Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 17:47
Static task
static1
Behavioral task
behavioral1
Sample
seucartao0021 bdpk7zuq ju1ej9.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
seucartao0021 bdpk7zuq ju1ej9.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
seucartao0021 bdpk7zuq ju1ej9.msi
-
Size
4.0MB
-
MD5
8a53e2cb70a3967f721059d146e7ac4c
-
SHA1
429614ea9a6067160470aa5e101bb33b862deb80
-
SHA256
7e7d377140a146065c91c271e97dff7bb94f4b42245f1fba4dd2899271281912
-
SHA512
5ce3076109b4220de0e996eb91addeefeb9c0c9a19b0434b9858c18b69c88151ac8478402ad13efe6c791bb0771dcfec4f7fcc231cb199f7c334fb9c550d6e5d
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 9 68 MsiExec.exe 20 68 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 876 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ySoMcarOiPHT.lnk MsiExec.exe -
Loads dropped DLL 27 IoCs
pid Process 68 MsiExec.exe 68 MsiExec.exe 68 MsiExec.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe 68 MsiExec.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe 2272 gBjJpaReuXMu.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSID506.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{53F90BF6-541C-4605-8922-54C699AD1846} msiexec.exe File opened for modification C:\Windows\Installer\MSICDC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\f75ccb7.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID10D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI33A2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI35D7.tmp msiexec.exe File created C:\Windows\Installer\f75ccb7.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2252 schtasks.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1908 msiexec.exe 1908 msiexec.exe 876 gBjJpaReuXMu.exe 876 gBjJpaReuXMu.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeSecurityPrivilege 1908 msiexec.exe Token: SeCreateTokenPrivilege 2508 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2508 msiexec.exe Token: SeLockMemoryPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeMachineAccountPrivilege 2508 msiexec.exe Token: SeTcbPrivilege 2508 msiexec.exe Token: SeSecurityPrivilege 2508 msiexec.exe Token: SeTakeOwnershipPrivilege 2508 msiexec.exe Token: SeLoadDriverPrivilege 2508 msiexec.exe Token: SeSystemProfilePrivilege 2508 msiexec.exe Token: SeSystemtimePrivilege 2508 msiexec.exe Token: SeProfSingleProcessPrivilege 2508 msiexec.exe Token: SeIncBasePriorityPrivilege 2508 msiexec.exe Token: SeCreatePagefilePrivilege 2508 msiexec.exe Token: SeCreatePermanentPrivilege 2508 msiexec.exe Token: SeBackupPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 2508 msiexec.exe Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeDebugPrivilege 2508 msiexec.exe Token: SeAuditPrivilege 2508 msiexec.exe Token: SeSystemEnvironmentPrivilege 2508 msiexec.exe Token: SeChangeNotifyPrivilege 2508 msiexec.exe Token: SeRemoteShutdownPrivilege 2508 msiexec.exe Token: SeUndockPrivilege 2508 msiexec.exe Token: SeSyncAgentPrivilege 2508 msiexec.exe Token: SeEnableDelegationPrivilege 2508 msiexec.exe Token: SeManageVolumePrivilege 2508 msiexec.exe Token: SeImpersonatePrivilege 2508 msiexec.exe Token: SeCreateGlobalPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 1908 msiexec.exe Token: SeTakeOwnershipPrivilege 1908 msiexec.exe Token: SeRestorePrivilege 1908 msiexec.exe Token: SeTakeOwnershipPrivilege 1908 msiexec.exe Token: SeRestorePrivilege 1908 msiexec.exe Token: SeTakeOwnershipPrivilege 1908 msiexec.exe Token: SeRestorePrivilege 1908 msiexec.exe Token: SeTakeOwnershipPrivilege 1908 msiexec.exe Token: SeIncreaseQuotaPrivilege 3628 WMIC.exe Token: SeSecurityPrivilege 3628 WMIC.exe Token: SeTakeOwnershipPrivilege 3628 WMIC.exe Token: SeLoadDriverPrivilege 3628 WMIC.exe Token: SeSystemProfilePrivilege 3628 WMIC.exe Token: SeSystemtimePrivilege 3628 WMIC.exe Token: SeProfSingleProcessPrivilege 3628 WMIC.exe Token: SeIncBasePriorityPrivilege 3628 WMIC.exe Token: SeCreatePagefilePrivilege 3628 WMIC.exe Token: SeBackupPrivilege 3628 WMIC.exe Token: SeRestorePrivilege 3628 WMIC.exe Token: SeShutdownPrivilege 3628 WMIC.exe Token: SeDebugPrivilege 3628 WMIC.exe Token: SeSystemEnvironmentPrivilege 3628 WMIC.exe Token: SeRemoteShutdownPrivilege 3628 WMIC.exe Token: SeUndockPrivilege 3628 WMIC.exe Token: SeManageVolumePrivilege 3628 WMIC.exe Token: 33 3628 WMIC.exe Token: 34 3628 WMIC.exe Token: 35 3628 WMIC.exe Token: 36 3628 WMIC.exe Token: SeIncreaseQuotaPrivilege 3628 WMIC.exe Token: SeSecurityPrivilege 3628 WMIC.exe Token: SeTakeOwnershipPrivilege 3628 WMIC.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2508 msiexec.exe 68 MsiExec.exe 2508 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1908 wrote to memory of 68 1908 msiexec.exe 70 PID 1908 wrote to memory of 68 1908 msiexec.exe 70 PID 1908 wrote to memory of 68 1908 msiexec.exe 70 PID 68 wrote to memory of 3628 68 MsiExec.exe 72 PID 68 wrote to memory of 3628 68 MsiExec.exe 72 PID 68 wrote to memory of 3628 68 MsiExec.exe 72 PID 876 wrote to memory of 2168 876 gBjJpaReuXMu.exe 76 PID 876 wrote to memory of 2168 876 gBjJpaReuXMu.exe 76 PID 876 wrote to memory of 2168 876 gBjJpaReuXMu.exe 76 PID 2168 wrote to memory of 2252 2168 cmd.exe 78 PID 2168 wrote to memory of 2252 2168 cmd.exe 78 PID 2168 wrote to memory of 2252 2168 cmd.exe 78
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\seucartao0021 bdpk7zuq ju1ej9.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2508
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 80804E40358D5E47382EB20FFB8771F72⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:68 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
-
C:\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exeC:\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exe /SC minute /MO 2 /IT /RU %USERNAME%2⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exe /SC minute /MO 2 /IT /RU Admin3⤵
- Creates scheduled task(s)
PID:2252
-
-
-
C:\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exeC:\\Users\Admin\vqVbtusxUIfu\gBjJpaReuXMu.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272