Analysis

  • max time kernel
    141s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 17:05

General

  • Target

    cffea33c961cf1f822ae009527b4fcaf9fb3e5c374fd470e8fee7eeaa20c3adf.msi

  • Size

    2.2MB

  • MD5

    9f266d8ad30e25b4260f24181d117c5f

  • SHA1

    68744aaf74dd72c812333583e3913598da317f5d

  • SHA256

    cffea33c961cf1f822ae009527b4fcaf9fb3e5c374fd470e8fee7eeaa20c3adf

  • SHA512

    6148c33da7241b16eda745e18da088bde141f9b77be5e46868f4bb8dc6396a4d31ad922c1e647cf1d4fe0bd4ac9bf9a43a3c2a4a4c44bff5ccc3fb7b00fc753c

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cffea33c961cf1f822ae009527b4fcaf9fb3e5c374fd470e8fee7eeaa20c3adf.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:724
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1240

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads