Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe
-
Size
157KB
-
MD5
a017322f3a19a6e20c924b644303f4b0
-
SHA1
c7949dd02f94cb36184448ffc8fb82b595ad8475
-
SHA256
b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a
-
SHA512
c77423c431f8e0876edca3328cdac574ac71207564ea273482147adf2733251d3a818a8d0569f7871d4af5061b1f600e1147295a5ba5b813f5cb99637f68ba02
-
SSDEEP
3072:PKFiOcFhrk4tNC3mA+niRh7wCmZqubAN76Nb3TzM1:h9zCF+nicUu8oM
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\13168 = "c:\\progra~3\\msiosi.exe" msiexec.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 9 4492 msiexec.exe 38 4492 msiexec.exe 42 4492 msiexec.exe -
Disables taskbar notifications via registry modification
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created \??\c:\progra~3\msiosi.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe 4492 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4492 msiexec.exe Token: SeBackupPrivilege 4492 msiexec.exe Token: SeRestorePrivilege 4492 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4492 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 83 PID 4316 wrote to memory of 4492 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 83 PID 4316 wrote to memory of 4492 4316 b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe 83 PID 4492 wrote to memory of 1276 4492 msiexec.exe 84 PID 4492 wrote to memory of 1276 4492 msiexec.exe 84 PID 4492 wrote to memory of 1276 4492 msiexec.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe"C:\Users\Admin\AppData\Local\Temp\b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵PID:1276
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD5a017322f3a19a6e20c924b644303f4b0
SHA1c7949dd02f94cb36184448ffc8fb82b595ad8475
SHA256b2dd3aa388c0532035d56a40b2ad4cf20034ccfe869eee915321bb8e9caffd4a
SHA512c77423c431f8e0876edca3328cdac574ac71207564ea273482147adf2733251d3a818a8d0569f7871d4af5061b1f600e1147295a5ba5b813f5cb99637f68ba02