Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
17/12/2021, 09:43
Static task
static1
Behavioral task
behavioral1
Sample
0329fb0b86a0f542c95c6405d5cb8e78.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0329fb0b86a0f542c95c6405d5cb8e78.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
0329fb0b86a0f542c95c6405d5cb8e78.msi
-
Size
4.0MB
-
MD5
0329fb0b86a0f542c95c6405d5cb8e78
-
SHA1
1871d26fb53a65d99bb72819e0069804cebe3443
-
SHA256
0b9d503e19f5555e2f2d13d629f9ba95f33a1317a1cc38d54daf176f52827d3c
-
SHA512
b156c3c65da4ab00835f1d727e4da41e0e965f64da4a2f7eb1fe7a9025791daab4e931dfb36a834cb277c756f8f5d2addd78ef606e091e0594d78c92d5de31df
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 20 3400 MsiExec.exe 34 3400 MsiExec.exe -
Executes dropped EXE 4 IoCs
pid Process 1372 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zlhXNWIvWoHV.lnk MsiExec.exe -
Loads dropped DLL 46 IoCs
pid Process 3400 MsiExec.exe 3400 MsiExec.exe 3400 MsiExec.exe 3400 MsiExec.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 4960 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe 3772 VColLLtCiaNH.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIBAA7.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{F8B0A06A-2E13-46D0-9887-1D4AFA9E2976} msiexec.exe File opened for modification C:\Windows\Installer\MSI2886.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2973.tmp msiexec.exe File opened for modification C:\Windows\Installer\f75b45d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB557.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB83.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\f75b45d.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3120 schtasks.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 34 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 800 msiexec.exe 800 msiexec.exe 1372 VColLLtCiaNH.exe 1372 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe 3848 VColLLtCiaNH.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3668 msiexec.exe Token: SeIncreaseQuotaPrivilege 3668 msiexec.exe Token: SeSecurityPrivilege 800 msiexec.exe Token: SeCreateTokenPrivilege 3668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3668 msiexec.exe Token: SeLockMemoryPrivilege 3668 msiexec.exe Token: SeIncreaseQuotaPrivilege 3668 msiexec.exe Token: SeMachineAccountPrivilege 3668 msiexec.exe Token: SeTcbPrivilege 3668 msiexec.exe Token: SeSecurityPrivilege 3668 msiexec.exe Token: SeTakeOwnershipPrivilege 3668 msiexec.exe Token: SeLoadDriverPrivilege 3668 msiexec.exe Token: SeSystemProfilePrivilege 3668 msiexec.exe Token: SeSystemtimePrivilege 3668 msiexec.exe Token: SeProfSingleProcessPrivilege 3668 msiexec.exe Token: SeIncBasePriorityPrivilege 3668 msiexec.exe Token: SeCreatePagefilePrivilege 3668 msiexec.exe Token: SeCreatePermanentPrivilege 3668 msiexec.exe Token: SeBackupPrivilege 3668 msiexec.exe Token: SeRestorePrivilege 3668 msiexec.exe Token: SeShutdownPrivilege 3668 msiexec.exe Token: SeDebugPrivilege 3668 msiexec.exe Token: SeAuditPrivilege 3668 msiexec.exe Token: SeSystemEnvironmentPrivilege 3668 msiexec.exe Token: SeChangeNotifyPrivilege 3668 msiexec.exe Token: SeRemoteShutdownPrivilege 3668 msiexec.exe Token: SeUndockPrivilege 3668 msiexec.exe Token: SeSyncAgentPrivilege 3668 msiexec.exe Token: SeEnableDelegationPrivilege 3668 msiexec.exe Token: SeManageVolumePrivilege 3668 msiexec.exe Token: