Analysis
- max time kernel
139s - max time network
150s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
06/02/2022, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi
- Size 2.2MB
- Sample220206-qa4rwsaedm
- SHA256 490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb
- MD5 3a8af2810c28d0eac73f55fb5efb63c2
- SHA1 fcc72c86caafc640c7ca831bf9e1fbb2341f6895
- SHA512 cc490c53a66e13548a20e301616c09ab1e1fabc25b64000b0f9c13dfc570d43c8f4b259f431147ab6dc60a33a837dafb0e356f330fdc796552c33d61232de839
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 4 IoCs
flow pid Process 5 1564 MsiExec.exe 7 1564 MsiExec.exe 9 1564 MsiExec.exe 11 1564 MsiExec.exe - Executes dropped EXE 2 IoCs
pid Process 664 MSI306D.tmp 1668 Escudo.exe - Loads dropped DLL 9 IoCs
pid Process 1564 MsiExec.exe 1564 MsiExec.exe 1564 MsiExec.exe 1564 MsiExec.exe 1564 MsiExec.exe 1564 MsiExec.exe 1564 MsiExec.exe 1564 MsiExec.exe 1668 Escudo.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\39961.msi msiexec.exe File opened for modification C:\Windows\Installer\39961.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDD57.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE1BE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB413.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBC4F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F23.tmp msiexec.exe File opened for modification C:\Windows\Installer\39963.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9AB8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB452.tmp msiexec.exe File created C:\Windows\Installer\39963.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIDEA1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI306D.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1680 msiexec.exe 1680 msiexec.exe - Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeSecurityPrivilege 1680 msiexec.exe Token: SeCreateTokenPrivilege 1284 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1284 msiexec.exe Token: SeLockMemoryPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeMachineAccountPrivilege 1284 msiexec.exe Token: SeTcbPrivilege 1284 msiexec.exe Token: SeSecurityPrivilege 1284 msiexec.exe Token: SeTakeOwnershipPrivilege 1284 msiexec.exe Token: SeLoadDriverPrivilege 1284 msiexec.exe Token: SeSystemProfilePrivilege 1284 msiexec.exe Token: SeSystemtimePrivilege 1284 msiexec.exe Token: SeProfSingleProcessPrivilege 1284 msiexec.exe Token: SeIncBasePriorityPrivilege 1284 msiexec.exe Token: SeCreatePagefilePrivilege 1284 msiexec.exe Token: SeCreatePermanentPrivilege 1284 msiexec.exe Token: SeBackupPrivilege 1284 msiexec.exe Token: SeRestorePrivilege 1284 msiexec.exe Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeDebugPrivilege 1284 msiexec.exe Token: SeAuditPrivilege 1284 msiexec.exe Token: SeSystemEnvironmentPrivilege 1284 msiexec.exe Token: SeChangeNotifyPrivilege 1284 msiexec.exe Token: SeRemoteShutdownPrivilege 1284 msiexec.exe Token: SeUndockPrivilege 1284 msiexec.exe Token: SeSyncAgentPrivilege 1284 msiexec.exe Token: SeEnableDelegationPrivilege 1284 msiexec.exe Token: SeManageVolumePrivilege 1284 msiexec.exe Token: SeImpersonatePrivilege 1284 msiexec.exe Token: SeCreateGlobalPrivilege 1284 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe Token: SeRestorePrivilege 1680 msiexec.exe Token: SeTakeOwnershipPrivilege 1680 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1284 msiexec.exe 1284 msiexec.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 1564 1680 msiexec.exe 28 PID 1680 wrote to memory of 664 1680 msiexec.exe 32 PID 1680 wrote to memory of 664 1680 msiexec.exe 32 PID 1680 wrote to memory of 664 1680 msiexec.exe 32 PID 1680 wrote to memory of 664 1680 msiexec.exe 32 PID 1680 wrote to memory of 664 1680 msiexec.exe 32 PID 1680 wrote to memory of 664 1680 msiexec.exe 32 PID 1680 wrote to memory of 664 1680 msiexec.exe 32
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1284
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7D0B763D724126EC9150EADDF527DBB2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1564
-
-
C:\Windows\Installer\MSI306D.tmp"C:\Windows\Installer\MSI306D.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"2⤵
- Executes dropped EXE
PID:664
-
-
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668