Analysis
- max time kernel
124s - max time network
148s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
02/12/2021, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
106-48.SNA.BN.oe.msi
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
106-48.SNA.BN.oe.msi
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target 106-48.SNA.BN.oe.msi
- Size 5.9MB
- Sample211202-q3jmeshcam
- SHA256 d21c1da1101725eed36089c6839542fc615a602ce9db273d3930dfd3ca28db4e
- MD5 4c65b4849f8dbf863361c6dc27d64f1a
- SHA1 bd32bf2fa72225182c15bd3e4aa2aa3f9346a821
- SHA512 afc5cc5779bda4c0e82c6f3272254b305fd57bcb3ef5fca512ef336a5c7cb666ec75f614553efaa96d892436d29cd67ee8f701e97ac747830fb918caaa6131e5
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 8 424 MsiExec.exe - Loads dropped DLL 7 IoCs
pid Process 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI589C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5EA8.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7A72.tmp msiexec.exe File created C:\Windows\Installer\f7610c5.msi msiexec.exe File opened for modification C:\Windows\Installer\f7610c5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI1624.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI60AD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6225.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{1269AE81-54D3-488C-96A1-960F85ECFC92} msiexec.exe File opened for modification C:\Windows\Installer\MSI7792.tmp msiexec.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3568 424 WerFault.exe 70 - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1220 msiexec.exe 1220 msiexec.exe 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe 424 MsiExec.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe 3568 WerFault.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 2628 msiexec.exe Token: SeIncreaseQuotaPrivilege 2628 msiexec.exe Token: SeSecurityPrivilege 1220 msiexec.exe Token: SeCreateTokenPrivilege 2628 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2628 msiexec.exe Token: SeLockMemoryPrivilege 2628 msiexec.exe Token: SeIncreaseQuotaPrivilege 2628 msiexec.exe Token: SeMachineAccountPrivilege 2628 msiexec.exe Token: SeTcbPrivilege 2628 msiexec.exe Token: SeSecurityPrivilege 2628 msiexec.exe Token: SeTakeOwnershipPrivilege 2628 msiexec.exe Token: SeLoadDriverPrivilege 2628 msiexec.exe Token: SeSystemProfilePrivilege 2628 msiexec.exe Token: SeSystemtimePrivilege 2628 msiexec.exe Token: SeProfSingleProcessPrivilege 2628 msiexec.exe Token: SeIncBasePriorityPrivilege 2628 msiexec.exe Token: SeCreatePagefilePrivilege 2628 msiexec.exe Token: SeCreatePermanentPrivilege 2628 msiexec.exe Token: SeBackupPrivilege 2628 msiexec.exe Token: SeRestorePrivilege 2628 msiexec.exe Token: SeShutdownPrivilege 2628 msiexec.exe Token: SeDebugPrivilege 2628 msiexec.exe Token: SeAuditPrivilege 2628 msiexec.exe Token: SeSystemEnvironmentPrivilege 2628 msiexec.exe Token: SeChangeNotifyPrivilege 2628 msiexec.exe Token: SeRemoteShutdownPrivilege 2628 msiexec.exe Token: SeUndockPrivilege 2628 msiexec.exe Token: SeSyncAgentPrivilege 2628 msiexec.exe Token: SeEnableDelegationPrivilege 2628 msiexec.exe Token: SeManageVolumePrivilege 2628 msiexec.exe Token: SeImpersonatePrivilege 2628 msiexec.exe Token: SeCreateGlobalPrivilege 2628 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 3568 WerFault.exe Token: SeBackupPrivilege 3568 WerFault.exe Token: SeDebugPrivilege 3568 WerFault.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2628 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1220 wrote to memory of 424 1220 msiexec.exe 70 PID 1220 wrote to memory of 424 1220 msiexec.exe 70 PID 1220 wrote to memory of 424 1220 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\106-48.SNA.BN.oe.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 465DAED30B179CAD4BC5DA8A312CA86E2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 1843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-