Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    13-02-2022 12:31

General

  • Target

    05036d5462ca70ebd709ba9218f07ff16a8d5cfa33dbf19b8407fff404df9581.msi

  • Size

    382KB

  • MD5

    a49c0e0d1ca8a829a8175a3931e5cba1

  • SHA1

    efa1b8275c6b1b1b7a5a21ecab8aec9f0fbea6f1

  • SHA256

    05036d5462ca70ebd709ba9218f07ff16a8d5cfa33dbf19b8407fff404df9581

  • SHA512

    50e036a03741c8465d38b66d3d27741f2f1f580cd0c54daeac254b2ada3b1d3d21310f9a522f2606e01943401d7756ac976e95e8b444712008109ccc756a80b2

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\05036d5462ca70ebd709ba9218f07ff16a8d5cfa33dbf19b8407fff404df9581.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1212
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1408
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1120

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1212-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

    Filesize

    8KB