Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
02-12-2021 23:27
Static task
static1
Behavioral task
behavioral1
Sample
DOC#848#158945.msi
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral2
Sample
DOC#848#158945.msi
Resource
win10-en-20211014
windows10_x64
General
-
Target
DOC#848#158945.msi
-
Size
264KB
-
MD5
c5b778c6e4b1410a079457c50193a0d5
-
SHA1
6abd263dbc4487e80db003eaf66f1843792eab0b
-
SHA256
50356478881e585ac8020c4e471f7494aef7cebae0bc2b98b6c106fd3b6c5ddf
-
SHA512
2a6e412743f2b35f73e74a4846130a2ac0703ee479d76e4132bd2b1f2c5a12b000aafccb40a2015543d5e58cf7dad1f707ac99b260aa43fa16939d3022eba6fe
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
MsiExec.exeflow pid Process 3 540 MsiExec.exe -
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 540 MsiExec.exe 540 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Drops file in Windows directory 4 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Windows\Installer\f75b876.msi msiexec.exe File opened for modification C:\Windows\Installer\f75b876.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB9DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBD76.tmp msiexec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 1588 msiexec.exe Token: SeIncreaseQuotaPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeSecurityPrivilege 1656 msiexec.exe Token: SeCreateTokenPrivilege 1588 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1588 msiexec.exe Token: SeLockMemoryPrivilege 1588 msiexec.exe Token: SeIncreaseQuotaPrivilege 1588 msiexec.exe Token: SeMachineAccountPrivilege 1588 msiexec.exe Token: SeTcbPrivilege 1588 msiexec.exe Token: SeSecurityPrivilege 1588 msiexec.exe Token: SeTakeOwnershipPrivilege 1588 msiexec.exe Token: SeLoadDriverPrivilege 1588 msiexec.exe Token: SeSystemProfilePrivilege 1588 msiexec.exe Token: SeSystemtimePrivilege 1588 msiexec.exe Token: SeProfSingleProcessPrivilege 1588 msiexec.exe Token: SeIncBasePriorityPrivilege 1588 msiexec.exe Token: SeCreatePagefilePrivilege 1588 msiexec.exe Token: SeCreatePermanentPrivilege 1588 msiexec.exe Token: SeBackupPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1588 msiexec.exe Token: SeShutdownPrivilege 1588 msiexec.exe Token: SeDebugPrivilege 1588 msiexec.exe Token: SeAuditPrivilege 1588 msiexec.exe Token: SeSystemEnvironmentPrivilege 1588 msiexec.exe Token: SeChangeNotifyPrivilege 1588 msiexec.exe Token: SeRemoteShutdownPrivilege 1588 msiexec.exe Token: SeUndockPrivilege 1588 msiexec.exe Token: SeSyncAgentPrivilege 1588 msiexec.exe Token: SeEnableDelegationPrivilege 1588 msiexec.exe Token: SeManageVolumePrivilege 1588 msiexec.exe Token: SeImpersonatePrivilege 1588 msiexec.exe Token: SeCreateGlobalPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 1588 msiexec.exe 1588 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 1656 wrote to memory of 540 1656 msiexec.exe 29 PID 1656 wrote to memory of 540 1656 msiexec.exe 29 PID 1656 wrote to memory of 540 1656 msiexec.exe 29 PID 1656 wrote to memory of 540 1656 msiexec.exe 29 PID 1656 wrote to memory of 540 1656 msiexec.exe 29 PID 1656 wrote to memory of 540 1656 msiexec.exe 29 PID 1656 wrote to memory of 540 1656 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DOC#848#158945.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1588
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DBB17D4EB7FC33E10EAAA5F3B68917712⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:540
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b