5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991

General

Target

shipment.delievery.msi
Size

967KB
MD5

3c56483e8c0788b2862bfe0c490c865a
SHA1

3f541fbc9e927a718c1745b4b8d02f3768aa3fd2
SHA256

5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991
SHA512

ab45313032b3822b919b8a782422f15fd60f8c46cc61bb3294d937d98821795ab3b5089873419bbd9ada99357691759653a6fe50ba110ef04eee2bffba68ffe1

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

4232 MsiExec.exe
4232 MsiExec.exe

pid	process
4232	MsiExec.exe
4232	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

Drops file in Windows directory 5 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e56eaf1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBCC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE1F.tmp	msiexec.exe
File created	C:\Windows\Installer\e56eaf1.msi	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e111c2ed168134740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e111c2ed0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900e111c2ed000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	872	msiexec.exe
Token: SeSecurityPrivilege	1616	msiexec.exe
Token: SeCreateTokenPrivilege	872	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	872	msiexec.exe
Token: SeLockMemoryPrivilege	872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	872	msiexec.exe
Token: SeMachineAccountPrivilege	872	msiexec.exe
Token: SeTcbPrivilege	872	msiexec.exe
Token: SeSecurityPrivilege	872	msiexec.exe
Token: SeTakeOwnershipPrivilege	872	msiexec.exe
Token: SeLoadDriverPrivilege	872	msiexec.exe
Token: SeSystemProfilePrivilege	872	msiexec.exe
Token: SeSystemtimePrivilege	872	msiexec.exe
Token: SeProfSingleProcessPrivilege	872	msiexec.exe
Token: SeIncBasePriorityPrivilege	872	msiexec.exe
Token: SeCreatePagefilePrivilege	872	msiexec.exe
Token: SeCreatePermanentPrivilege	872	msiexec.exe
Token: SeBackupPrivilege	872	msiexec.exe
Token: SeRestorePrivilege	872	msiexec.exe
Token: SeShutdownPrivilege	872	msiexec.exe
Token: SeDebugPrivilege	872	msiexec.exe
Token: SeAuditPrivilege	872	msiexec.exe
Token: SeSystemEnvironmentPrivilege	872	msiexec.exe
Token: SeChangeNotifyPrivilege	872	msiexec.exe
Token: SeRemoteShutdownPrivilege	872	msiexec.exe
Token: SeUndockPrivilege	872	msiexec.exe
Token: SeSyncAgentPrivilege	872	msiexec.exe
Token: SeEnableDelegationPrivilege	872	msiexec.exe
Token: SeManageVolumePrivilege	872	msiexec.exe
Token: SeImpersonatePrivilege	872	msiexec.exe
Token: SeCreateGlobalPrivilege	872	msiexec.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeAuditPrivilege	3672	vssvc.exe
Token: SeBackupPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeBackupPrivilege	4912	srtasks.exe
Token: SeRestorePrivilege	4912	srtasks.exe
Token: SeSecurityPrivilege	4912	srtasks.exe
Token: SeTakeOwnershipPrivilege	4912	srtasks.exe
Token: SeBackupPrivilege	4912	srtasks.exe
Token: SeRestorePrivilege	4912	srtasks.exe
Token: SeSecurityPrivilege	4912	srtasks.exe
Token: SeTakeOwnershipPrivilege	4912	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

872 msiexec.exe
872 msiexec.exe

pid	process
872	msiexec.exe
872	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 1616 wrote to memory of 4912	1616	msiexec.exe	srtasks.exe
PID 1616 wrote to memory of 4912	1616	msiexec.exe	srtasks.exe
PID 1616 wrote to memory of 4232	1616	msiexec.exe	MsiExec.exe
PID 1616 wrote to memory of 4232	1616	msiexec.exe	MsiExec.exe
PID 1616 wrote to memory of 4232	1616	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\shipment.delievery.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:872

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 24041E913456AF37174C3E364CA81F76
2⤵
- Loads dropped DLL
PID:4232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

2

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSIEBCC.tmp
Filesize
56KB

MD5
38a4250c5e678728a0cdf126f1cdd937

SHA1
d55553ab896f085fd5cd191022c64442c99f48a4

SHA256
63c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08

SHA512
cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894

Download Submit
C:\Windows\Installer\MSIEBCC.tmp
Filesize
56KB

MD5
38a4250c5e678728a0cdf126f1cdd937

SHA1
d55553ab896f085fd5cd191022c64442c99f48a4

SHA256
63c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08

SHA512
cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894

Download Submit
C:\Windows\Installer\MSIEE1F.tmp
Filesize
56KB

MD5
38a4250c5e678728a0cdf126f1cdd937

SHA1
d55553ab896f085fd5cd191022c64442c99f48a4

SHA256
63c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08

SHA512
cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894

Download Submit
C:\Windows\Installer\MSIEE1F.tmp
Filesize
56KB

MD5
38a4250c5e678728a0cdf126f1cdd937

SHA1
d55553ab896f085fd5cd191022c64442c99f48a4

SHA256
63c4d968320e634b97542ccf0edffe130800314346c3316817813e62d7b7ee08

SHA512
cc00d1d5e6b074eff3245d3e8aa3020804a6bfd01516c7be7b05f671a93c6a56d9058738c422ad77eabb6c10e6c698a219dac7102e0b17dd941b11bfd60eb894

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
e716e4e233dcb00b65ed50fa056a0343

SHA1
45a2a1bdd957138ba59cf41f161975cb5b0eab1e

SHA256
8ae737795776bce7bac794fe1387b283354f81593057ce6698345b1b88c45334

SHA512
3f3530eee4fa2b1d1624971e74a3d33c831d1307de7ca5793d3dc691d15ac078ca412e0f759139381add0851a77eedceb997a829d419e9607be250b6968c6b5e

Download Submit
\??\Volume{edc211e1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6d6638a3-f724-4d6a-a9a6-8de422bd5576}_OnDiskSnapshotProp
Filesize
5KB

MD5
b6572e35b8a9ae17106a023b9749b5d5

SHA1
e7de05b078a90ec22740c02922e48e87c5bb7942

SHA256
f84b6b9e1dc60d361dd91b835cb5ec938e9596b08da214ff67528aa20abcf75a

SHA512
9e22c40cb060d613e15e7953a6e99d1a5226d7b059cd8e4b8a169ed6b76b94fe9e703e65fda376971f17ddeb3ae19d8274ea2ba5a7f3afbcc2339400d9af7267

Download Submit
memory/4232-131-0x0000000000000000-mapping.dmp

Download
memory/4912-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads