Analysis
- max time kernel
132s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
20/02/2022, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
DOC Nº 0536721657986767009.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DOC Nº 0536721657986767009.msi
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target DOC Nº 0536721657986767009.msi
- Size 264KB
- Sample220220-n8836abdb6
- SHA256 0d3d441cfce5ddd49ea62dcc542facbbc705f137e7bb11b61c0a86a344c6b78f
- MD5 6fab37d33f1728ef246aa7d2cc20ad42
- SHA1 1f1c40af53ccc3f6c2ea42662b2a938b7a63bbdc
- SHA512 1ba4c4e93057b94769c3f9e8533163f3107812786b60f3b44e13ff547a9c764110340fe4fb267be2cce9cbf5a776f50a94846e7639d45f0c0b1c711fe90f9fc3
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 18 4444 MsiExec.exe - Loads dropped DLL 2 IoCs
pid Process 4444 MsiExec.exe 4444 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6CA2.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7157.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\Installer\1cd6b4a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{584E7728-2487-49DA-83A8-D19EF5D84E89} msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File created C:\Windows\Installer\1cd6b4a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6F04.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4100 msiexec.exe 4100 msiexec.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2800 msiexec.exe Token: SeIncreaseQuotaPrivilege 2800 msiexec.exe Token: SeSecurityPrivilege 4100 msiexec.exe Token: SeCreateTokenPrivilege 2800 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2800 msiexec.exe Token: SeLockMemoryPrivilege 2800 msiexec.exe Token: SeIncreaseQuotaPrivilege 2800 msiexec.exe Token: SeMachineAccountPrivilege 2800 msiexec.exe Token: SeTcbPrivilege 2800 msiexec.exe Token: SeSecurityPrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeLoadDriverPrivilege 2800 msiexec.exe Token: SeSystemProfilePrivilege 2800 msiexec.exe Token: SeSystemtimePrivilege 2800 msiexec.exe Token: SeProfSingleProcessPrivilege 2800 msiexec.exe Token: SeIncBasePriorityPrivilege 2800 msiexec.exe Token: SeCreatePagefilePrivilege 2800 msiexec.exe Token: SeCreatePermanentPrivilege 2800 msiexec.exe Token: SeBackupPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeShutdownPrivilege 2800 msiexec.exe Token: SeDebugPrivilege 2800 msiexec.exe Token: SeAuditPrivilege 2800 msiexec.exe Token: SeSystemEnvironmentPrivilege 2800 msiexec.exe Token: SeChangeNotifyPrivilege 2800 msiexec.exe Token: SeRemoteShutdownPrivilege 2800 msiexec.exe Token: SeUndockPrivilege 2800 msiexec.exe Token: SeSyncAgentPrivilege 2800 msiexec.exe Token: SeEnableDelegationPrivilege 2800 msiexec.exe Token: SeManageVolumePrivilege 2800 msiexec.exe Token: SeImpersonatePrivilege 2800 msiexec.exe Token: SeCreateGlobalPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeShutdownPrivilege 1464 svchost.exe Token: SeCreatePagefilePrivilege 1464 svchost.exe Token: SeShutdownPrivilege 1464 svchost.exe Token: SeCreatePagefilePrivilege 1464 svchost.exe Token: SeShutdownPrivilege 1464 svchost.exe Token: SeCreatePagefilePrivilege 1464 svchost.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2800 msiexec.exe 2800 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4100 wrote to memory of 4444 4100 msiexec.exe 84 PID 4100 wrote to memory of 4444 4100 msiexec.exe 84 PID 4100 wrote to memory of 4444 4100 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\DOC Nº 0536721657986767009.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2800
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4952BEB63AF09DBE28DB8EBA9E42803B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4444
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1464