Overview

overview

8

Static

static

634141ba2a...c6.msi

windows7_x64

8

634141ba2a...c6.msi

windows10_x64

8

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    25-11-2021 16:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    634141ba2a59b2474677ce121e65d8c6.msi

  • Size

    2.9MB

  • MD5

    634141ba2a59b2474677ce121e65d8c6

  • SHA1

    9fd4068c432e354d2e2c67c96f84ce96abe2406e

  • SHA256

    67525ed96e0f69af2de778ad3679ba45b620b8f80b45d46035c7fde19eab9648

  • SHA512

    32e0e1a28c645563d5500e05a7cdc3131f9c845fa7e55da716d53347cd99839a54fdb66ac3b43e851901edf77a318a3329a7b2c60e6eeb5f2ccfc75c6f8df087

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\634141ba2a59b2474677ce121e65d8c6.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2896
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E66819E0C1A2F728EF04EC88A5975EBF
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C start /MIN https://paulosantanna.com/2021/01/27/ambientes-legados-erro-codigo-80072efe-no-windows-update-em-pc-com-windows-7/
        3⤵
        • Checks computer location settings
        PID:2268
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4032
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3904
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2552
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3780
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1736
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4148
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI5cbdc.LOG
    MD5

    b877057473b8766a8b8ff76c3bb798ed

    SHA1

    aa443e3db3e7ed27860d6cb31ecd8aad5499943a

    SHA256

    458191623231e42599bb049b877a8c8263187f31916e2e8f0c65c413081a5882

    SHA512

    feb1a6657f019c4a604101770ec86f7b5b9c84e2fcfaa9a887c7696243d160938d1bc251c6b3ca1ec9dca8f2b01716cfa8ec5b140a1d6deecebf0f12960274bb

    Download Submit
  • C:\Windows\Installer\MSIE5BD.tmp
    MD5

    5c5bef05b6f3806106f8f3ce13401cc1

    SHA1

    6005fbe17f6e917ac45317552409d7a60976db14

    SHA256

    f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

    SHA512

    97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

    Download Submit
  • \Windows\Installer\MSIE5BD.tmp
    MD5

    5c5bef05b6f3806106f8f3ce13401cc1

    SHA1

    6005fbe17f6e917ac45317552409d7a60976db14

    SHA256

    f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

    SHA512

    97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

    Download Submit
  • memory/1184-120-0x0000000000000000-mapping.dmp
    Download
  • memory/1184-121-0x0000000000020000-0x0000000000021000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1184-122-0x0000000000020000-0x0000000000021000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2268-125-0x0000000000000000-mapping.dmp
    Download
  • memory/2704-117-0x0000012F1DFF0000-0x0000012F1DFF2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2704-118-0x0000012F1DFF0000-0x0000012F1DFF2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2896-115-0x0000012B0FC40000-0x0000012B0FC42000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2896-116-0x0000012B0FC40000-0x0000012B0FC42000-memory.dmp
    Filesize

    8KB

    Download