Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02/12/2021, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
DOC#848#158945.msi
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DOC#848#158945.msi
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
DOC#848#158945.msi
-
Size
264KB
-
MD5
c5b778c6e4b1410a079457c50193a0d5
-
SHA1
6abd263dbc4487e80db003eaf66f1843792eab0b
-
SHA256
50356478881e585ac8020c4e471f7494aef7cebae0bc2b98b6c106fd3b6c5ddf
-
SHA512
2a6e412743f2b35f73e74a4846130a2ac0703ee479d76e4132bd2b1f2c5a12b000aafccb40a2015543d5e58cf7dad1f707ac99b260aa43fa16939d3022eba6fe
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 9 3488 MsiExec.exe -
Loads dropped DLL 2 IoCs
pid Process 3488 MsiExec.exe 3488 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Installer\f75e204.msi msiexec.exe File opened for modification C:\Windows\Installer\f75e204.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE32D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEAB0.tmp msiexec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 3456 msiexec.exe Token: SeIncreaseQuotaPrivilege 3456 msiexec.exe Token: SeSecurityPrivilege 1152 msiexec.exe Token: SeCreateTokenPrivilege 3456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3456 msiexec.exe Token: SeLockMemoryPrivilege 3456 msiexec.exe Token: SeIncreaseQuotaPrivilege 3456 msiexec.exe Token: SeMachineAccountPrivilege 3456 msiexec.exe Token: SeTcbPrivilege 3456 msiexec.exe Token: SeSecurityPrivilege 3456 msiexec.exe Token: SeTakeOwnershipPrivilege 3456 msiexec.exe Token: SeLoadDriverPrivilege 3456 msiexec.exe Token: SeSystemProfilePrivilege 3456 msiexec.exe Token: SeSystemtimePrivilege 3456 msiexec.exe Token: SeProfSingleProcessPrivilege 3456 msiexec.exe Token: SeIncBasePriorityPrivilege 3456 msiexec.exe Token: SeCreatePagefilePrivilege 3456 msiexec.exe Token: SeCreatePermanentPrivilege 3456 msiexec.exe Token: SeBackupPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 3456 msiexec.exe Token: SeShutdownPrivilege 3456 msiexec.exe Token: SeDebugPrivilege 3456 msiexec.exe Token: SeAuditPrivilege 3456 msiexec.exe Token: SeSystemEnvironmentPrivilege 3456 msiexec.exe Token: SeChangeNotifyPrivilege 3456 msiexec.exe Token: SeRemoteShutdownPrivilege 3456 msiexec.exe Token: SeUndockPrivilege 3456 msiexec.exe Token: SeSyncAgentPrivilege 3456 msiexec.exe Token: SeEnableDelegationPrivilege 3456 msiexec.exe Token: SeManageVolumePrivilege 3456 msiexec.exe Token: SeImpersonatePrivilege 3456 msiexec.exe Token: SeCreateGlobalPrivilege 3456 msiexec.exe Token: SeRestorePrivilege 1152 msiexec.exe Token: SeTakeOwnershipPrivilege 1152 msiexec.exe Token: SeRestorePrivilege 1152 msiexec.exe Token: SeTakeOwnershipPrivilege 1152 msiexec.exe Token: SeRestorePrivilege 1152 msiexec.exe Token: SeTakeOwnershipPrivilege 1152 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3456 msiexec.exe 3456 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1152 wrote to memory of 3488 1152 msiexec.exe 70 PID 1152 wrote to memory of 3488 1152 msiexec.exe 70 PID 1152 wrote to memory of 3488 1152 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DOC#848#158945.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3456
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F816B7311D6123A3CE3BA33EAEA3E2642⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3488
-