Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2022 17:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://static.corestrengths.com/core-cloud/csp/4.8.3/en-US/CSP-en-US-Windows-latest.msi
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
http://static.corestrengths.com/core-cloud/csp/4.8.3/en-US/CSP-en-US-Windows-latest.msi
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 6 1016 msiexec.exe 8 1016 msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 4984 MsiExec.exe -
Unknown use of msiexec with remote resource 1 IoCs
pid Process 1016 msiexec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7256.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI94C9.tmp msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1728 msiexec.exe 1728 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeShutdownPrivilege 1016 msiexec.exe Token: SeIncreaseQuotaPrivilege 1016 msiexec.exe Token: SeRestorePrivilege 1016 msiexec.exe Token: SeTakeOwnershipPrivilege 1016 msiexec.exe Token: SeSecurityPrivilege 1728 msiexec.exe Token: SeCreateTokenPrivilege 1016 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1016 msiexec.exe Token: SeLockMemoryPrivilege 1016 msiexec.exe Token: SeIncreaseQuotaPrivilege 1016 msiexec.exe Token: SeMachineAccountPrivilege 1016 msiexec.exe Token: SeTcbPrivilege 1016 msiexec.exe Token: SeSecurityPrivilege 1016 msiexec.exe Token: SeTakeOwnershipPrivilege 1016 msiexec.exe Token: SeLoadDriverPrivilege 1016 msiexec.exe Token: SeSystemProfilePrivilege 1016 msiexec.exe Token: SeSystemtimePrivilege 1016 msiexec.exe Token: SeProfSingleProcessPrivilege 1016 msiexec.exe Token: SeIncBasePriorityPrivilege 1016 msiexec.exe Token: SeCreatePagefilePrivilege 1016 msiexec.exe Token: SeCreatePermanentPrivilege 1016 msiexec.exe Token: SeBackupPrivilege 1016 msiexec.exe Token: SeRestorePrivilege 1016 msiexec.exe Token: SeShutdownPrivilege 1016 msiexec.exe Token: SeDebugPrivilege 1016 msiexec.exe Token: SeAuditPrivilege 1016 msiexec.exe Token: SeSystemEnvironmentPrivilege 1016 msiexec.exe Token: SeChangeNotifyPrivilege 1016 msiexec.exe Token: SeRemoteShutdownPrivilege 1016 msiexec.exe Token: SeUndockPrivilege 1016 msiexec.exe Token: SeSyncAgentPrivilege 1016 msiexec.exe Token: SeEnableDelegationPrivilege 1016 msiexec.exe Token: SeManageVolumePrivilege 1016 msiexec.exe Token: SeImpersonatePrivilege 1016 msiexec.exe Token: SeCreateGlobalPrivilege 1016 msiexec.exe Token: SeBackupPrivilege 3584 vssvc.exe Token: SeRestorePrivilege 3584 vssvc.exe Token: SeAuditPrivilege 3584 vssvc.exe Token: SeBackupPrivilege 1728 msiexec.exe Token: SeRestorePrivilege 1728 msiexec.exe Token: SeRestorePrivilege 1728 msiexec.exe Token: SeTakeOwnershipPrivilege 1728 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1016 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2340 1728 msiexec.exe 93 PID 1728 wrote to memory of 2340 1728 msiexec.exe 93 PID 1728 wrote to memory of 4984 1728 msiexec.exe 95 PID 1728 wrote to memory of 4984 1728 msiexec.exe 95 PID 1728 wrote to memory of 4984 1728 msiexec.exe 95
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I http://static.corestrengths.com/core-cloud/csp/4.8.3/en-US/CSP-en-US-Windows-latest.msi1⤵
- Blocklisted process makes network request
- Unknown use of msiexec with remote resource
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1016
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2340
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 36727D5DD232D4616D4B0C0FE2A0A4282⤵
- Loads dropped DLL
PID:4984
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948.2MB
MD58726e88275ee134b989e08bb24c20bb8
SHA1de97c661b10432a2d0ab951054c0a264fc940b45
SHA256c9fb4a99848d319cc33c70a8cb3edc0fa0a32a4fa3cc7da1b511ddd584079c10
SHA512f9f41f711ac42a73087f1d9d62c13b2e41581c480d5de5d791652f108045906fa36b4fcc76fbcbc15da6a24f8d8423644bc7ba1bb93adf3999532b1939822212
-
Filesize
128KB
MD5bd237aac254bd2285aa3b2d9023beedc
SHA13d2715c92a301dcad0d3d4683d559886202dec37
SHA256b126b59c75f9e3ca19bd5f901c462325e954baf5719765bb0ea4a6e09b6b6b69
SHA51272e912c23b6d3220b0b8d4ff262a28797ecc163449221ed5e5e047c3b0706f4b85211e74e61a3ac0ef6b1d5dda35eb341e2528a607ac3fca883c1d60967faa0a
-
Filesize
128KB
MD5bd237aac254bd2285aa3b2d9023beedc
SHA13d2715c92a301dcad0d3d4683d559886202dec37
SHA256b126b59c75f9e3ca19bd5f901c462325e954baf5719765bb0ea4a6e09b6b6b69
SHA51272e912c23b6d3220b0b8d4ff262a28797ecc163449221ed5e5e047c3b0706f4b85211e74e61a3ac0ef6b1d5dda35eb341e2528a607ac3fca883c1d60967faa0a