Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
23/12/2021, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Nota Fiscal Eletronica2.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Nota Fiscal Eletronica2.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target Nota Fiscal Eletronica2.msi
- Size 1.4MB
- Sample211223-2r9v1scegr
- SHA256 52d79e7edccadccda98fdaaa761c5306adc502a639e7e217b2256ed6d8b7fa17
- MD5 7295fd231f90dafd7f384dbafa4c9500
- SHA1 a2c5697e877bc9e7fced61688f987de22026e561
- SHA512 5051d5c1f4d2249be777e566f7c370e5edddaa1286a02470b8b095076687e6ae0846e7fa5409edd258535576aedbce2fedd817bb960660c86e1a5f5571ce79e7
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 7 IoCs
flow pid Process 11 4072 MsiExec.exe 25 4072 MsiExec.exe 26 4072 MsiExec.exe 29 4072 MsiExec.exe 30 4072 MsiExec.exe 31 4072 MsiExec.exe 32 4072 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 4072 MsiExec.exe 4072 MsiExec.exe 4072 MsiExec.exe 4072 MsiExec.exe 4072 MsiExec.exe 4072 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIEA22.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{00D54E0D-1E8B-4478-B79B-2DE04B56A70D} msiexec.exe File opened for modification C:\Windows\Installer\MSIFD82.tmp msiexec.exe File created C:\Windows\Installer\f75e976.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIED30.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEE0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEF36.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF93A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF969.tmp msiexec.exe File opened for modification C:\Windows\Installer\f75e976.msi msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4136 msiexec.exe 4136 msiexec.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 1480 msiexec.exe Token: SeIncreaseQuotaPrivilege 1480 msiexec.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 1480 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1480 msiexec.exe Token: SeLockMemoryPrivilege 1480 msiexec.exe Token: SeIncreaseQuotaPrivilege 1480 msiexec.exe Token: SeMachineAccountPrivilege 1480 msiexec.exe Token: SeTcbPrivilege 1480 msiexec.exe Token: SeSecurityPrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeLoadDriverPrivilege 1480 msiexec.exe Token: SeSystemProfilePrivilege 1480 msiexec.exe Token: SeSystemtimePrivilege 1480 msiexec.exe Token: SeProfSingleProcessPrivilege 1480 msiexec.exe Token: SeIncBasePriorityPrivilege 1480 msiexec.exe Token: SeCreatePagefilePrivilege 1480 msiexec.exe Token: SeCreatePermanentPrivilege 1480 msiexec.exe Token: SeBackupPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeShutdownPrivilege 1480 msiexec.exe Token: SeDebugPrivilege 1480 msiexec.exe Token: SeAuditPrivilege 1480 msiexec.exe Token: SeSystemEnvironmentPrivilege 1480 msiexec.exe Token: SeChangeNotifyPrivilege 1480 msiexec.exe Token: SeRemoteShutdownPrivilege 1480 msiexec.exe Token: SeUndockPrivilege 1480 msiexec.exe Token: SeSyncAgentPrivilege 1480 msiexec.exe Token: SeEnableDelegationPrivilege 1480 msiexec.exe Token: SeManageVolumePrivilege 1480 msiexec.exe Token: SeImpersonatePrivilege 1480 msiexec.exe Token: SeCreateGlobalPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1480 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4136 wrote to memory of 4072 4136 msiexec.exe 70 PID 4136 wrote to memory of 4072 4136 msiexec.exe 70 PID 4136 wrote to memory of 4072 4136 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Nota Fiscal Eletronica2.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1480
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 746AAC41C676F1A693D0866153875C8F2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4072
-