Analysis
- max time kernel
111s - max time network
134s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
a4dca8dee896ef0ecf96b45d997cda8f3e6806eb219acd54eb815a02d481998f.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target a4dca8dee896ef0ecf96b45d997cda8f3e6806eb219acd54eb815a02d481998f.msi
- Size 9.0MB
- Sample220128-xvvs2sbfa9
- SHA256 a4dca8dee896ef0ecf96b45d997cda8f3e6806eb219acd54eb815a02d481998f
- MD5 121cc363933928040be73ece203d670a
- SHA1 20f0f4877a949ca35a86af1bbd5a227f0e18a5f0
- SHA512 a61aa87b8d65528bb99420e15a2f5e8dec43744c279a5eaaffc263d5e1978d9e36cbaadfb64bfb6781693b2d6570e4485d04ac2a2562127824d9f6cd63643d72
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 8 3604 msiexec.exe 10 3604 msiexec.exe 12 3604 msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 4164 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3604 msiexec.exe Token: SeIncreaseQuotaPrivilege 3604 msiexec.exe Token: SeSecurityPrivilege 3948 msiexec.exe Token: SeCreateTokenPrivilege 3604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3604 msiexec.exe Token: SeLockMemoryPrivilege 3604 msiexec.exe Token: SeIncreaseQuotaPrivilege 3604 msiexec.exe Token: SeMachineAccountPrivilege 3604 msiexec.exe Token: SeTcbPrivilege 3604 msiexec.exe Token: SeSecurityPrivilege 3604 msiexec.exe Token: SeTakeOwnershipPrivilege 3604 msiexec.exe Token: SeLoadDriverPrivilege 3604 msiexec.exe Token: SeSystemProfilePrivilege 3604 msiexec.exe Token: SeSystemtimePrivilege 3604 msiexec.exe Token: SeProfSingleProcessPrivilege 3604 msiexec.exe Token: SeIncBasePriorityPrivilege 3604 msiexec.exe Token: SeCreatePagefilePrivilege 3604 msiexec.exe Token: SeCreatePermanentPrivilege 3604 msiexec.exe Token: SeBackupPrivilege 3604 msiexec.exe Token: SeRestorePrivilege 3604 msiexec.exe Token: SeShutdownPrivilege 3604 msiexec.exe Token: SeDebugPrivilege 3604 msiexec.exe Token: SeAuditPrivilege 3604 msiexec.exe Token: SeSystemEnvironmentPrivilege 3604 msiexec.exe Token: SeChangeNotifyPrivilege 3604 msiexec.exe Token: SeRemoteShutdownPrivilege 3604 msiexec.exe Token: SeUndockPrivilege 3604 msiexec.exe Token: SeSyncAgentPrivilege 3604 msiexec.exe Token: SeEnableDelegationPrivilege 3604 msiexec.exe Token: SeManageVolumePrivilege 3604 msiexec.exe Token: SeImpersonatePrivilege 3604 msiexec.exe Token: SeCreateGlobalPrivilege 3604 msiexec.exe Token: SeCreateTokenPrivilege 3604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3604 msiexec.exe Token: SeLockMemoryPrivilege 3604 msiexec.exe Token: SeIncreaseQuotaPrivilege 3604 msiexec.exe Token: SeMachineAccountPrivilege 3604 msiexec.exe Token: SeTcbPrivilege 3604 msiexec.exe Token: SeSecurityPrivilege 3604 msiexec.exe Token: SeTakeOwnershipPrivilege 3604 msiexec.exe Token: SeLoadDriverPrivilege 3604 msiexec.exe Token: SeSystemProfilePrivilege 3604 msiexec.exe Token: SeSystemtimePrivilege 3604 msiexec.exe Token: SeProfSingleProcessPrivilege 3604 msiexec.exe Token: SeIncBasePriorityPrivilege 3604 msiexec.exe Token: SeCreatePagefilePrivilege 3604 msiexec.exe Token: SeCreatePermanentPrivilege 3604 msiexec.exe Token: SeBackupPrivilege 3604 msiexec.exe Token: SeRestorePrivilege 3604 msiexec.exe Token: SeShutdownPrivilege 3604 msiexec.exe Token: SeDebugPrivilege 3604 msiexec.exe Token: SeAuditPrivilege 3604 msiexec.exe Token: SeSystemEnvironmentPrivilege 3604 msiexec.exe Token: SeChangeNotifyPrivilege 3604 msiexec.exe Token: SeRemoteShutdownPrivilege 3604 msiexec.exe Token: SeUndockPrivilege 3604 msiexec.exe Token: SeSyncAgentPrivilege 3604 msiexec.exe Token: SeEnableDelegationPrivilege 3604 msiexec.exe Token: SeManageVolumePrivilege 3604 msiexec.exe Token: SeImpersonatePrivilege 3604 msiexec.exe Token: SeCreateGlobalPrivilege 3604 msiexec.exe Token: SeCreateTokenPrivilege 3604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3604 msiexec.exe Token: SeLockMemoryPrivilege 3604 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3604 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4164 3948 msiexec.exe 70 PID 3948 wrote to memory of 4164 3948 msiexec.exe 70 PID 3948 wrote to memory of 4164 3948 msiexec.exe 70
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a4dca8dee896ef0ecf96b45d997cda8f3e6806eb219acd54eb815a02d481998f.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3604
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3303983817EB4B9021E676A47B1870FA C2⤵
- Loads dropped DLL
PID:4164
-