Analysis
-
max time kernel
89s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13/01/2022, 15:53
Static task
static1
Behavioral task
behavioral1
Sample
load.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
load.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
load.msi
-
Size
4.0MB
-
MD5
84a654e89c30bf453beecaafb694f6a9
-
SHA1
40ead07a0b5079314cfb2811d425e0370f6b6715
-
SHA256
5fe0bcefbfd86e01e6fd17a2009f2e9ebaf041e9ecf7ce3c83603a74ad440d53
-
SHA512
3e8b1e228d9e46c1fbb3639c5c71a6d790f51696160c11252906ddefe31db6668c687937fb6fd9f4bbbcadcf0c7357b03dc64299f7f36447279943c1e1f6914f
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 19 2308 MsiExec.exe 24 2308 MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 900 wdROHnZVvlkZEMv.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CXSTQVlgDwHBlee.lnk MsiExec.exe -
Loads dropped DLL 8 IoCs
pid Process 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 900 wdROHnZVvlkZEMv.exe 900 wdROHnZVvlkZEMv.exe 900 wdROHnZVvlkZEMv.exe 900 wdROHnZVvlkZEMv.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI1818.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI23A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA8C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIADC6.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{391923A1-7509-4253-BE5D-BA0D6D42F508} msiexec.exe File created C:\Windows\Installer\f7616ff.msi msiexec.exe File opened for modification C:\Windows\Installer\f7616ff.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI22E6.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3872 schtasks.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1824 msiexec.exe 1824 msiexec.exe 900 wdROHnZVvlkZEMv.exe 900 wdROHnZVvlkZEMv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 64 msiexec.exe Token: SeIncreaseQuotaPrivilege 64 msiexec.exe Token: SeSecurityPrivilege 1824 msiexec.exe Token: SeCreateTokenPrivilege 64 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 64 msiexec.exe Token: SeLockMemoryPrivilege 64 msiexec.exe Token: SeIncreaseQuotaPrivilege 64 msiexec.exe Token: SeMachineAccountPrivilege 64 msiexec.exe Token: SeTcbPrivilege 64 msiexec.exe Token: SeSecurityPrivilege 64 msiexec.exe Token: SeTakeOwnershipPrivilege 64 msiexec.exe Token: SeLoadDriverPrivilege 64 msiexec.exe Token: SeSystemProfilePrivilege 64 msiexec.exe Token: SeSystemtimePrivilege 64 msiexec.exe Token: SeProfSingleProcessPrivilege 64 msiexec.exe Token: SeIncBasePriorityPrivilege 64 msiexec.exe Token: SeCreatePagefilePrivilege 64 msiexec.exe Token: SeCreatePermanentPrivilege 64 msiexec.exe Token: SeBackupPrivilege 64 msiexec.exe Token: SeRestorePrivilege 64 msiexec.exe Token: SeShutdownPrivilege 64 msiexec.exe Token: SeDebugPrivilege 64 msiexec.exe Token: SeAuditPrivilege 64 msiexec.exe Token: SeSystemEnvironmentPrivilege 64 msiexec.exe Token: SeChangeNotifyPrivilege 64 msiexec.exe Token: SeRemoteShutdownPrivilege 64 msiexec.exe Token: SeUndockPrivilege 64 msiexec.exe Token: SeSyncAgentPrivilege 64 msiexec.exe Token: SeEnableDelegationPrivilege 64 msiexec.exe Token: SeManageVolumePrivilege 64 msiexec.exe Token: SeImpersonatePrivilege 64 msiexec.exe Token: SeCreateGlobalPrivilege 64 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeIncreaseQuotaPrivilege 1368 WMIC.exe Token: SeSecurityPrivilege 1368 WMIC.exe Token: SeTakeOwnershipPrivilege 1368 WMIC.exe Token: SeLoadDriverPrivilege 1368 WMIC.exe Token: SeSystemProfilePrivilege 1368 WMIC.exe Token: SeSystemtimePrivilege 1368 WMIC.exe Token: SeProfSingleProcessPrivilege 1368 WMIC.exe Token: SeIncBasePriorityPrivilege 1368 WMIC.exe Token: SeCreatePagefilePrivilege 1368 WMIC.exe Token: SeBackupPrivilege 1368 WMIC.exe Token: SeRestorePrivilege 1368 WMIC.exe Token: SeShutdownPrivilege 1368 WMIC.exe Token: SeDebugPrivilege 1368 WMIC.exe Token: SeSystemEnvironmentPrivilege 1368 WMIC.exe Token: SeRemoteShutdownPrivilege 1368 WMIC.exe Token: SeUndockPrivilege 1368 WMIC.exe Token: SeManageVolumePrivilege 1368 WMIC.exe Token: 33 1368 WMIC.exe Token: 34 1368 WMIC.exe Token: 35 1368 WMIC.exe Token: 36 1368 WMIC.exe Token: SeRestorePrivilege 1824 msiexec.exe Token: SeTakeOwnershipPrivilege 1824 msiexec.exe Token: SeRestorePrivilege 1824 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 64 msiexec.exe 2308 MsiExec.exe 64 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2308 1824 msiexec.exe 71 PID 1824 wrote to memory of 2308 1824 msiexec.exe 71 PID 1824 wrote to memory of 2308 1824 msiexec.exe 71 PID 2308 wrote to memory of 1368 2308 MsiExec.exe 72 PID 2308 wrote to memory of 1368 2308 MsiExec.exe 72 PID 2308 wrote to memory of 1368 2308 MsiExec.exe 72 PID 900 wrote to memory of 2436 900 wdROHnZVvlkZEMv.exe 78 PID 900 wrote to memory of 2436 900 wdROHnZVvlkZEMv.exe 78 PID 900 wrote to memory of 2436 900 wdROHnZVvlkZEMv.exe 78 PID 2436 wrote to memory of 3872 2436 cmd.exe 80 PID 2436 wrote to memory of 3872 2436 cmd.exe 80 PID 2436 wrote to memory of 3872 2436 cmd.exe 80
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\load.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:64
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 14A8EB2391CFAC40CFD0C874A30751152⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\cryyUkYGbHLONZW\wdROHnZVvlkZEMv.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
-
C:\Users\Admin\cryyUkYGbHLONZW\wdROHnZVvlkZEMv.exeC:\Users\Admin\cryyUkYGbHLONZW\wdROHnZVvlkZEMv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\cryyUkYGbHLONZW\wdROHnZVvlkZEMv.exe /SC minute /MO 2 /IT /RU %USERNAME%2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\cryyUkYGbHLONZW\wdROHnZVvlkZEMv.exe /SC minute /MO 2 /IT /RU Admin3⤵
- Creates scheduled task(s)
PID:3872
-
-