Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
NFE_5394.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NFE_5394.msi
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target NFE_5394.msi
- Size 562KB
- Sample220209-r2fd2sagem
- SHA256 c7acc959e7dab12dd53aebb53fd10e05f0e201f0b348bed7bc5136a1463ca7ff
- MD5 d833ede15b113ee3e51a9aa3a0e33b57
- SHA1 0366e76a6d67da811922b2be553f0901126ffab8
- SHA512 303eab232924dbb65c2c23380b7fbce78c126dd33cdae285c9334e8a59f70b16bc6d8f5735361f154ac4a8723886cfefb9f39caf6f953f0fb5d0ea0aa5f7e3bb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Windows Executable Downloaded With Image Content-Type Header
suricata: ET MALWARE Windows Executable Downloaded With Image Content-Type Header
- Blocklisted process makes network request 1 IoCs
flow pid Process 15 2972 MsiExec.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe -
resource yara_rule behavioral2/files/0x000300000001e7ee-142.dat vmprotect behavioral2/files/0x000300000001e7ee-144.dat vmprotect behavioral2/files/0x000300000001e7ee-143.dat vmprotect behavioral2/memory/4960-156-0x0000000000CE0000-0x00000000030CC000-memory.dmp vmprotect - Loads dropped DLL 6 IoCs
pid Process 2972 MsiExec.exe 2972 MsiExec.exe 2972 MsiExec.exe 2972 MsiExec.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run Ã5TQ2T£C±S‰ŠJCGQWK0A.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xYF0lAF3mCH3tYC8xWF8 = "C:\\Users\\Admin\\AppData\\Local\\lCA8zNE3wLE4rVA0aIG9wJA6\\lCA8zNE3wLE4rVA0aIG9wJA6.exe" Ã5TQ2T£C±S‰ŠJCGQWK0A.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA0A6.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File created C:\Windows\Installer\SourceHash{F164612A-0CD4-4717-9AF5-B45FE788A3B9} msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\Installer\MSI9E04.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E73.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\Installer\1cd96fe.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9D67.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File created C:\Windows\Installer\1cd96fe.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9817.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\http:\13.58.89.178\contador\serv.php Ã5TQ2T£C±S‰ŠJCGQWK0A.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 42 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4112 msiexec.exe 4112 msiexec.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe 4960 Ã5TQ2T£C±S‰ŠJCGQWK0A.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 4112 msiexec.exe Token: SeCreateTokenPrivilege 2868 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2868 msiexec.exe Token: SeLockMemoryPrivilege 2868 msiexec.exe Token: SeIncreaseQuotaPrivilege 2868 msiexec.exe Token: SeMachineAccountPrivilege 2868 msiexec.exe Token: SeTcbPrivilege 2868 msiexec.exe Token: SeSecurityPrivilege 2868 msiexec.exe Token: SeTakeOwnershipPrivilege 2868 msiexec.exe Token: SeLoadDriverPrivilege 2868 msiexec.exe Token: SeSystemProfilePrivilege 2868 msiexec.exe Token: SeSystemtimePrivilege 2868 msiexec.exe Token: SeProfSingleProcessPrivilege 2868 msiexec.exe Token: SeIncBasePriorityPrivilege 2868 msiexec.exe Token: SeCreatePagefilePrivilege 2868 msiexec.exe Token: SeCreatePermanentPrivilege 2868 msiexec.exe Token: SeBackupPrivilege 2868 msiexec.exe Token: SeRestorePrivilege 2868 msiexec.exe Token: SeShutdownPrivilege 2868 msiexec.exe Token: SeDebugPrivilege 2868 msiexec.exe Token: SeAuditPrivilege 2868 msiexec.exe Token: SeSystemEnvironmentPrivilege 2868 msiexec.exe Token: SeChangeNotifyPrivilege 2868 msiexec.exe Token: SeRemoteShutdownPrivilege 2868 msiexec.exe Token: SeUndockPrivilege 2868 msiexec.exe Token: SeSyncAgentPrivilege 2868 msiexec.exe Token: SeEnableDelegationPrivilege 2868 msiexec.exe Token: SeManageVolumePrivilege 2868 msiexec.exe Token: SeImpersonatePrivilege 2868 msiexec.exe Token: SeCreateGlobalPrivilege 2868 msiexec.exe Token: SeRestorePrivilege 4112 msiexec.exe Token: SeTakeOwnershipPrivilege 4112 msiexec.exe Token: SeRestorePrivilege 4112 msiexec.exe Token: SeTakeOwnershipPrivilege 4112 msiexec.exe Token: SeRestorePrivilege 4112 msiexec.exe Token: SeTakeOwnershipPrivilege 4112 msiexec.exe Token: SeRestorePrivilege 4112 msiexec.exe Token: SeTakeOwnershipPrivilege 4112 msiexec.exe Token: SeRestorePrivilege 4112 msiexec.exe Token: SeTakeOwnershipPrivilege 4112 msiexec.exe Token: SeRestorePrivilege 4112 msiexec.exe Token: SeTakeOwnershipPrivilege 4112 msiexec.exe Token: SeShutdownPrivilege 2948 svchost.exe Token: SeCreatePagefilePrivilege 2948 svchost.exe Token: SeShutdownPrivilege 2948 svchost.exe Token: SeCreatePagefilePrivilege 2948 svchost.exe Token: SeShutdownPrivilege 2948 svchost.exe Token: SeCreatePagefilePrivilege 2948 svchost.exe Token: SeSecurityPrivilege 2764 TiWorker.exe Token: SeRestorePrivilege 2764 TiWorker.exe Token: SeBackupPrivilege 2764 TiWorker.exe Token: SeBackupPrivilege 2764 TiWorker.exe Token: SeRestorePrivilege 2764 TiWorker.exe Token: SeSecurityPrivilege 2764 TiWorker.exe Token: SeBackupPrivilege 2764 TiWorker.exe Token: SeRestorePrivilege 2764 TiWorker.exe Token: SeSecurityPrivilege 2764 TiWorker.exe Token: SeBackupPrivilege 2764 TiWorker.exe Token: SeRestorePrivilege 2764 TiWorker.exe Token: SeSecurityPrivilege 2764 TiWorker.exe Token: SeBackupPrivilege 2764 TiWorker.exe Token: SeRestorePrivilege 2764 TiWorker.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2868 msiexec.exe 2868 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4112 wrote to memory of 2972 4112 msiexec.exe 84 PID 4112 wrote to memory of 2972 4112 msiexec.exe 84 PID 4112 wrote to memory of 2972 4112 msiexec.exe 84 PID 2972 wrote to memory of 4960 2972 MsiExec.exe 91 PID 2972 wrote to memory of 4960 2972 MsiExec.exe 91 PID 2972 wrote to memory of 4960 2972 MsiExec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NFE_5394.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2868
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6983867D8D7CABF9B25F91A20BE8F7482⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Public\Documents\Ã5TQ2T£C±S‰ŠJCGQWK0A.exeC:\Users\Public\Documents\Ã5TQ2T£C±S‰ŠJCGQWK0A.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2764