Analysis
- max time kernel
42s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
06/04/2022, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi
- Size 3.2MB
- Sample220406-kw59yscae5
- SHA256 d95edec180d7c2ea69585c2e2fe6f7d30421fe0974b38afdc88a4ba756514cd6
- MD5 44715ede5a070a9689aa738c2a904dae
- SHA1 72a7a0754accbbe1523240bb058e9137245647fc
- SHA512 9f6b4638963b842444ed1782464ebb9ef65437ebddebf148f7ae12174e85a7f4e7e4985b504bed45c8ccabde6f0979b94718f48a217e35d8b3c30368413c2048
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 1556 MsiExec.exe 1556 MsiExec.exe 1556 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6c6b71.msi msiexec.exe File opened for modification C:\Windows\Installer\6c6b71.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6BCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6E9D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7246.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe - Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 1616 msiexec.exe Token: SeIncreaseQuotaPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe Token: SeSecurityPrivilege 1864 msiexec.exe Token: SeCreateTokenPrivilege 1616 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1616 msiexec.exe Token: SeLockMemoryPrivilege 1616 msiexec.exe Token: SeIncreaseQuotaPrivilege 1616 msiexec.exe Token: SeMachineAccountPrivilege 1616 msiexec.exe Token: SeTcbPrivilege 1616 msiexec.exe Token: SeSecurityPrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeLoadDriverPrivilege 1616 msiexec.exe Token: SeSystemProfilePrivilege 1616 msiexec.exe Token: SeSystemtimePrivilege 1616 msiexec.exe Token: SeProfSingleProcessPrivilege 1616 msiexec.exe Token: SeIncBasePriorityPrivilege 1616 msiexec.exe Token: SeCreatePagefilePrivilege 1616 msiexec.exe Token: SeCreatePermanentPrivilege 1616 msiexec.exe Token: SeBackupPrivilege 1616 msiexec.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeShutdownPrivilege 1616 msiexec.exe Token: SeDebugPrivilege 1616 msiexec.exe Token: SeAuditPrivilege 1616 msiexec.exe Token: SeSystemEnvironmentPrivilege 1616 msiexec.exe Token: SeChangeNotifyPrivilege 1616 msiexec.exe Token: SeRemoteShutdownPrivilege 1616 msiexec.exe Token: SeUndockPrivilege 1616 msiexec.exe Token: SeSyncAgentPrivilege 1616 msiexec.exe Token: SeEnableDelegationPrivilege 1616 msiexec.exe Token: SeManageVolumePrivilege 1616 msiexec.exe Token: SeImpersonatePrivilege 1616 msiexec.exe Token: SeCreateGlobalPrivilege 1616 msiexec.exe Token: SeBackupPrivilege 1216 vssvc.exe Token: SeRestorePrivilege 1216 vssvc.exe Token: SeAuditPrivilege 1216 vssvc.exe Token: SeBackupPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1432 DrvInst.exe Token: SeLoadDriverPrivilege 1432 DrvInst.exe Token: SeLoadDriverPrivilege 1432 DrvInst.exe Token: SeLoadDriverPrivilege 1432 DrvInst.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe Token: SeRestorePrivilege 1864 msiexec.exe Token: SeTakeOwnershipPrivilege 1864 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1616 msiexec.exe 1616 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1864 wrote to memory of 1556 1864 msiexec.exe 32 PID 1864 wrote to memory of 1556 1864 msiexec.exe 32 PID 1864 wrote to memory of 1556 1864 msiexec.exe 32 PID 1864 wrote to memory of 1556 1864 msiexec.exe 32 PID 1864 wrote to memory of 1556 1864 msiexec.exe 32 PID 1864 wrote to memory of 1556 1864 msiexec.exe 32 PID 1864 wrote to memory of 1556 1864 msiexec.exe 32
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1616
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BAC73CC2D95FC1245ECF855181A432F12⤵
- Loads dropped DLL
PID:1556
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000598" "00000000000004A0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI6BCE.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6E9D.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7246.tmp
- Size 860KB
- SHA256 b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538
- MD5 71b541254864bd52f85e932e2040cbe8
- SHA1 713766e1818f8d7ca814c86109c9cdd5d57914ef
- SHA512 4d2e0a30fd6729eb40fad358795db152327b0441da574052a371762f33c9f9e7b9a77c4a4762207bcb401a2d3ef6438730c245916f4a81cd20f748857d5170d2
- SSDEEP 24576:E/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/co0OI++qHfV5xJd9zlY:hKtulJl7VFv1lxKOC8fE/co0Oj+qHfV8
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI6BCE.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI6E9D.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI7246.tmp
- Size 860KB
- SHA256 b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538
- MD5 71b541254864bd52f85e932e2040cbe8
- SHA1 713766e1818f8d7ca814c86109c9cdd5d57914ef
- SHA512 4d2e0a30fd6729eb40fad358795db152327b0441da574052a371762f33c9f9e7b9a77c4a4762207bcb401a2d3ef6438730c245916f4a81cd20f748857d5170d2
- SSDEEP 24576:E/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/co0OI++qHfV5xJd9zlY:hKtulJl7VFv1lxKOC8fE/co0Oj+qHfV8
- MD5 SHA1 SHA512 SSDEEP