Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
23-11-2021 13:27
Static task
static1
Behavioral task
behavioral1
Sample
Proc.Eeletronico80rdgkj4 qoz4br.msi
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Proc.Eeletronico80rdgkj4 qoz4br.msi
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
Proc.Eeletronico80rdgkj4 qoz4br.msi
-
Size
4.0MB
-
MD5
1321ee6809d5368dc9ec125e04bc4cf8
-
SHA1
f1c0503e18eba4af77c5e637b38f2cf323e6c2bc
-
SHA256
c8c447eabc388282ef6ee8678cce4aa65557bf557a936109485648fd217baae8
-
SHA512
c348633687ec45a8c6a82fb7339ceb54bcc7c7448108841d4c4aa54ab15de582dd4b2b981ce76c743dd6d3f5ceaf96491cf2a9065df3439aafd33d1398900597
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 540 MsiExec.exe -
Loads dropped DLL 3 IoCs
pid Process 540 MsiExec.exe 540 MsiExec.exe 540 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBCD9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBFE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC0B2.tmp msiexec.exe File created C:\Windows\Installer\f75bba1.msi msiexec.exe File opened for modification C:\Windows\Installer\f75bba1.msi msiexec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 2032 msiexec.exe Token: SeIncreaseQuotaPrivilege 2032 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeSecurityPrivilege 980 msiexec.exe Token: SeCreateTokenPrivilege 2032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2032 msiexec.exe Token: SeLockMemoryPrivilege 2032 msiexec.exe Token: SeIncreaseQuotaPrivilege 2032 msiexec.exe Token: SeMachineAccountPrivilege 2032 msiexec.exe Token: SeTcbPrivilege 2032 msiexec.exe Token: SeSecurityPrivilege 2032 msiexec.exe Token: SeTakeOwnershipPrivilege 2032 msiexec.exe Token: SeLoadDriverPrivilege 2032 msiexec.exe Token: SeSystemProfilePrivilege 2032 msiexec.exe Token: SeSystemtimePrivilege 2032 msiexec.exe Token: SeProfSingleProcessPrivilege 2032 msiexec.exe Token: SeIncBasePriorityPrivilege 2032 msiexec.exe Token: SeCreatePagefilePrivilege 2032 msiexec.exe Token: SeCreatePermanentPrivilege 2032 msiexec.exe Token: SeBackupPrivilege 2032 msiexec.exe Token: SeRestorePrivilege 2032 msiexec.exe Token: SeShutdownPrivilege 2032 msiexec.exe Token: SeDebugPrivilege 2032 msiexec.exe Token: SeAuditPrivilege 2032 msiexec.exe Token: SeSystemEnvironmentPrivilege 2032 msiexec.exe Token: SeChangeNotifyPrivilege 2032 msiexec.exe Token: SeRemoteShutdownPrivilege 2032 msiexec.exe Token: SeUndockPrivilege 2032 msiexec.exe Token: SeSyncAgentPrivilege 2032 msiexec.exe Token: SeEnableDelegationPrivilege 2032 msiexec.exe Token: SeManageVolumePrivilege 2032 msiexec.exe Token: SeImpersonatePrivilege 2032 msiexec.exe Token: SeCreateGlobalPrivilege 2032 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2032 msiexec.exe 2032 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 980 wrote to memory of 540 980 msiexec.exe 29 PID 980 wrote to memory of 540 980 msiexec.exe 29 PID 980 wrote to memory of 540 980 msiexec.exe 29 PID 980 wrote to memory of 540 980 msiexec.exe 29 PID 980 wrote to memory of 540 980 msiexec.exe 29 PID 980 wrote to memory of 540 980 msiexec.exe 29 PID 980 wrote to memory of 540 980 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Proc.Eeletronico80rdgkj4 qoz4br.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2032
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85E9CFE13329B663F4D0B2039FA018A12⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:540
-