Analysis
- max time kernel
123s - max time network
140s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
d4bbdb9ea536f4f5ecf6038a2d50f71f284c84ed24558f04228c1d2ee55a47b6.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target d4bbdb9ea536f4f5ecf6038a2d50f71f284c84ed24558f04228c1d2ee55a47b6.msi
- Size 9.2MB
- Sample220128-wqfb5aaadk
- SHA256 d4bbdb9ea536f4f5ecf6038a2d50f71f284c84ed24558f04228c1d2ee55a47b6
- MD5 7467ba65ac6433e9df3e237d3e4bf355
- SHA1 7d356d3a24a0700354848fd5af9be12c62137781
- SHA512 8b94db6dbc4654346da1a4b17caea78a255e8dde368456bb22addaaed1b95ceb03c292aaea5ff8062c6901d2ea5131f9b81e9a71bcb213c74ac2f96f7fceb01a
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 9 2784 msiexec.exe 10 2784 msiexec.exe 12 2784 msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 1216 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2784 msiexec.exe Token: SeIncreaseQuotaPrivilege 2784 msiexec.exe Token: SeSecurityPrivilege 3456 msiexec.exe Token: SeCreateTokenPrivilege 2784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2784 msiexec.exe Token: SeLockMemoryPrivilege 2784 msiexec.exe Token: SeIncreaseQuotaPrivilege 2784 msiexec.exe Token: SeMachineAccountPrivilege 2784 msiexec.exe Token: SeTcbPrivilege 2784 msiexec.exe Token: SeSecurityPrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeLoadDriverPrivilege 2784 msiexec.exe Token: SeSystemProfilePrivilege 2784 msiexec.exe Token: SeSystemtimePrivilege 2784 msiexec.exe Token: SeProfSingleProcessPrivilege 2784 msiexec.exe Token: SeIncBasePriorityPrivilege 2784 msiexec.exe Token: SeCreatePagefilePrivilege 2784 msiexec.exe Token: SeCreatePermanentPrivilege 2784 msiexec.exe Token: SeBackupPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeShutdownPrivilege 2784 msiexec.exe Token: SeDebugPrivilege 2784 msiexec.exe Token: SeAuditPrivilege 2784 msiexec.exe Token: SeSystemEnvironmentPrivilege 2784 msiexec.exe Token: SeChangeNotifyPrivilege 2784 msiexec.exe Token: SeRemoteShutdownPrivilege 2784 msiexec.exe Token: SeUndockPrivilege 2784 msiexec.exe Token: SeSyncAgentPrivilege 2784 msiexec.exe Token: SeEnableDelegationPrivilege 2784 msiexec.exe Token: SeManageVolumePrivilege 2784 msiexec.exe Token: SeImpersonatePrivilege 2784 msiexec.exe Token: SeCreateGlobalPrivilege 2784 msiexec.exe Token: SeCreateTokenPrivilege 2784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2784 msiexec.exe Token: SeLockMemoryPrivilege 2784 msiexec.exe Token: SeIncreaseQuotaPrivilege 2784 msiexec.exe Token: SeMachineAccountPrivilege 2784 msiexec.exe Token: SeTcbPrivilege 2784 msiexec.exe Token: SeSecurityPrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeLoadDriverPrivilege 2784 msiexec.exe Token: SeSystemProfilePrivilege 2784 msiexec.exe Token: SeSystemtimePrivilege 2784 msiexec.exe Token: SeProfSingleProcessPrivilege 2784 msiexec.exe Token: SeIncBasePriorityPrivilege 2784 msiexec.exe Token: SeCreatePagefilePrivilege 2784 msiexec.exe Token: SeCreatePermanentPrivilege 2784 msiexec.exe Token: SeBackupPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeShutdownPrivilege 2784 msiexec.exe Token: SeDebugPrivilege 2784 msiexec.exe Token: SeAuditPrivilege 2784 msiexec.exe Token: SeSystemEnvironmentPrivilege 2784 msiexec.exe Token: SeChangeNotifyPrivilege 2784 msiexec.exe Token: SeRemoteShutdownPrivilege 2784 msiexec.exe Token: SeUndockPrivilege 2784 msiexec.exe Token: SeSyncAgentPrivilege 2784 msiexec.exe Token: SeEnableDelegationPrivilege 2784 msiexec.exe Token: SeManageVolumePrivilege 2784 msiexec.exe Token: SeImpersonatePrivilege 2784 msiexec.exe Token: SeCreateGlobalPrivilege 2784 msiexec.exe Token: SeCreateTokenPrivilege 2784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2784 msiexec.exe Token: SeLockMemoryPrivilege 2784 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2784 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3456 wrote to memory of 1216 3456 msiexec.exe 70 PID 3456 wrote to memory of 1216 3456 msiexec.exe 70 PID 3456 wrote to memory of 1216 3456 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d4bbdb9ea536f4f5ecf6038a2d50f71f284c84ed24558f04228c1d2ee55a47b6.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2784
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2FEDD81E00BBA2C46BB55173EAEC2BCE C2⤵
- Loads dropped DLL
PID:1216
-