Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    13-01-2022 15:16

General

  • Target

    5fe0bcefbfd86e01e6fd17a2009f2e9ebaf041e9ecf7ce3c83603a74ad440d53.msi

  • Size

    4.0MB

  • MD5

    84a654e89c30bf453beecaafb694f6a9

  • SHA1

    40ead07a0b5079314cfb2811d425e0370f6b6715

  • SHA256

    5fe0bcefbfd86e01e6fd17a2009f2e9ebaf041e9ecf7ce3c83603a74ad440d53

  • SHA512

    3e8b1e228d9e46c1fbb3639c5c71a6d790f51696160c11252906ddefe31db6668c687937fb6fd9f4bbbcadcf0c7357b03dc64299f7f36447279943c1e1f6914f

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5fe0bcefbfd86e01e6fd17a2009f2e9ebaf041e9ecf7ce3c83603a74ad440d53.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:760
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DBB1D02742C781C0F3711BFC0FF49959
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:696
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        "C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe'
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1588
  • C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
    C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe /SC minute /MO 2 /IT /RU %USERNAME%
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe /SC minute /MO 2 /IT /RU Admin
        3⤵
        • Creates scheduled task(s)
        PID:1188
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {B9B53057-7C40-4B27-A684-52BDF85B3BE7} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
      C:\\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:768

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Vso\font.cache
    MD5

    7834e13b8eb68255c9957100f4b1d5f9

    SHA1

    da134210ea64a9bdd59817e2f07bb7ebd1fc0624

    SHA256

    dbf23ab06b2df630045a2e0c47b2641451006157dd8468e5f19488ecbbfb330a

    SHA512

    1678f2054b2edc7015dab5856ab56fc0f5c0d8db4e6a11578a37ab267d032794f059c6ef4bb43e3aa4abcb4c683fe46843b40d20325764ce1ba66b453199493e

  • C:\Users\Admin\TKcdOHFjXEKZsYp\Host.hst
    MD5

    6f3bba5ce4dd65ee065162686a92a85b

    SHA1

    cc7954337b595a43d3213e7e009d71da1e87f83e

    SHA256

    450179cf5eb269302ce1487864e1cef5516bdedd98adea7376ea3dd00b634658

    SHA512

    346df682063a0bc18836635bd88c22d046e05dfd4538aa7a1a2cd4e80608fd0d070f3bacd720fbf862bcfdda2cd4e6ecd84063c66157e833bc57cfe01c3e53e1

  • C:\Users\Admin\TKcdOHFjXEKZsYp\avutil.dll
    MD5

    37c0ed7f075e3f25d15f5220fe195b8a

    SHA1

    5b64c237982aeb840827377d8205a78fd9e0f7d6

    SHA256

    790c3d3b0db212d260fb7569b76ec52c1c1f9c9ccc617f53191b91e8fad7be27

    SHA512

    075f465b938018b38842c27ce5eeb7a6b6e29c8a7de7d723099ff81d1f8bf88af1bd2f0733c5bb4f7dd545742d7efc3fc9c56c38d58e9d52dd0d60b3e3098f03

  • C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
    MD5

    0fef3ff51c28467fd84d7e5995b5b201

    SHA1

    4eb5f61c3c2a408e44555964ad8c51713c8a8f2c

    SHA256

    6506bac3cb16bc73f6f1ee76591b206c7b331e85afd07eba12f2bed5730f63ff

    SHA512

    18050bb3eaad2d3c33da1e10997dff4e17f9b6bd969a62453ab2d6fe638b16ec81a10f2ef76b521a868273159d3862519ff31d4d62f2534cb3e3a72dee08dcd7

  • C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
    MD5

    0fef3ff51c28467fd84d7e5995b5b201

    SHA1

    4eb5f61c3c2a408e44555964ad8c51713c8a8f2c

    SHA256

    6506bac3cb16bc73f6f1ee76591b206c7b331e85afd07eba12f2bed5730f63ff

    SHA512

    18050bb3eaad2d3c33da1e10997dff4e17f9b6bd969a62453ab2d6fe638b16ec81a10f2ef76b521a868273159d3862519ff31d4d62f2534cb3e3a72dee08dcd7