SeImpersonatePrivilege 3668 msiexec.exe Token: SeCreateGlobalPrivilege 3668 msiexec.exe Token: SeRestorePrivilege 800 msiexec.exe Token: SeTakeOwnershipPrivilege 800 msiexec.exe Token: SeRestorePrivilege 800 msiexec.exe Token: SeTakeOwnershipPrivilege 800 msiexec.exe Token: SeRestorePrivilege 800 msiexec.exe Token: SeTakeOwnershipPrivilege 800 msiexec.exe Token: SeRestorePrivilege 800 msiexec.exe Token: SeTakeOwnershipPrivilege 800 msiexec.exe Token: SeIncreaseQuotaPrivilege 516 WMIC.exe Token: SeSecurityPrivilege 516 WMIC.exe Token: SeTakeOwnershipPrivilege 516 WMIC.exe Token: SeLoadDriverPrivilege 516 WMIC.exe Token: SeSystemProfilePrivilege 516 WMIC.exe Token: SeSystemtimePrivilege 516 WMIC.exe Token: SeProfSingleProcessPrivilege 516 WMIC.exe Token: SeIncBasePriorityPrivilege 516 WMIC.exe Token: SeCreatePagefilePrivilege 516 WMIC.exe Token: SeBackupPrivilege 516 WMIC.exe Token: SeRestorePrivilege 516 WMIC.exe Token: SeShutdownPrivilege 516 WMIC.exe Token: SeDebugPrivilege 516 WMIC.exe Token: SeSystemEnvironmentPrivilege 516 WMIC.exe Token: SeRemoteShutdownPrivilege 516 WMIC.exe Token: SeUndockPrivilege 516 WMIC.exe Token: SeManageVolumePrivilege 516 WMIC.exe Token: 33 516 WMIC.exe Token: 34 516 WMIC.exe Token: 35 516 WMIC.exe Token: 36 516 WMIC.exe Token: SeRestorePrivilege 800 msiexec.exe Token: SeTakeOwnershipPrivilege 800 msiexec.exe Token: SeRestorePrivilege 800 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3668 msiexec.exe 3400 MsiExec.exe 3668 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 800 wrote to memory of 3400 800 msiexec.exe 71 PID 800 wrote to memory of 3400 800 msiexec.exe 71 PID 800 wrote to memory of 3400 800 msiexec.exe 71 PID 3400 wrote to memory of 516 3400 MsiExec.exe 72 PID 3400 wrote to memory of 516 3400 MsiExec.exe 72 PID 3400 wrote to memory of 516 3400 MsiExec.exe 72 PID 1372 wrote to memory of 2776 1372 VColLLtCiaNH.exe 76 PID 1372 wrote to memory of 2776 1372 VColLLtCiaNH.exe 76 PID 1372 wrote to memory of 2776 1372 VColLLtCiaNH.exe 76 PID 2776 wrote to memory of 3120 2776 cmd.exe 78 PID 2776 wrote to memory of 3120 2776 cmd.exe 78 PID 2776 wrote to memory of 3120 2776 cmd.exe 78 PID 1372 wrote to memory of 3848 1372 VColLLtCiaNH.exe 79 PID 1372 wrote to memory of 3848 1372 VColLLtCiaNH.exe 79 PID 1372 wrote to memory of 3848 1372 VColLLtCiaNH.exe 79 PID 3848 wrote to memory of 4960 3848 VColLLtCiaNH.exe 80 PID 3848 wrote to memory of 4960 3848 VColLLtCiaNH.exe 80 PID 3848 wrote to memory of 4960 3848 VColLLtCiaNH.exe 80
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0329fb0b86a0f542c95c6405d5cb8e78.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3668
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69AE8752C60810BB80305C89107BBDBD2⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
-
C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exeC:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe /SC minute /MO 2 /IT /RU %USERNAME%2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe /SC minute /MO 2 /IT /RU Admin3⤵
- Creates scheduled task(s)
PID:3120
-
-
-
C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe"C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe"C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4960
-
-
-
C:\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exeC:\\Users\Admin\dccpcWLcwIAl\VColLLtCiaNH.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3772