Analysis
-
max time kernel
90s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
13-04-2022 09:03
Static task
static1
Behavioral task
behavioral1
Sample
9c50e1ae7b75476930888da58db8fdf2.msi
Resource
win7-20220331-en
windows7_x64
Behavioral task
behavioral2
Sample
9c50e1ae7b75476930888da58db8fdf2.msi
Resource
win10v2004-20220331-en
windows10-2004_x64
General
-
Target
9c50e1ae7b75476930888da58db8fdf2.msi
-
Size
768KB
-
MD5
9c50e1ae7b75476930888da58db8fdf2
-
SHA1
c9a60dcefda2a90eecc5b540c4cf277c15c7ab8b
-
SHA256
96cbaba8d3f4e43f1456af0d4ed8f56280f3a716c3819059ffe58308e710f3d7
-
SHA512
fa66cb96975408fe6be2d82a9487082e78a8f8a9e55e0089226483a7ebfad6f4282d581977764e69136aa41350eb22dac4d26b585e9efcc3d7748cc8b90e71d3
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 2016 MsiExec.exe 2016 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc Process File opened for modification C:\Windows\Installer\MSI8AD3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8E5C.tmp msiexec.exe File created C:\Windows\Installer\6c9040.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3E5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c9040.ipi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 1240 msiexec.exe 1240 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 832 msiexec.exe Token: SeIncreaseQuotaPrivilege 832 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeSecurityPrivilege 1240 msiexec.exe Token: SeCreateTokenPrivilege 832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 832 msiexec.exe Token: SeLockMemoryPrivilege 832 msiexec.exe Token: SeIncreaseQuotaPrivilege 832 msiexec.exe Token: SeMachineAccountPrivilege 832 msiexec.exe Token: SeTcbPrivilege 832 msiexec.exe Token: SeSecurityPrivilege 832 msiexec.exe Token: SeTakeOwnershipPrivilege 832 msiexec.exe Token: SeLoadDriverPrivilege 832 msiexec.exe Token: SeSystemProfilePrivilege 832 msiexec.exe Token: SeSystemtimePrivilege 832 msiexec.exe Token: SeProfSingleProcessPrivilege 832 msiexec.exe Token: SeIncBasePriorityPrivilege 832 msiexec.exe Token: SeCreatePagefilePrivilege 832 msiexec.exe Token: SeCreatePermanentPrivilege 832 msiexec.exe Token: SeBackupPrivilege 832 msiexec.exe Token: SeRestorePrivilege 832 msiexec.exe Token: SeShutdownPrivilege 832 msiexec.exe Token: SeDebugPrivilege 832 msiexec.exe Token: SeAuditPrivilege 832 msiexec.exe Token: SeSystemEnvironmentPrivilege 832 msiexec.exe Token: SeChangeNotifyPrivilege 832 msiexec.exe Token: SeRemoteShutdownPrivilege 832 msiexec.exe Token: SeUndockPrivilege 832 msiexec.exe Token: SeSyncAgentPrivilege 832 msiexec.exe Token: SeEnableDelegationPrivilege 832 msiexec.exe Token: SeManageVolumePrivilege 832 msiexec.exe Token: SeImpersonatePrivilege 832 msiexec.exe Token: SeCreateGlobalPrivilege 832 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 832 msiexec.exe 832 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 1240 wrote to memory of 2016 1240 msiexec.exe 29 PID 1240 wrote to memory of 2016 1240 msiexec.exe 29 PID 1240 wrote to memory of 2016 1240 msiexec.exe 29 PID 1240 wrote to memory of 2016 1240 msiexec.exe 29 PID 1240 wrote to memory of 2016 1240 msiexec.exe 29 PID 1240 wrote to memory of 2016 1240 msiexec.exe 29 PID 1240 wrote to memory of 2016 1240 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9c50e1ae7b75476930888da58db8fdf2.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:832
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8EA5B1DB6E8681DF15C1822024B6DD242⤵
- Loads dropped DLL
PID:2016
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2