgentPrivilege 768 msiexec.exe Token: SeEnableDelegationPrivilege 768 msiexec.exe Token: SeManageVolumePrivilege 768 msiexec.exe Token: SeImpersonatePrivilege 768 msiexec.exe Token: SeCreateGlobalPrivilege 768 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 768 msiexec.exe 768 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ee408fa74fbfe568a05b0bbeff2e4339.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:768
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A551B1154E189681CFA4DCC7C2271C292⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:836
-