Analysis
-
max time kernel
4294181s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
24/03/2022, 21:02
Static task
static1
Behavioral task
behavioral1
Sample
3d85cd032360a85b03cdf182a052bde12ab8084ba19a82b7cdff2cbba06b89e9.msi
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3d85cd032360a85b03cdf182a052bde12ab8084ba19a82b7cdff2cbba06b89e9.msi
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3d85cd032360a85b03cdf182a052bde12ab8084ba19a82b7cdff2cbba06b89e9.msi
-
Size
865KB
-
MD5
8296e7857eb86fe59e304ff64b48d839
-
SHA1
9696bc7a2708e3ec4ff53aa951928c4f69083684
-
SHA256
3d85cd032360a85b03cdf182a052bde12ab8084ba19a82b7cdff2cbba06b89e9
-
SHA512
84d5f99db5ab010c7610d89165a40029faa1bd4d632492a5b6f92126992e2f92c8e00fa76de7b3f3b75abe598246e0b894d9972f0a556221049d03eedf58e0ad
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1500 MsiExec.exe 1500 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1960 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 576 msiexec.exe Token: SeTakeOwnershipPrivilege 576 msiexec.exe Token: SeSecurityPrivilege 576 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1960 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 576 wrote to memory of 1500 576 msiexec.exe 28 PID 576 wrote to memory of 1500 576 msiexec.exe 28 PID 576 wrote to memory of 1500 576 msiexec.exe 28 PID 576 wrote to memory of 1500 576 msiexec.exe 28 PID 576 wrote to memory of 1500 576 msiexec.exe 28 PID 576 wrote to memory of 1500 576 msiexec.exe 28 PID 576 wrote to memory of 1500 576 msiexec.exe 28
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3d85cd032360a85b03cdf182a052bde12ab8084ba19a82b7cdff2cbba06b89e9.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1960
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8D0A7DCA1036EDF008624A7D420D734 C2⤵
- Loads dropped DLL
PID:1500
-