Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
22-11-2021 07:55
Static task
static1
Behavioral task
behavioral1
Sample
ee408fa74fbfe568a05b0bbeff2e4339.msi
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral2
Sample
ee408fa74fbfe568a05b0bbeff2e4339.msi
Resource
win10-en-20211014
windows10_x64
General
-
Target
ee408fa74fbfe568a05b0bbeff2e4339.msi
-
Size
4.0MB
-
MD5
ee408fa74fbfe568a05b0bbeff2e4339
-
SHA1
0e8e7da9769102123a1bd8ad0d22e48338d20495
-
SHA256
abe6b696965b8e856ccb20587f8a2fc8327169557e0083cebeab58e14a9d0560
-
SHA512
290d475b870da3d3e436d67b6aed192e1f68be592ee2b9eb70b2731596c8ce13be7c0bfd0192d63b57d4d103cca4f5a6d781ccf8dba17234f73c247de21162ac
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
MsiExec.exeflow pid Process 3 836 MsiExec.exe -
Loads dropped DLL 3 IoCs
Processes:
MsiExec.exepid Process 836 MsiExec.exe 836 MsiExec.exe 836 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Windows directory 5 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Windows\Installer\f75b683.msi msiexec.exe File opened for modification C:\Windows\Installer\f75b683.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB6E1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB81A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB878.tmp msiexec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeSecurityPrivilege 1104 msiexec.exe Token: SeCreateTokenPrivilege 768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 768 msiexec.exe Token: SeLockMemoryPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeMachineAccountPrivilege 768 msiexec.exe Token: SeTcbPrivilege 768 msiexec.exe Token: SeSecurityPrivilege 768 msiexec.exe Token: SeTakeOwnershipPrivilege 768 msiexec.exe Token: SeLoadDriverPrivilege 768 msiexec.exe Token: SeSystemProfilePrivilege 768 msiexec.exe Token: SeSystemtimePrivilege 768 msiexec.exe Token: SeProfSingleProcessPrivilege 768 msiexec.exe Token: SeIncBasePriorityPrivilege 768 msiexec.exe Token: SeCreatePagefilePrivilege 768 msiexec.exe Token: SeCreatePermanentPrivilege 768 msiexec.exe Token: SeBackupPrivilege 768 msiexec.exe Token: SeRestorePrivilege 768 msiexec.exe Token: SeShutdownPrivilege 768 msiexec.exe Token: SeDebugPrivilege 768 msiexec.exe Token: SeAuditPrivilege 768 msiexec.exe Token: SeSystemEnvironmentPrivilege 768 msiexec.exe Token: SeChangeNotifyPrivilege 768 msiexec.exe Token: SeRemoteShutdownPrivilege 768 msiexec.exe Token: SeUndockPrivilege 768 msiexec.exe Token: SeSyncAgentPrivilege 768 msiexec.exe Token: SeEnableDelegationPrivilege 768 msiexec.exe Token: SeManageVolumePrivilege 768 msiexec.exe Token: SeImpersonatePrivilege 768 msiexec.exe Token: SeCreateGlobalPrivilege 768 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 768 msiexec.exe 768 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29 PID 1104 wrote to memory of 836 1104 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ee408fa74fbfe568a05b0bbeff2e4339.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:768
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A551B1154E189681CFA4DCC7C2271C292⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:836
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
0872fc86ddb1c0c51beab1deaaa80218
SHA1abe143cfe0053d6e93c042815f020ff4714794bc
SHA25699f2f155dfed73c33416e82ca6cd8f6dc66abbf50513a5e2a857d12e49504c60
SHA5121b15ea0122d5adef9098381a2dc9659257ba13704fc4b51105c535044c94e370b9ea24e70c836e85cd0b4c9cc4dab63522c74af2ab913619984e86c27888a346
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
0872fc86ddb1c0c51beab1deaaa80218
SHA1abe143cfe0053d6e93c042815f020ff4714794bc
SHA25699f2f155dfed73c33416e82ca6cd8f6dc66abbf50513a5e2a857d12e49504c60
SHA5121b15ea0122d5adef9098381a2dc9659257ba13704fc4b51105c535044c94e370b9ea24e70c836e85cd0b4c9cc4dab63522c74af2ab913619984e86c27888a346