Overview
overview
10Static
static
8test/0b627...5b.doc
windows7_x64
10test/0b627...5b.doc
windows10_x64
10test/0dded...66.doc
windows7_x64
10test/0dded...66.doc
windows10_x64
10test/91B5D...9D.msi
windows7_x64
8test/91B5D...9D.msi
windows10_x64
8test/ed01e...aa.exe
windows7_x64
10test/ed01e...aa.exe
windows10_x64
10test/fe9d7...8f.exe
windows7_x64
10test/fe9d7...8f.exe
windows10_x64
10Analysis
-
max time kernel
123s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 10:54
Static task
static1
Behavioral task
behavioral1
Sample
test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral2
Sample
test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral3
Sample
test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral4
Sample
test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral5
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral6
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral7
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral8
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral9
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral10
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10-en-20211014
windows10_x64
General
-
Target
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
-
Size
277KB
-
MD5
91b5db3c0ccbd68bd04c24571e27f99d
-
SHA1
b01cb4fe38315d41fcbe9c6278ebe4574496ab0d
-
SHA256
ec85138598c57c6a6bdb5ed470614f582d3b5a8c6b243eb2f41b9970ea13d130
-
SHA512
9f0b07f961625fcc06ee64fcfe5e35e0d40db81f75c3cbc584434c1925fac241db69cac3c1a1bf329d965a4df9bdaa53c13bb8ea3206e2c9d4facf7f74ba21b7
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 11 1004 MsiExec.exe 22 1568 MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 396 lc3FD4.tmp -
Loads dropped DLL 4 IoCs
pid Process 1568 MsiExec.exe 1568 MsiExec.exe 1568 MsiExec.exe 1568 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f75da92.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI339F.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B7E63CAC-805B-4255-A63C-38D579B3EEAB} msiexec.exe File opened for modification C:\Windows\Installer\MSI446C.tmp msiexec.exe File created C:\Windows\Installer\f75da92.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI3DD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3FA7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI411F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3568 msiexec.exe 3568 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2728 msiexec.exe Token: SeIncreaseQuotaPrivilege 2728 msiexec.exe Token: SeSecurityPrivilege 3568 msiexec.exe Token: SeCreateTokenPrivilege 2728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2728 msiexec.exe Token: SeLockMemoryPrivilege 2728 msiexec.exe Token: SeIncreaseQuotaPrivilege 2728 msiexec.exe Token: SeMachineAccountPrivilege 2728 msiexec.exe Token: SeTcbPrivilege 2728 msiexec.exe Token: SeSecurityPrivilege 2728 msiexec.exe Token: SeTakeOwnershipPrivilege 2728 msiexec.exe Token: SeLoadDriverPrivilege 2728 msiexec.exe Token: SeSystemProfilePrivilege 2728 msiexec.exe Token: SeSystemtimePrivilege 2728 msiexec.exe Token: SeProfSingleProcessPrivilege 2728 msiexec.exe Token: SeIncBasePriorityPrivilege 2728 msiexec.exe Token: SeCreatePagefilePrivilege 2728 msiexec.exe Token: SeCreatePermanentPrivilege 2728 msiexec.exe Token: SeBackupPrivilege 2728 msiexec.exe Token: SeRestorePrivilege 2728 msiexec.exe Token: SeShutdownPrivilege 2728 msiexec.exe Token: SeDebugPrivilege 2728 msiexec.exe Token: SeAuditPrivilege 2728 msiexec.exe Token: SeSystemEnvironmentPrivilege 2728 msiexec.exe Token: SeChangeNotifyPrivilege 2728 msiexec.exe Token: SeRemoteShutdownPrivilege 2728 msiexec.exe Token: SeUndockPrivilege 2728 msiexec.exe Token: SeSyncAgentPrivilege 2728 msiexec.exe Token: SeEnableDelegationPrivilege 2728 msiexec.exe Token: SeManageVolumePrivilege 2728 msiexec.exe Token: SeImpersonatePrivilege 2728 msiexec.exe Token: SeCreateGlobalPrivilege 2728 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2728 msiexec.exe 2728 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3568 wrote to memory of 1004 3568 msiexec.exe 70 PID 3568 wrote to memory of 1004 3568 msiexec.exe 70 PID 3568 wrote to memory of 1568 3568 msiexec.exe 71 PID 3568 wrote to memory of 1568 3568 msiexec.exe 71 PID 3568 wrote to memory of 1568 3568 msiexec.exe 71 PID 1568 wrote to memory of 396 1568 MsiExec.exe 72 PID 1568 wrote to memory of 396 1568 MsiExec.exe 72 PID 1568 wrote to memory of 396 1568 MsiExec.exe 72
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\test\91B5DB3C0CCBD68BD04C24571E27F99D.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2728
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F45821C4D8FDE26E779C4EA214E6E9A72⤵
- Blocklisted process makes network request
PID:1004
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DFA90C283399FA53117D8E2558249852⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\lc3FD4.tmp"C:\Users\Admin\AppData\Local\Temp\lc3FD4.tmp"3⤵
- Executes dropped EXE
PID:396
-
-