Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17/12/2021, 09:43
Static task
static1
Behavioral task
behavioral1
Sample
0329fb0b86a0f542c95c6405d5cb8e78.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0329fb0b86a0f542c95c6405d5cb8e78.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
0329fb0b86a0f542c95c6405d5cb8e78.msi
-
Size
4.0MB
-
MD5
0329fb0b86a0f542c95c6405d5cb8e78
-
SHA1
1871d26fb53a65d99bb72819e0069804cebe3443
-
SHA256
0b9d503e19f5555e2f2d13d629f9ba95f33a1317a1cc38d54daf176f52827d3c
-
SHA512
b156c3c65da4ab00835f1d727e4da41e0e965f64da4a2f7eb1fe7a9025791daab4e931dfb36a834cb277c756f8f5d2addd78ef606e091e0594d78c92d5de31df
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 1252 MsiExec.exe 4 1252 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 1512 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hCciYNWngFNi.lnk MsiExec.exe -
Loads dropped DLL 25 IoCs
pid Process 1252 MsiExec.exe 1252 MsiExec.exe 1252 MsiExec.exe 1252 MsiExec.exe 1252 MsiExec.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1512 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI3B01.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3B61.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB625.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB74F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB7BD.tmp msiexec.exe File created C:\Windows\Installer\f75b53d.ipi msiexec.exe File opened for modification C:\Windows\Installer\f75b53d.ipi msiexec.exe File created C:\Windows\Installer\f75b53b.msi msiexec.exe File opened for modification C:\Windows\Installer\f75b53b.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 576 schtasks.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1656 msiexec.exe 1656 msiexec.exe 1512 gVtqSYArtORq.exe 1976 gVtqSYArtORq.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 744 msiexec.exe Token: SeIncreaseQuotaPrivilege 744 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeSecurityPrivilege 1656 msiexec.exe Token: SeCreateTokenPrivilege 744 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 744 msiexec.exe Token: SeLockMemoryPrivilege 744 msiexec.exe Token: SeIncreaseQuotaPrivilege 744 msiexec.exe Token: SeMachineAccountPrivilege 744 msiexec.exe Token: SeTcbPrivilege 744 msiexec.exe Token: SeSecurityPrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeLoadDriverPrivilege 744 msiexec.exe Token: SeSystemProfilePrivilege 744 msiexec.exe Token: SeSystemtimePrivilege 744 msiexec.exe Token: SeProfSingleProcessPrivilege 744 msiexec.exe Token: SeIncBasePriorityPrivilege 744 msiexec.exe Token: SeCreatePagefilePrivilege 744 msiexec.exe Token: SeCreatePermanentPrivilege 744 msiexec.exe Token: SeBackupPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeShutdownPrivilege 744 msiexec.exe Token: SeDebugPrivilege 744 msiexec.exe Token: SeAuditPrivilege 744 msiexec.exe Token: SeSystemEnvironmentPrivilege 744 msiexec.exe Token: SeChangeNotifyPrivilege 744 msiexec.exe Token: SeRemoteShutdownPrivilege 744 msiexec.exe Token: SeUndockPrivilege 744 msiexec.exe Token: SeSyncAgentPrivilege 744 msiexec.exe Token: SeEnableDelegationPrivilege 744 msiexec.exe Token: SeManageVolumePrivilege 744 msiexec.exe Token: SeImpersonatePrivilege 744 msiexec.exe Token: SeCreateGlobalPrivilege 744 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeIncreaseQuotaPrivilege 1164 WMIC.exe Token: SeSecurityPrivilege 1164 WMIC.exe Token: SeTakeOwnershipPrivilege 1164 WMIC.exe Token: SeLoadDriverPrivilege 1164 WMIC.exe Token: SeSystemProfilePrivilege 1164 WMIC.exe Token: SeSystemtimePrivilege 1164 WMIC.exe Token: SeProfSingleProcessPrivilege 1164 WMIC.exe Token: SeIncBasePriorityPrivilege 1164 WMIC.exe Token: SeCreatePagefilePrivilege 1164 WMIC.exe Token: SeBackupPrivilege 1164 WMIC.exe Token: SeRestorePrivilege 1164 WMIC.exe Token: SeShutdownPrivilege 1164 WMIC.exe Token: SeDebugPrivilege 1164 WMIC.exe Token: SeSystemEnvironmentPrivilege 1164 WMIC.exe Token: SeRemoteShutdownPrivilege 1164 WMIC.exe Token: SeUndockPrivilege 1164 WMIC.exe Token: SeManageVolumePrivilege 1164 WMIC.exe Token: 33 1164 WMIC.exe Token: 34 1164 WMIC.exe Token: 35 1164 WMIC.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 744 msiexec.exe 1252 MsiExec.exe 744 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1656 wrote to memory of 1252 1656 msiexec.exe 28 PID 1252 wrote to memory of 1164 1252 MsiExec.exe 29 PID 1252 wrote to memory of 1164 1252 MsiExec.exe 29 PID 1252 wrote to memory of 1164 1252 MsiExec.exe 29 PID 1252 wrote to memory of 1164 1252 MsiExec.exe 29 PID 1512 wrote to memory of 520 1512 gVtqSYArtORq.exe 33 PID 1512 wrote to memory of 520 1512 gVtqSYArtORq.exe 33 PID 1512 wrote to memory of 520 1512 gVtqSYArtORq.exe 33 PID 1512 wrote to memory of 520 1512 gVtqSYArtORq.exe 33 PID 520 wrote to memory of 576 520 cmd.exe 35 PID 520 wrote to memory of 576 520 cmd.exe 35 PID 520 wrote to memory of 576 520 cmd.exe 35 PID 520 wrote to memory of 576 520 cmd.exe 35 PID 1588 wrote to memory of 1976 1588 taskeng.exe 39 PID 1588 wrote to memory of 1976 1588 taskeng.exe 39 PID 1588 wrote to memory of 1976 1588 taskeng.exe 39 PID 1588 wrote to memory of 1976 1588 taskeng.exe 39
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0329fb0b86a0f542c95c6405d5cb8e78.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:744
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B6A4C1548C8E2E56D429BB71DC17AAC72⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
-
C:\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exeC:\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exe /SC minute /MO 2 /IT /RU %USERNAME%2⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exe /SC minute /MO 2 /IT /RU Admin3⤵
- Creates scheduled task(s)
PID:576
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E8B5F50C-0009-4B1B-A619-5503F0297C07} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exeC:\\Users\Admin\nshWQLhzYGFS\gVtqSYArtORq.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1976
-