Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27-04-2022 03:00
Static task
static1
Behavioral task
behavioral1
Sample
shipment.delievery.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
shipment.delievery.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
shipment.delievery.msi
-
Size
967KB
-
MD5
3c56483e8c0788b2862bfe0c490c865a
-
SHA1
3f541fbc9e927a718c1745b4b8d02f3768aa3fd2
-
SHA256
5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991
-
SHA512
ab45313032b3822b919b8a782422f15fd60f8c46cc61bb3294d937d98821795ab3b5089873419bbd9ada99357691759653a6fe50ba110ef04eee2bffba68ffe1
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 3240 MsiExec.exe 3240 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Windows directory 5 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Windows\Installer\e56d6fc.msi msiexec.exe File opened for modification C:\Windows\Installer\e56d6fc.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID7C7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDA0A.tmp msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e111c2ed168134740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e111c2ed0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900e111c2ed000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exesrtasks.exedescription pid Process Token: SeShutdownPrivilege 1604 msiexec.exe Token: SeIncreaseQuotaPrivilege 1604 msiexec.exe Token: SeSecurityPrivilege 2260 msiexec.exe Token: SeCreateTokenPrivilege 1604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1604 msiexec.exe Token: SeLockMemoryPrivilege 1604 msiexec.exe Token: SeIncreaseQuotaPrivilege 1604 msiexec.exe Token: SeMachineAccountPrivilege 1604 msiexec.exe Token: SeTcbPrivilege 1604 msiexec.exe Token: SeSecurityPrivilege 1604 msiexec.exe Token: SeTakeOwnershipPrivilege 1604 msiexec.exe Token: SeLoadDriverPrivilege 1604 msiexec.exe Token: SeSystemProfilePrivilege 1604 msiexec.exe Token: SeSystemtimePrivilege 1604 msiexec.exe Token: SeProfSingleProcessPrivilege 1604 msiexec.exe Token: SeIncBasePriorityPrivilege 1604 msiexec.exe Token: SeCreatePagefilePrivilege 1604 msiexec.exe Token: SeCreatePermanentPrivilege 1604 msiexec.exe Token: SeBackupPrivilege 1604 msiexec.exe Token: SeRestorePrivilege 1604 msiexec.exe Token: SeShutdownPrivilege 1604 msiexec.exe Token: SeDebugPrivilege 1604 msiexec.exe Token: SeAuditPrivilege 1604 msiexec.exe Token: SeSystemEnvironmentPrivilege 1604 msiexec.exe Token: SeChangeNotifyPrivilege 1604 msiexec.exe Token: SeRemoteShutdownPrivilege 1604 msiexec.exe Token: SeUndockPrivilege 1604 msiexec.exe Token: SeSyncAgentPrivilege 1604 msiexec.exe Token: SeEnableDelegationPrivilege 1604 msiexec.exe Token: SeManageVolumePrivilege 1604 msiexec.exe Token: SeImpersonatePrivilege 1604 msiexec.exe Token: SeCreateGlobalPrivilege 1604 msiexec.exe Token: SeBackupPrivilege 3524 vssvc.exe Token: SeRestorePrivilege 3524 vssvc.exe Token: SeAuditPrivilege 3524 vssvc.exe Token: SeBackupPrivilege 2260 msiexec.exe Token: SeRestorePrivilege 2260 msiexec.exe Token: SeRestorePrivilege 2260 msiexec.exe Token: SeTakeOwnershipPrivilege 2260 msiexec.exe Token: SeRestorePrivilege 2260 msiexec.exe Token: SeTakeOwnershipPrivilege 2260 msiexec.exe Token: SeRestorePrivilege 2260 msiexec.exe Token: SeTakeOwnershipPrivilege 2260 msiexec.exe Token: SeBackupPrivilege 204 srtasks.exe Token: SeRestorePrivilege 204 srtasks.exe Token: SeSecurityPrivilege 204 srtasks.exe Token: SeTakeOwnershipPrivilege 204 srtasks.exe Token: SeBackupPrivilege 204 srtasks.exe Token: SeRestorePrivilege 204 srtasks.exe Token: SeSecurityPrivilege 204 srtasks.exe Token: SeTakeOwnershipPrivilege 204 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 1604 msiexec.exe 1604 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 2260 wrote to memory of 204 2260 msiexec.exe 94 PID 2260 wrote to memory of 204 2260 msiexec.exe 94 PID 2260 wrote to memory of 3240 2260 msiexec.exe 96 PID 2260 wrote to memory of 3240 2260 msiexec.exe 96 PID 2260 wrote to memory of 3240 2260 msiexec.exe 96
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\shipment.delievery.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1604
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:204
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BBE0702A2EA31C405698E25A6C3A09122⤵
- Loads dropped DLL
PID:3240
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3524
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD538a4250c5e678728a0cdf126f1cdd937
SHA1d55553ab896f085fd5cd191022c64442c99f48a4
SHA25663c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08
SHA512cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894
-
Filesize
56KB
MD538a4250c5e678728a0cdf126f1cdd937
SHA1d55553ab896f085fd5cd191022c64442c99f48a4
SHA25663c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08
SHA512cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894
-
Filesize
56KB
MD538a4250c5e678728a0cdf126f1cdd937
SHA1d55553ab896f085fd5cd191022c64442c99f48a4
SHA25663c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08
SHA512cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894
-
Filesize
56KB
MD538a4250c5e678728a0cdf126f1cdd937
SHA1d55553ab896f085fd5cd191022c64442c99f48a4
SHA25663c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08
SHA512cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894
-
Filesize
23.0MB
MD5ec7bb88fbc7226ca69f9d0eb4eefc7f6
SHA1d2bd3bca8633e27588684f8ca0f455a3e0e59f04
SHA256adad0ceac4a78697ed295b1ce71275f4411a60f7db5c6f3118328281952fc49a
SHA51218e31accdc649d30b37d0d63e4bd8f4ca1e7ddfe3b524719a71b9f6369cd212a904924f3e4ba29e97e12311c585e6cf763a14c46767ffd8bf702b09a7b0629ba
-
\??\Volume{edc211e1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{27b858e3-915c-403e-aa22-81874d5a21a5}_OnDiskSnapshotProp
Filesize5KB
MD5281183b7fb1a6f6c4a2851f4cdbeebdf
SHA11505b2b8d66157c48182d2a58443d5945a2623e4
SHA25621bfdcee4a4e9da80c92ba7139cc34984648dc2d121fc6587a6900b2b6c0e808
SHA51227fd9ef7f8f6e64e2fc987b6b0bc98654a0a2308f94e68b8b1c999b0344ea73809881a0b9927e2656a9713643b06d07d1f56454fddfad4e5cd205b8e6d6abdff