  • C:\Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
    MD5

    0fef3ff51c28467fd84d7e5995b5b201

    SHA1

    4eb5f61c3c2a408e44555964ad8c51713c8a8f2c

    SHA256

    6506bac3cb16bc73f6f1ee76591b206c7b331e85afd07eba12f2bed5730f63ff

    SHA512

    18050bb3eaad2d3c33da1e10997dff4e17f9b6bd969a62453ab2d6fe638b16ec81a10f2ef76b521a868273159d3862519ff31d4d62f2534cb3e3a72dee08dcd7

  • C:\Users\Admin\TKcdOHFjXEKZsYp\win_sparkle_check_update_with_ui_and_install
    MD5

    d525fa53f1f7c10a432c31d6b6cc6b3b

    SHA1

    c13cd2695171fa0353995b02dab4e20485717258

    SHA256

    b0c61e2b76fe4e78dccbab97f55de98ae99f61c0e45b4f0956ce4b073be79100

    SHA512

    627bf42c7097840dec4d1cd03ba3fdc16ea7c42cc1446e99a94f7961da691aa6b2788e46f7bc9c19672edcd51140594c7ae83c1920a37d9de79a2df63981ecb5

  • C:\Windows\Installer\MSI54DA.tmp
    MD5

    0872fc86ddb1c0c51beab1deaaa80218

    SHA1

    abe143cfe0053d6e93c042815f020ff4714794bc

    SHA256

    99f2f155dfed73c33416e82ca6cd8f6dc66abbf50513a5e2a857d12e49504c60

    SHA512

    1b15ea0122d5adef9098381a2dc9659257ba13704fc4b51105c535044c94e370b9ea24e70c836e85cd0b4c9cc4dab63522c74af2ab913619984e86c27888a346

  • C:\Windows\Installer\MSIC38D.tmp
    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • C:\Windows\Installer\MSIC505.tmp
    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • C:\Windows\Installer\MSIC5B1.tmp
    MD5

    0872fc86ddb1c0c51beab1deaaa80218

    SHA1

    abe143cfe0053d6e93c042815f020ff4714794bc

    SHA256

    99f2f155dfed73c33416e82ca6cd8f6dc66abbf50513a5e2a857d12e49504c60

    SHA512

    1b15ea0122d5adef9098381a2dc9659257ba13704fc4b51105c535044c94e370b9ea24e70c836e85cd0b4c9cc4dab63522c74af2ab913619984e86c27888a346

  • \??\PIPE\srvsvc
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Users\Admin\TKcdOHFjXEKZsYp\avutil.dll
    MD5

    37c0ed7f075e3f25d15f5220fe195b8a

    SHA1

    5b64c237982aeb840827377d8205a78fd9e0f7d6

    SHA256

    790c3d3b0db212d260fb7569b76ec52c1c1f9c9ccc617f53191b91e8fad7be27

    SHA512

    075f465b938018b38842c27ce5eeb7a6b6e29c8a7de7d723099ff81d1f8bf88af1bd2f0733c5bb4f7dd545742d7efc3fc9c56c38d58e9d52dd0d60b3e3098f03

  • \Users\Admin\TKcdOHFjXEKZsYp\avutil.dll
    MD5

    37c0ed7f075e3f25d15f5220fe195b8a

    SHA1

    5b64c237982aeb840827377d8205a78fd9e0f7d6

    SHA256

    790c3d3b0db212d260fb7569b76ec52c1c1f9c9ccc617f53191b91e8fad7be27

    SHA512

    075f465b938018b38842c27ce5eeb7a6b6e29c8a7de7d723099ff81d1f8bf88af1bd2f0733c5bb4f7dd545742d7efc3fc9c56c38d58e9d52dd0d60b3e3098f03

  • \Users\Admin\TKcdOHFjXEKZsYp\avutil.dll
    MD5

    2ee6722b74e178cc3b8cbc356877f4f2

    SHA1

    4a89606761bd93811f1d56395c32e1e7b0f8de52

    SHA256

    eaa9242ae077c5ee04a0a353ce40069c35f9b9a7a57c2b9fd60e494aa26774a6

    SHA512

    38ebdf2cfe90990aa2f7772c7916c5f107326d6c1576eec71186190703f5bf28d28a20c1e0425035b69bb44a176f7ceca71c80efbff22c0f857e88c7b5c7cc78

