Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
23-05-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
66.msi
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
66.msi
Resource
win10v2004-20220414-en
General
-
Target
66.msi
-
Size
96KB
-
MD5
5d4e40d1d41c4588fbf7065fa85454e7
-
SHA1
ca876c335ef0a4d90b456f13cc975c04016a5cc1
-
SHA256
4c7314083933a283c87dc28abbed3082040f12e92edac47ff72f8539af6e3ea1
-
SHA512
5f86b37bbdd97ec632e0098d5c2ff71c0a23f547a27493d88d5a0cfa0342e45c39fc79ddbb42e4103a08e7e8a71b88412ca45cbb3b1aed615fdbe4c50d647f3c
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid process 1272 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 11 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\6d0e44.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1132.tmp msiexec.exe File created C:\Windows\Installer\6d0e47.msi msiexec.exe File opened for modification C:\Windows\Installer\6d0e45.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6d0e44.msi msiexec.exe File created C:\Windows\Installer\6d0e45.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI1057.tmp msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1164 msiexec.exe 1164 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeSecurityPrivilege 1164 msiexec.exe Token: SeCreateTokenPrivilege 1660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1660 msiexec.exe Token: SeLockMemoryPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeMachineAccountPrivilege 1660 msiexec.exe Token: SeTcbPrivilege 1660 msiexec.exe Token: SeSecurityPrivilege 1660 msiexec.exe Token: SeTakeOwnershipPrivilege 1660 msiexec.exe Token: SeLoadDriverPrivilege 1660 msiexec.exe Token: SeSystemProfilePrivilege 1660 msiexec.exe Token: SeSystemtimePrivilege 1660 msiexec.exe Token: SeProfSingleProcessPrivilege 1660 msiexec.exe Token: SeIncBasePriorityPrivilege 1660 msiexec.exe Token: SeCreatePagefilePrivilege 1660 msiexec.exe Token: SeCreatePermanentPrivilege 1660 msiexec.exe Token: SeBackupPrivilege 1660 msiexec.exe Token: SeRestorePrivilege 1660 msiexec.exe Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeDebugPrivilege 1660 msiexec.exe Token: SeAuditPrivilege 1660 msiexec.exe Token: SeSystemEnvironmentPrivilege 1660 msiexec.exe Token: SeChangeNotifyPrivilege 1660 msiexec.exe Token: SeRemoteShutdownPrivilege 1660 msiexec.exe Token: SeUndockPrivilege 1660 msiexec.exe Token: SeSyncAgentPrivilege 1660 msiexec.exe Token: SeEnableDelegationPrivilege 1660 msiexec.exe Token: SeManageVolumePrivilege 1660 msiexec.exe Token: SeImpersonatePrivilege 1660 msiexec.exe Token: SeCreateGlobalPrivilege 1660 msiexec.exe Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe Token: SeBackupPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1528 DrvInst.exe Token: SeLoadDriverPrivilege 1528 DrvInst.exe Token: SeLoadDriverPrivilege 1528 DrvInst.exe Token: SeLoadDriverPrivilege 1528 DrvInst.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe Token: SeTakeOwnershipPrivilege 1164 msiexec.exe Token: SeRestorePrivilege 1164 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1660 msiexec.exe 1660 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
msiexec.exedescription pid process target process PID 1164 wrote to memory of 1272 1164 msiexec.exe MsiExec.exe PID 1164 wrote to memory of 1272 1164 msiexec.exe MsiExec.exe PID 1164 wrote to memory of 1272 1164 msiexec.exe MsiExec.exe PID 1164 wrote to memory of 1272 1164 msiexec.exe MsiExec.exe PID 1164 wrote to memory of 1272 1164 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\66.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 24E94E2E335E4D8CDD38C1CEB2746BDB2⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000055C" "0000000000000550"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI1057.tmpFilesize
54KB
MD5eadaaa6edab657ed52d0b76325494469
SHA10c3b0c61e91857f715e737276c7fcd066117095d
SHA256ec0ac9068fa7c0e422f0f090efb31e335ef87439bb5034e98a6d9f1a6e292acb
SHA512df8d3602f086b2a84b203f489a678f0e0c0ad2ae2114b24619e61d4c780969dc267719d9a29d4ba8ae15acdc32afeb7982437570b51e465a362ce6a53b4bd621
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\Installer\MSI1057.tmpFilesize
54KB
MD5eadaaa6edab657ed52d0b76325494469
SHA10c3b0c61e91857f715e737276c7fcd066117095d
SHA256ec0ac9068fa7c0e422f0f090efb31e335ef87439bb5034e98a6d9f1a6e292acb
SHA512df8d3602f086b2a84b203f489a678f0e0c0ad2ae2114b24619e61d4c780969dc267719d9a29d4ba8ae15acdc32afeb7982437570b51e465a362ce6a53b4bd621
-
memory/1272-57-0x0000000000000000-mapping.dmp
-
memory/1660-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmpFilesize
8KB