Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 08:09
General
-
Target
fba454b0f86b6514c9d9e5268ed58a398d30443819ec887fbc2b02d590dc1522.msi
-
Size
1.3MB
-
MD5
6e31d2f2c745b340e02b2e1f9711a715
-
SHA1
9c99809aa69805f708afb5418b68b430d4087552
-
SHA256
fba454b0f86b6514c9d9e5268ed58a398d30443819ec887fbc2b02d590dc1522
-
SHA512
41694c05606a8585e6fa8e4e5e0672c59ccc096be6dbf0184c4af0e03e145f98101d96d02e3f744f9710cb722906b2afb2b6f90851842cec9eb9912c32fc587c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 9 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fba454b0f86b6514c9d9e5268ed58a398d30443819ec887fbc2b02d590dc1522.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4F7AE74AF177B5FE15221BB41B83EEE12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\files\ab5sJkWggxaDJyJU.exe"C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\files\ab5sJkWggxaDJyJU.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\files"3⤵
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\files.cabFilesize
904KB
MD537ca8d45f74cbc1215726cbf74990e85
SHA18ad754ae9db24c18998d3a10525091a385a94546
SHA256f7ad06b2d914343daec583f4ebaf01e0d733a629a0040a85e54f8b74e944e1e5
SHA5128ffdf1c157dfc4702c1f2d13b148d0fb35439ba1e50395e58ee74de9e02e323664ca8421b55057a1910829d417a2e38424bc77848ed81ac8d4c2623682eaa007
-
C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\files\ab5sJkWggxaDJyJU.exeFilesize
1.2MB
MD5cb8cd07d32498986d817939e06ac4abb
SHA11de2ea093784a9b7ff6d1fa6d6877fdae990bd42
SHA256f751501b33b4d7e35aa20d08f718e5a8ed1c0471b4da1bdd2562a3536d83d58e
SHA5124c37cbd33af706f265415a309f9b32a46836430597be5a929423b4eaffc498a25c853ab7806a39f2e641ac9e95d75f8306bf48c37958b6e9291db8d80ae0ad59
-
C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\files\ab5sJkWggxaDJyJU.exeFilesize
1.2MB
MD5cb8cd07d32498986d817939e06ac4abb
SHA11de2ea093784a9b7ff6d1fa6d6877fdae990bd42
SHA256f751501b33b4d7e35aa20d08f718e5a8ed1c0471b4da1bdd2562a3536d83d58e
SHA5124c37cbd33af706f265415a309f9b32a46836430597be5a929423b4eaffc498a25c853ab7806a39f2e641ac9e95d75f8306bf48c37958b6e9291db8d80ae0ad59
-
C:\Users\Admin\AppData\Local\Temp\MW-a8d09a8d-27d3-4bdd-98e2-67c36a4180b2\msiwrapper.iniFilesize
1KB
MD5088396f1b0cec01c9e5d5241265cb9bf
SHA1568b41d2a70c5ff6ccf4bb54fd21f1fe82c8f55f
SHA256893a49fdaeef3fc35ae237b89b536220df615b162a7f12f2a73ee813ccf31bc3
SHA5120600ef23196f5240afdc690f765fe321918ce0f765d40699ad39a29c9fd7f78cacd9a519576facb906b16f4d0419fadaf121d14d3caab392b57cc2d0a8d5741b
-
C:\Windows\Installer\MSICB4F.tmpFilesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
-
C:\Windows\Installer\MSICB4F.tmpFilesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD5c1fa7863ad1158a4c140155f8b5d9117
SHA1bca48bcc75d5970a4968b8e066ece301f06069ad
SHA256b72a712117c7d7ff73f273ad52c68d1b5d79c8f736cdbbb7c78a9c857e9e1af7
SHA512a0d69f969506f0eddd241bfb47f3fc525866a3922f762ee51db887aaba7777164a991a6f75f9aa5cc674d2a708540168246769dc523c8f5f616ec6fcd3b67130
-
\??\Volume{c8b84e5a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ef6c47d7-fae0-4b21-8dab-f7a4c7937714}_OnDiskSnapshotPropFilesize
5KB
MD5b62932acc63d01cd67d1a1da9995bbe7
SHA1b2cd702c54cacfdfc5c1828aab503573abae7818
SHA2566e15fcb3d63384938529618b327e9a4a7984231d0be11aeee77909d01a46e13c
SHA512113e46ed87815df896e968bcf139e75af67729767bb0561a214eeace11ab70c2171e3df27b7e364f574b6cb9c8cb2739259d1cd30b158c24259b2d68dddb63ee
-
memory/752-151-0x0000000000000000-mapping.dmp
-
memory/2216-134-0x0000000000000000-mapping.dmp
-
memory/3012-155-0x0000000007D90000-0x0000000007E9A000-memory.dmpFilesize
1.0MB
-
memory/3012-147-0x0000000000000000-mapping.dmp
-
memory/3012-163-0x0000000009FD0000-0x000000000A4FC000-memory.dmpFilesize
5.2MB
-
memory/3012-162-0x00000000098D0000-0x0000000009A92000-memory.dmpFilesize
1.8MB
-
memory/3012-161-0x0000000008B40000-0x0000000008BA6000-memory.dmpFilesize
408KB
-
memory/3012-160-0x00000000080E0000-0x00000000080FE000-memory.dmpFilesize
120KB
-
memory/3012-159-0x0000000008E30000-0x00000000093D4000-memory.dmpFilesize
5.6MB
-
memory/3012-157-0x0000000008000000-0x0000000008076000-memory.dmpFilesize
472KB
-
memory/3012-148-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3012-150-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3012-156-0x0000000007CC0000-0x0000000007CFC000-memory.dmpFilesize
240KB
-
memory/3012-158-0x0000000008120000-0x00000000081B2000-memory.dmpFilesize
584KB
-
memory/3012-153-0x0000000008260000-0x0000000008878000-memory.dmpFilesize
6.1MB
-
memory/3012-154-0x0000000007C60000-0x0000000007C72000-memory.dmpFilesize
72KB
-
memory/3320-130-0x0000000000000000-mapping.dmp
-
memory/3604-131-0x0000000000000000-mapping.dmp
-
memory/3684-146-0x000000000EF10000-0x000000000F02B000-memory.dmpFilesize
1.1MB
-
memory/3684-141-0x0000000002760000-0x000000000289D000-memory.dmpFilesize
1.2MB
-
memory/3684-145-0x000000000EF10000-0x000000000F02B000-memory.dmpFilesize
1.1MB
-
memory/3684-139-0x0000000000000000-mapping.dmp
-
memory/3684-142-0x0000000002760000-0x000000000289D000-memory.dmpFilesize
1.2MB
-
memory/4352-152-0x0000000000000000-mapping.dmp
-
memory/4632-137-0x0000000000000000-mapping.dmp