  • \Users\Admin\TKcdOHFjXEKZsYp\avutil.dll
    MD5

    9755c238b8d11e3bcee99e9e9fa9c8f0

    SHA1

    4a0452181e74d32feeb5563bdd7f3bcb7211e586

    SHA256

    5a1498bd37b3567266c08fa2138900cea8ef5fb92efa815884ac641b80808610

    SHA512

    7614f4f6484130de8c0815539ad11a8d0851600f456c0a08dc976e49f1d5a9f2c45eaf06179d4cee6d6b8f2eb6b648127c8b71093a7245dcaba6cd532728b8d3

  • \Users\Admin\TKcdOHFjXEKZsYp\bmPVuGfskBoXXSe.exe
    MD5

    0fef3ff51c28467fd84d7e5995b5b201

    SHA1

    4eb5f61c3c2a408e44555964ad8c51713c8a8f2c

    SHA256

    6506bac3cb16bc73f6f1ee76591b206c7b331e85afd07eba12f2bed5730f63ff

    SHA512

    18050bb3eaad2d3c33da1e10997dff4e17f9b6bd969a62453ab2d6fe638b16ec81a10f2ef76b521a868273159d3862519ff31d4d62f2534cb3e3a72dee08dcd7

  • \Windows\Installer\MSI54DA.tmp
    MD5

    0872fc86ddb1c0c51beab1deaaa80218

    SHA1

    abe143cfe0053d6e93c042815f020ff4714794bc

    SHA256

    99f2f155dfed73c33416e82ca6cd8f6dc66abbf50513a5e2a857d12e49504c60

    SHA512

    1b15ea0122d5adef9098381a2dc9659257ba13704fc4b51105c535044c94e370b9ea24e70c836e85cd0b4c9cc4dab63522c74af2ab913619984e86c27888a346

  • \Windows\Installer\MSIC38D.tmp
    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • \Windows\Installer\MSIC505.tmp
    MD5

    9f1e5d66c2889018daef4aef604eebc4

    SHA1

    b80294261c8a1635e16e14f55a3d76889ff2c857

    SHA256

    02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

    SHA512

    8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

  • \Windows\Installer\MSIC5B1.tmp
    MD5

    0872fc86ddb1c0c51beab1deaaa80218

    SHA1

    abe143cfe0053d6e93c042815f020ff4714794bc

    SHA256

    99f2f155dfed73c33416e82ca6cd8f6dc66abbf50513a5e2a857d12e49504c60

    SHA512

    1b15ea0122d5adef9098381a2dc9659257ba13704fc4b51105c535044c94e370b9ea24e70c836e85cd0b4c9cc4dab63522c74af2ab913619984e86c27888a346

  • memory/572-72-0x0000000000350000-0x0000000000351000-memory.dmp
    Filesize

    4KB

  • memory/572-79-0x0000000006801000-0x0000000006C87000-memory.dmp
    Filesize

    4.5MB

  • memory/572-80-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
    Filesize

    4KB

  • memory/572-75-0x0000000006550000-0x00000000066BA000-memory.dmp
    Filesize

    1.4MB

  • memory/696-56-0x0000000000000000-mapping.dmp
  • memory/696-57-0x0000000075D61000-0x0000000075D63000-memory.dmp
    Filesize

    8KB

  • memory/696-64-0x0000000000710000-0x0000000000711000-memory.dmp
    Filesize

    4KB

  • memory/760-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp
    Filesize

    8KB

  • memory/768-91-0x0000000006400000-0x000000000656A000-memory.dmp
    Filesize

    1.4MB

  • memory/768-87-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

  • memory/768-84-0x0000000000000000-mapping.dmp
  • memory/868-81-0x0000000000000000-mapping.dmp
  • memory/1188-82-0x0000000000000000-mapping.dmp
  • memory/1588-66-0x0000000000000000-mapping.dmp