Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
17/12/2021, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
Deliveryinfo.jar.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Deliveryinfo.jar.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target Deliveryinfo.jar.msi
- Size 1.1MB
- Sample211217-zapseaebe3
- SHA256 0b3ec79751b73aa58e7c71e691d970b00f48f6439f3d0067d269fc2ddef16881
- MD5 6d8a06055c1059cda4fe47582ea2a9fe
- SHA1 cb7ac52f879336973b6112dd198ed2713ead67b4
- SHA512 d55652aed4be0a75588c6ff4fa17b9efdaa52b71d505608ccdaab46eee1b902b4aa008f1494c928617ede3a101e92016530d9a5925b1ee5307b13c41a7c3e704
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 1356 MsiExec.exe 1356 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1580 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1580 msiexec.exe Token: SeIncreaseQuotaPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1068 msiexec.exe Token: SeTakeOwnershipPrivilege 1068 msiexec.exe Token: SeSecurityPrivilege 1068 msiexec.exe Token: SeCreateTokenPrivilege 1580 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1580 msiexec.exe Token: SeLockMemoryPrivilege 1580 msiexec.exe Token: SeIncreaseQuotaPrivilege 1580 msiexec.exe Token: SeMachineAccountPrivilege 1580 msiexec.exe Token: SeTcbPrivilege 1580 msiexec.exe Token: SeSecurityPrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeLoadDriverPrivilege 1580 msiexec.exe Token: SeSystemProfilePrivilege 1580 msiexec.exe Token: SeSystemtimePrivilege 1580 msiexec.exe Token: SeProfSingleProcessPrivilege 1580 msiexec.exe Token: SeIncBasePriorityPrivilege 1580 msiexec.exe Token: SeCreatePagefilePrivilege 1580 msiexec.exe Token: SeCreatePermanentPrivilege 1580 msiexec.exe Token: SeBackupPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeShutdownPrivilege 1580 msiexec.exe Token: SeDebugPrivilege 1580 msiexec.exe Token: SeAuditPrivilege 1580 msiexec.exe Token: SeSystemEnvironmentPrivilege 1580 msiexec.exe Token: SeChangeNotifyPrivilege 1580 msiexec.exe Token: SeRemoteShutdownPrivilege 1580 msiexec.exe Token: SeUndockPrivilege 1580 msiexec.exe Token: SeSyncAgentPrivilege 1580 msiexec.exe Token: SeEnableDelegationPrivilege 1580 msiexec.exe Token: SeManageVolumePrivilege 1580 msiexec.exe Token: SeImpersonatePrivilege 1580 msiexec.exe Token: SeCreateGlobalPrivilege 1580 msiexec.exe Token: SeCreateTokenPrivilege 1580 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1580 msiexec.exe Token: SeLockMemoryPrivilege 1580 msiexec.exe Token: SeIncreaseQuotaPrivilege 1580 msiexec.exe Token: SeMachineAccountPrivilege 1580 msiexec.exe Token: SeTcbPrivilege 1580 msiexec.exe Token: SeSecurityPrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeLoadDriverPrivilege 1580 msiexec.exe Token: SeSystemProfilePrivilege 1580 msiexec.exe Token: SeSystemtimePrivilege 1580 msiexec.exe Token: SeProfSingleProcessPrivilege 1580 msiexec.exe Token: SeIncBasePriorityPrivilege 1580 msiexec.exe Token: SeCreatePagefilePrivilege 1580 msiexec.exe Token: SeCreatePermanentPrivilege 1580 msiexec.exe Token: SeBackupPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeShutdownPrivilege 1580 msiexec.exe Token: SeDebugPrivilege 1580 msiexec.exe Token: SeAuditPrivilege 1580 msiexec.exe Token: SeSystemEnvironmentPrivilege 1580 msiexec.exe Token: SeChangeNotifyPrivilege 1580 msiexec.exe Token: SeRemoteShutdownPrivilege 1580 msiexec.exe Token: SeUndockPrivilege 1580 msiexec.exe Token: SeSyncAgentPrivilege 1580 msiexec.exe Token: SeEnableDelegationPrivilege 1580 msiexec.exe Token: SeManageVolumePrivilege 1580 msiexec.exe Token: SeImpersonatePrivilege 1580 msiexec.exe Token: SeCreateGlobalPrivilege 1580 msiexec.exe Token: SeCreateTokenPrivilege 1580 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1580 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1068 wrote to memory of 1356 1068 msiexec.exe 28 PID 1068 wrote to memory of 1356 1068 msiexec.exe 28 PID 1068 wrote to memory of 1356 1068 msiexec.exe 28 PID 1068 wrote to memory of 1356 1068 msiexec.exe 28 PID 1068 wrote to memory of 1356 1068 msiexec.exe 28 PID 1068 wrote to memory of 1356 1068 msiexec.exe 28 PID 1068 wrote to memory of 1356 1068 msiexec.exe 28
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Deliveryinfo.jar.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1580
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F356A771248CBAADDC4624039F4E27CD C2⤵
- Loads dropped DLL
PID:1356
-