Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19-10-2022 10:59

General

  • Target

    i.msi

  • Size

    996KB

  • MD5

    b0b7cb36503c46755882751191c9a711

  • SHA1

    c0d058bacb81f36dfd1b1d99a386ff0a7bb0ec7a

  • SHA256

    77ed1502e9c8bfd2e91f04e3dce2d5649f68201061fb24c4ab4fa5e9b7fdec50

  • SHA512

    4f00e5743fa56f553ce64d1ebc35a71cd5cb5200d7434f94a46a30fe6efbcbd64d105d440bd1ce45c2b66f9e91b622e6cfc8a7de08bf08727fc75df1cec32b4d

  • SSDEEP

    24576:G+aBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:G+8lrXVVdWX59GUrSLzeaVtFU

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\i.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1504
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4653D0F4D95ECE56C0DC5FC0F1380332
      2⤵
      • Loads dropped DLL
      PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSIF91F.tmp
    Filesize

    379KB

    MD5

    305a50c391a94b42a68958f3f89906fb

    SHA1

    4110d68d71f3594f5d3bdfca91a1c759ab0105d4

    SHA256

    f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

    SHA512

    fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

  • C:\Windows\Installer\MSIFAE4.tmp
    Filesize

    379KB

    MD5

    305a50c391a94b42a68958f3f89906fb

    SHA1

    4110d68d71f3594f5d3bdfca91a1c759ab0105d4

    SHA256

    f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

    SHA512

    fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

  • C:\Windows\Installer\MSIFB62.tmp
    Filesize

    537KB

    MD5

    d7ec04b009302b83da506b9c63ca775c

    SHA1

    6fa9ea09b71531754b4cd05814a91032229834c0

    SHA256

    00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

    SHA512

    171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

  • C:\Windows\Installer\MSIFBEF.tmp
    Filesize

    379KB

    MD5

    305a50c391a94b42a68958f3f89906fb

    SHA1

    4110d68d71f3594f5d3bdfca91a1c759ab0105d4

    SHA256

    f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

    SHA512

    fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

  • \Windows\Installer\MSIF91F.tmp
    Filesize

    379KB

    MD5

    305a50c391a94b42a68958f3f89906fb

    SHA1

    4110d68d71f3594f5d3bdfca91a1c759ab0105d4

    SHA256

    f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

    SHA512

    fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

  • \Windows\Installer\MSIFAE4.tmp
    Filesize

    379KB

    MD5

    305a50c391a94b42a68958f3f89906fb

    SHA1

    4110d68d71f3594f5d3bdfca91a1c759ab0105d4

    SHA256

    f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

    SHA512

    fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

  • \Windows\Installer\MSIFB62.tmp
    Filesize

    537KB

    MD5

    d7ec04b009302b83da506b9c63ca775c

    SHA1

    6fa9ea09b71531754b4cd05814a91032229834c0

    SHA256

    00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

    SHA512

    171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

  • \Windows\Installer\MSIFBEF.tmp
    Filesize

    379KB

    MD5

    305a50c391a94b42a68958f3f89906fb

    SHA1

    4110d68d71f3594f5d3bdfca91a1c759ab0105d4

    SHA256

    f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

    SHA512

    fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

  • memory/1504-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp
    Filesize

    8KB

  • memory/2024-56-0x0000000000000000-mapping.dmp
  • memory/2024-57-0x0000000075FB1000-0x0000000075FB3000-memory.dmp
    Filesize

    8KB