Analysis
- max time kernel
122s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
08/01/2022, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
e3ed152ccc1603d19c2e69997407bed7.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e3ed152ccc1603d19c2e69997407bed7.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target e3ed152ccc1603d19c2e69997407bed7.msi
- Size 1.1MB
- Sample220108-j2qk1schb2
- SHA256 ff91b27ceafee96143faa965d9316de7746ab90befcf05fcb1bcc4fda5516852
- MD5 e3ed152ccc1603d19c2e69997407bed7
- SHA1 187c8ec8d24a05250d50cfc3739d54f24aa34826
- SHA512 d2c445dddc71aee3fafaa0e74f209ea5d99cab21bef539e75e6c57b34a8896188fb137344ddc5e466bbcffd24ab9c8370b905a7fc492e7fad022b861b15a97ef
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3912 MsiExec.exe 3912 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1028 msiexec.exe Token: SeIncreaseQuotaPrivilege 1028 msiexec.exe Token: SeSecurityPrivilege 1224 msiexec.exe Token: SeCreateTokenPrivilege 1028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1028 msiexec.exe Token: SeLockMemoryPrivilege 1028 msiexec.exe Token: SeIncreaseQuotaPrivilege 1028 msiexec.exe Token: SeMachineAccountPrivilege 1028 msiexec.exe Token: SeTcbPrivilege 1028 msiexec.exe Token: SeSecurityPrivilege 1028 msiexec.exe Token: SeTakeOwnershipPrivilege 1028 msiexec.exe Token: SeLoadDriverPrivilege 1028 msiexec.exe Token: SeSystemProfilePrivilege 1028 msiexec.exe Token: SeSystemtimePrivilege 1028 msiexec.exe Token: SeProfSingleProcessPrivilege 1028 msiexec.exe Token: SeIncBasePriorityPrivilege 1028 msiexec.exe Token: SeCreatePagefilePrivilege 1028 msiexec.exe Token: SeCreatePermanentPrivilege 1028 msiexec.exe Token: SeBackupPrivilege 1028 msiexec.exe Token: SeRestorePrivilege 1028 msiexec.exe Token: SeShutdownPrivilege 1028 msiexec.exe Token: SeDebugPrivilege 1028 msiexec.exe Token: SeAuditPrivilege 1028 msiexec.exe Token: SeSystemEnvironmentPrivilege 1028 msiexec.exe Token: SeChangeNotifyPrivilege 1028 msiexec.exe Token: SeRemoteShutdownPrivilege 1028 msiexec.exe Token: SeUndockPrivilege 1028 msiexec.exe Token: SeSyncAgentPrivilege 1028 msiexec.exe Token: SeEnableDelegationPrivilege 1028 msiexec.exe Token: SeManageVolumePrivilege 1028 msiexec.exe Token: SeImpersonatePrivilege 1028 msiexec.exe Token: SeCreateGlobalPrivilege 1028 msiexec.exe Token: SeCreateTokenPrivilege 1028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1028 msiexec.exe Token: SeLockMemoryPrivilege 1028 msiexec.exe Token: SeIncreaseQuotaPrivilege 1028 msiexec.exe Token: SeMachineAccountPrivilege 1028 msiexec.exe Token: SeTcbPrivilege 1028 msiexec.exe Token: SeSecurityPrivilege 1028 msiexec.exe Token: SeTakeOwnershipPrivilege 1028 msiexec.exe Token: SeLoadDriverPrivilege 1028 msiexec.exe Token: SeSystemProfilePrivilege 1028 msiexec.exe Token: SeSystemtimePrivilege 1028 msiexec.exe Token: SeProfSingleProcessPrivilege 1028 msiexec.exe Token: SeIncBasePriorityPrivilege 1028 msiexec.exe Token: SeCreatePagefilePrivilege 1028 msiexec.exe Token: SeCreatePermanentPrivilege 1028 msiexec.exe Token: SeBackupPrivilege 1028 msiexec.exe Token: SeRestorePrivilege 1028 msiexec.exe Token: SeShutdownPrivilege 1028 msiexec.exe Token: SeDebugPrivilege 1028 msiexec.exe Token: SeAuditPrivilege 1028 msiexec.exe Token: SeSystemEnvironmentPrivilege 1028 msiexec.exe Token: SeChangeNotifyPrivilege 1028 msiexec.exe Token: SeRemoteShutdownPrivilege 1028 msiexec.exe Token: SeUndockPrivilege 1028 msiexec.exe Token: SeSyncAgentPrivilege 1028 msiexec.exe Token: SeEnableDelegationPrivilege 1028 msiexec.exe Token: SeManageVolumePrivilege 1028 msiexec.exe Token: SeImpersonatePrivilege 1028 msiexec.exe Token: SeCreateGlobalPrivilege 1028 msiexec.exe Token: SeCreateTokenPrivilege 1028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1028 msiexec.exe Token: SeLockMemoryPrivilege 1028 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1028 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1224 wrote to memory of 3912 1224 msiexec.exe 71 PID 1224 wrote to memory of 3912 1224 msiexec.exe 71 PID 1224 wrote to memory of 3912 1224 msiexec.exe 71
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e3ed152ccc1603d19c2e69997407bed7.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1028
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 57EED45E6AD89DD6D1B3368824669CA0 C2⤵
- Loads dropped DLL
PID:3912
-