Analysis
-
max time kernel
80s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 17:09
Static task
static1
Behavioral task
behavioral1
Sample
c2128876a519384e58bc4c7689c750506a322a9af8cb51dae874e13310f7a657.msi
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
c2128876a519384e58bc4c7689c750506a322a9af8cb51dae874e13310f7a657.msi
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
c2128876a519384e58bc4c7689c750506a322a9af8cb51dae874e13310f7a657.msi
-
Size
582KB
-
MD5
7cf1cfbf90daf97f68e6353f3069958b
-
SHA1
099234e01840a5b31f7a07c67ef4ba5936663a66
-
SHA256
c2128876a519384e58bc4c7689c750506a322a9af8cb51dae874e13310f7a657
-
SHA512
2de405169dd450ff6fd0deb6279a2a0e994910f99d2cbda89fab757a5f4407c85951186350d5aa8d43653a8a4d24aeffd6b3dee656d502a3ddcec4819f8ae251
-
SSDEEP
12288:73RaFvRR7tSDjHuvxa+DotYTkG4w07dJZ8j8EhQ5e3Awu/y:734FvRR7tGa5altYTkGB0Rrq8GQc3Awy
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2860 MsiExec.exe 2860 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3340 msiexec.exe Token: SeIncreaseQuotaPrivilege 3340 msiexec.exe Token: SeSecurityPrivilege 2216 msiexec.exe Token: SeCreateTokenPrivilege 3340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3340 msiexec.exe Token: SeLockMemoryPrivilege 3340 msiexec.exe Token: SeIncreaseQuotaPrivilege 3340 msiexec.exe Token: SeMachineAccountPrivilege 3340 msiexec.exe Token: SeTcbPrivilege 3340 msiexec.exe Token: SeSecurityPrivilege 3340 msiexec.exe Token: SeTakeOwnershipPrivilege 3340 msiexec.exe Token: SeLoadDriverPrivilege 3340 msiexec.exe Token: SeSystemProfilePrivilege 3340 msiexec.exe Token: SeSystemtimePrivilege 3340 msiexec.exe Token: SeProfSingleProcessPrivilege 3340 msiexec.exe Token: SeIncBasePriorityPrivilege 3340 msiexec.exe Token: SeCreatePagefilePrivilege 3340 msiexec.exe Token: SeCreatePermanentPrivilege 3340 msiexec.exe Token: SeBackupPrivilege 3340 msiexec.exe Token: SeRestorePrivilege 3340 msiexec.exe Token: SeShutdownPrivilege 3340 msiexec.exe Token: SeDebugPrivilege 3340 msiexec.exe Token: SeAuditPrivilege 3340 msiexec.exe Token: SeSystemEnvironmentPrivilege 3340 msiexec.exe Token: SeChangeNotifyPrivilege 3340 msiexec.exe Token: SeRemoteShutdownPrivilege 3340 msiexec.exe Token: SeUndockPrivilege 3340 msiexec.exe Token: SeSyncAgentPrivilege 3340 msiexec.exe Token: SeEnableDelegationPrivilege 3340 msiexec.exe Token: SeManageVolumePrivilege 3340 msiexec.exe Token: SeImpersonatePrivilege 3340 msiexec.exe Token: SeCreateGlobalPrivilege 3340 msiexec.exe Token: SeCreateTokenPrivilege 3340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3340 msiexec.exe Token: SeLockMemoryPrivilege 3340 msiexec.exe Token: SeIncreaseQuotaPrivilege 3340 msiexec.exe Token: SeMachineAccountPrivilege 3340 msiexec.exe Token: SeTcbPrivilege 3340 msiexec.exe Token: SeSecurityPrivilege 3340 msiexec.exe Token: SeTakeOwnershipPrivilege 3340 msiexec.exe Token: SeLoadDriverPrivilege 3340 msiexec.exe Token: SeSystemProfilePrivilege 3340 msiexec.exe Token: SeSystemtimePrivilege 3340 msiexec.exe Token: SeProfSingleProcessPrivilege 3340 msiexec.exe Token: SeIncBasePriorityPrivilege 3340 msiexec.exe Token: SeCreatePagefilePrivilege 3340 msiexec.exe Token: SeCreatePermanentPrivilege 3340 msiexec.exe Token: SeBackupPrivilege 3340 msiexec.exe Token: SeRestorePrivilege 3340 msiexec.exe Token: SeShutdownPrivilege 3340 msiexec.exe Token: SeDebugPrivilege 3340 msiexec.exe Token: SeAuditPrivilege 3340 msiexec.exe Token: SeSystemEnvironmentPrivilege 3340 msiexec.exe Token: SeChangeNotifyPrivilege 3340 msiexec.exe Token: SeRemoteShutdownPrivilege 3340 msiexec.exe Token: SeUndockPrivilege 3340 msiexec.exe Token: SeSyncAgentPrivilege 3340 msiexec.exe Token: SeEnableDelegationPrivilege 3340 msiexec.exe Token: SeManageVolumePrivilege 3340 msiexec.exe Token: SeImpersonatePrivilege 3340 msiexec.exe Token: SeCreateGlobalPrivilege 3340 msiexec.exe Token: SeCreateTokenPrivilege 3340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3340 msiexec.exe Token: SeLockMemoryPrivilege 3340 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3340 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2860 2216 msiexec.exe 84 PID 2216 wrote to memory of 2860 2216 msiexec.exe 84 PID 2216 wrote to memory of 2860 2216 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c2128876a519384e58bc4c7689c750506a322a9af8cb51dae874e13310f7a657.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3340
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C3CA64E40C54C4F79286938737E6E993 C2⤵
- Loads dropped DLL
PID:2860
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5061b504c1a3a41ecdd9cf7b1d33259e4
SHA12394bb353951e524a67249f14b0a6fd15ea65123
SHA25602ca99212b699c7efb1f0c3a62d873911212777132366c894fd094fe226cb5bc
SHA5120697c0732d71db35db7380fbe78a09d8d32f92cfd38ca8f98b079938122e96e9c859039015f334471c0fb5d8b8077e975b5c92fe3170b0a639a7f39d2cc61c63
-
Filesize
48KB
MD5061b504c1a3a41ecdd9cf7b1d33259e4
SHA12394bb353951e524a67249f14b0a6fd15ea65123
SHA25602ca99212b699c7efb1f0c3a62d873911212777132366c894fd094fe226cb5bc
SHA5120697c0732d71db35db7380fbe78a09d8d32f92cfd38ca8f98b079938122e96e9c859039015f334471c0fb5d8b8077e975b5c92fe3170b0a639a7f39d2cc61c63
-
Filesize
48KB
MD5061b504c1a3a41ecdd9cf7b1d33259e4
SHA12394bb353951e524a67249f14b0a6fd15ea65123
SHA25602ca99212b699c7efb1f0c3a62d873911212777132366c894fd094fe226cb5bc
SHA5120697c0732d71db35db7380fbe78a09d8d32f92cfd38ca8f98b079938122e96e9c859039015f334471c0fb5d8b8077e975b5c92fe3170b0a639a7f39d2cc61c63
-
Filesize
48KB
MD5061b504c1a3a41ecdd9cf7b1d33259e4
SHA12394bb353951e524a67249f14b0a6fd15ea65123
SHA25602ca99212b699c7efb1f0c3a62d873911212777132366c894fd094fe226cb5bc
SHA5120697c0732d71db35db7380fbe78a09d8d32f92cfd38ca8f98b079938122e96e9c859039015f334471c0fb5d8b8077e975b5c92fe3170b0a639a7f39d2cc61c63