Analysis
-
max time kernel
58s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 16:42
Static task
static1
Behavioral task
behavioral1
Sample
shipment.delievery.msi
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
shipment.delievery.msi
Resource
win10v2004-20220414-en
General
-
Target
shipment.delievery.msi
-
Size
967KB
-
MD5
3c56483e8c0788b2862bfe0c490c865a
-
SHA1
3f541fbc9e927a718c1745b4b8d02f3768aa3fd2
-
SHA256
5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991
-
SHA512
ab45313032b3822b919b8a782422f15fd60f8c46cc61bb3294d937d98821795ab3b5089873419bbd9ada99357691759653a6fe50ba110ef04eee2bffba68ffe1
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 1772 MsiExec.exe 1772 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIE2C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE4B6.tmp msiexec.exe File created C:\Windows\Installer\6be571.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB36A.tmp msiexec.exe File opened for modification C:\Windows\Installer\6be571.ipi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1268 msiexec.exe 1268 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1560 msiexec.exe Token: SeIncreaseQuotaPrivilege 1560 msiexec.exe Token: SeRestorePrivilege 1268 msiexec.exe Token: SeTakeOwnershipPrivilege 1268 msiexec.exe Token: SeSecurityPrivilege 1268 msiexec.exe Token: SeCreateTokenPrivilege 1560 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1560 msiexec.exe Token: SeLockMemoryPrivilege 1560 msiexec.exe Token: SeIncreaseQuotaPrivilege 1560 msiexec.exe Token: SeMachineAccountPrivilege 1560 msiexec.exe Token: SeTcbPrivilege 1560 msiexec.exe Token: SeSecurityPrivilege 1560 msiexec.exe Token: SeTakeOwnershipPrivilege 1560 msiexec.exe Token: SeLoadDriverPrivilege 1560 msiexec.exe Token: SeSystemProfilePrivilege 1560 msiexec.exe Token: SeSystemtimePrivilege 1560 msiexec.exe Token: SeProfSingleProcessPrivilege 1560 msiexec.exe Token: SeIncBasePriorityPrivilege 1560 msiexec.exe Token: SeCreatePagefilePrivilege 1560 msiexec.exe Token: SeCreatePermanentPrivilege 1560 msiexec.exe Token: SeBackupPrivilege 1560 msiexec.exe Token: SeRestorePrivilege 1560 msiexec.exe Token: SeShutdownPrivilege 1560 msiexec.exe Token: SeDebugPrivilege 1560 msiexec.exe Token: SeAuditPrivilege 1560 msiexec.exe Token: SeSystemEnvironmentPrivilege 1560 msiexec.exe Token: SeChangeNotifyPrivilege 1560 msiexec.exe Token: SeRemoteShutdownPrivilege 1560 msiexec.exe Token: SeUndockPrivilege 1560 msiexec.exe Token: SeSyncAgentPrivilege 1560 msiexec.exe Token: SeEnableDelegationPrivilege 1560 msiexec.exe Token: SeManageVolumePrivilege 1560 msiexec.exe Token: SeImpersonatePrivilege 1560 msiexec.exe Token: SeCreateGlobalPrivilege 1560 msiexec.exe Token: SeRestorePrivilege 1268 msiexec.exe Token: SeTakeOwnershipPrivilege 1268 msiexec.exe Token: SeRestorePrivilege 1268 msiexec.exe Token: SeTakeOwnershipPrivilege 1268 msiexec.exe Token: SeRestorePrivilege 1268 msiexec.exe Token: SeTakeOwnershipPrivilege 1268 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1560 msiexec.exe 1560 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe PID 1268 wrote to memory of 1772 1268 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\shipment.delievery.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1560
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CE1B1247C924DF63FC71C1C0AD5C85522⤵
- Loads dropped DLL
PID:1772
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2