Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-08-2022 06:25
Behavioral task
behavioral1
Sample
2a404f85ff89f96f12279990ee9095a7.msi
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2a404f85ff89f96f12279990ee9095a7.msi
Resource
win10v2004-20220812-en
General
-
Target
2a404f85ff89f96f12279990ee9095a7.msi
-
Size
874KB
-
MD5
2a404f85ff89f96f12279990ee9095a7
-
SHA1
35b6b3b891921649a4a677d7b1c33a41c58a722a
-
SHA256
6717cf6ab3b1f012be6f47cd277fb8f9ef393aedbea6371c60cc5ee285dea671
-
SHA512
97b59da9f4136b0cbf518415ed95d38541642b8c49a961ec90c4ec82586392cedac0d39af278b28b0321a233d0d890db9d82a3216771926f632d50bb2f93f737
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 1284 MsiExec.exe 1284 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIFE2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3.tmp msiexec.exe File created C:\Windows\Installer\6c00dd.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI937.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c00dd.ipi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1348 msiexec.exe 1348 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1044 msiexec.exe Token: SeIncreaseQuotaPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeSecurityPrivilege 1348 msiexec.exe Token: SeCreateTokenPrivilege 1044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1044 msiexec.exe Token: SeLockMemoryPrivilege 1044 msiexec.exe Token: SeIncreaseQuotaPrivilege 1044 msiexec.exe Token: SeMachineAccountPrivilege 1044 msiexec.exe Token: SeTcbPrivilege 1044 msiexec.exe Token: SeSecurityPrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeLoadDriverPrivilege 1044 msiexec.exe Token: SeSystemProfilePrivilege 1044 msiexec.exe Token: SeSystemtimePrivilege 1044 msiexec.exe Token: SeProfSingleProcessPrivilege 1044 msiexec.exe Token: SeIncBasePriorityPrivilege 1044 msiexec.exe Token: SeCreatePagefilePrivilege 1044 msiexec.exe Token: SeCreatePermanentPrivilege 1044 msiexec.exe Token: SeBackupPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeShutdownPrivilege 1044 msiexec.exe Token: SeDebugPrivilege 1044 msiexec.exe Token: SeAuditPrivilege 1044 msiexec.exe Token: SeSystemEnvironmentPrivilege 1044 msiexec.exe Token: SeChangeNotifyPrivilege 1044 msiexec.exe Token: SeRemoteShutdownPrivilege 1044 msiexec.exe Token: SeUndockPrivilege 1044 msiexec.exe Token: SeSyncAgentPrivilege 1044 msiexec.exe Token: SeEnableDelegationPrivilege 1044 msiexec.exe Token: SeManageVolumePrivilege 1044 msiexec.exe Token: SeImpersonatePrivilege 1044 msiexec.exe Token: SeCreateGlobalPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1044 msiexec.exe 1044 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe PID 1348 wrote to memory of 1284 1348 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2a404f85ff89f96f12279990ee9095a7.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FC24B70EC78124A3A16E4E20712205AD2⤵
- Loads dropped DLL
PID:1284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI3.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSIFE2E.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
\Windows\Installer\MSI3.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
\Windows\Installer\MSIFE2E.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
memory/1044-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmpFilesize
8KB
-
memory/1284-56-0x0000000000000000-mapping.dmp
-
memory/1284-57-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB