Overview

overview

8

Static

static

Pago_ARCHI...56.msi

windows7_x64

7

Pago_ARCHI...56.msi

windows10-2004_x64

8

Analysis

  • max time kernel
    124s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    06/04/2022, 08:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi
  • Size 3.2MB
  • Sample220406-kw59yscae5
  • SHA256 d95edec180d7c2ea69585c2e2fe6f7d30421fe0974b38afdc88a4ba756514cd6
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 17 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5008
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3844
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 74010B55C6719792F48CB87303A1B24F
        2⤵
        • Loads dropped DLL
        PID:116
      • C:\Users\Admin\AppData\Roaming\Svchosts\InformacionServices4\irfjs7\serviceis.exe
        "C:\Users\Admin\AppData\Roaming\Svchosts\InformacionServices4\irfjs7\serviceis.exe"
        2⤵
        • Executes dropped EXE
        PID:1420
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4036
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4160

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          JSON.ahk
          • Path C:\Users\Admin\AppData\Roaming\Svchosts\InformacionServices4\irfjs7\JSON.ahk
          • Size 11KB
          • SHA256 bb85e4530ccd6355b3ef3506548b4f513bea844d1af37a69624c9c455521c70f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          serviceis.ahk
          • Path C:\Users\Admin\AppData\Roaming\Svchosts\InformacionServices4\irfjs7\serviceis.ahk
          • Size 2KB
          • SHA256 91b659c548f242417e03916283c73433b4f30fcd091336170bbaf9ccdc1ececf
          • MD5 SHA1 SHA512
          Submit Download

          serviceis.exe
          • Path C:\Users\Admin\AppData\Roaming\Svchosts\InformacionServices4\irfjs7\serviceis.exe
          • Size 884KB
          • SHA256 3242e0a736ef8ac90430a9f272ff30a81e2afc146fcb84a25c6e56e8192791e4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIBFAB.tmp
          • Path C:\Windows\Installer\MSIBFAB.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIBFAB.tmp
          • Path C:\Windows\Installer\MSIBFAB.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC20D.tmp
          • Path C:\Windows\Installer\MSIC20D.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC20D.tmp
          • Path C:\Windows\Installer\MSIC20D.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC308.tmp
          • Path C:\Windows\Installer\MSIC308.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC308.tmp
          • Path C:\Windows\Installer\MSIC308.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC396.tmp
          • Path C:\Windows\Installer\MSIC396.tmp
          • Size 860KB
          • SHA256 b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC396.tmp
          • Path C:\Windows\Installer\MSIC396.tmp
          • Size 860KB
          • SHA256 b29ab4744ff6c8c9c440e878abf6f76255c538e71564e6a6279513b543be0538
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC491.tmp
          • Path C:\Windows\Installer\MSIC491.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC491.tmp
          • Path C:\Windows\Installer\MSIC491.tmp
          • Size 376KB
          • SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC697.tmp
          • Path C:\Windows\Installer\MSIC697.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC697.tmp
          • Path C:\Windows\Installer\MSIC697.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC7D0.tmp
          • Path C:\Windows\Installer\MSIC7D0.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC7D0.tmp
          • Path C:\Windows\Installer\MSIC7D0.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC85E.tmp
          • Path C:\Windows\Installer\MSIC85E.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC85E.tmp
          • Path C:\Windows\Installer\MSIC85E.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC9C6.tmp
          • Path C:\Windows\Installer\MSIC9C6.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIC9C6.tmp
          • Path C:\Windows\Installer\MSIC9C6.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSICB7D.tmp
          • Path C:\Windows\Installer\MSICB7D.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSICB7D.tmp
          • Path C:\Windows\Installer\MSICB7D.tmp
          • Size 663KB
          • SHA256 08c8ca31a5b892e9c7159361d668a28766d611ec879be073a9157c9ece03cf2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 21.4MB
          • SHA256 f93ef72b52ffcf900f473d28880c740372181107884cd555ad52b864724de2dc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {b3c687e1-39bd-4adb-b958-60ddcb27a433}_OnDiskSnapshotProp
          • Path \??\Volume{a02f78f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b3c687e1-39bd-4adb-b958-60ddcb27a433}_OnDiskSnapshotProp
          • Size 5KB
          • SHA256 aaf0efc7980fd3908b3f03b5841085efa5d86f02b47e8872a7f79624c07987a3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download