Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
CEP_COMPROBANTE-ELECTRONICO-PAGO-CEP-41136d968a589ee7f4bf39cd15d31bd8e9fc.msi
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
CEP_COMPROBANTE-ELECTRONICO-PAGO-CEP-41136d968a589ee7f4bf39cd15d31bd8e9fc.msi
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
CEP_COMPROBANTE-ELECTRONICO-PAGO-CEP-41136d968a589ee7f4bf39cd15d31bd8e9fc.msi
-
Size
5.6MB
-
MD5
96d57b5a423ef71ba40e0539f8be828d
-
SHA1
95c1ea471cf592c6511ac6dfec4e3bf95221c871
-
SHA256
60eaf2ea62e78bbec6bced32cb9abd3fbf03b2099ff1a4ccece5e836b2ca187e
-
SHA512
c62cf674867bd18d9d010217cdba9b6d946af2c5d0f5b6ddb78a33c4478c7860eb3fb07ae54de07bbec29a88e9e6df364b13f070865b8927084a1913d3be31e6
-
SSDEEP
98304:aYvtRfOHcxu6ZBjdaBiBq2S6hBeRMyeaEE9QptyZo4xIDA+KJTia/eCA:F3yH+BdNBvSHipUC4uD3aTj
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 5 624 MsiExec.exe 7 624 MsiExec.exe 8 624 MsiExec.exe -
Loads dropped DLL 4 IoCs
pid Process 624 MsiExec.exe 624 MsiExec.exe 624 MsiExec.exe 624 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ipinfo.io 4 ipinfo.io -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC34.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB7B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI696.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c058d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI84C.tmp msiexec.exe File created C:\Windows\Installer\6c058f.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIEBAB.tmp msiexec.exe File created C:\Windows\Installer\6c058d.msi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1264 msiexec.exe 1264 msiexec.exe 624 MsiExec.exe 624 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 1648 msiexec.exe Token: SeIncreaseQuotaPrivilege 1648 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe Token: SeSecurityPrivilege 1264 msiexec.exe Token: SeCreateTokenPrivilege 1648 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1648 msiexec.exe Token: SeLockMemoryPrivilege 1648 msiexec.exe Token: SeIncreaseQuotaPrivilege 1648 msiexec.exe Token: SeMachineAccountPrivilege 1648 msiexec.exe Token: SeTcbPrivilege 1648 msiexec.exe Token: SeSecurityPrivilege 1648 msiexec.exe Token: SeTakeOwnershipPrivilege 1648 msiexec.exe Token: SeLoadDriverPrivilege 1648 msiexec.exe Token: SeSystemProfilePrivilege 1648 msiexec.exe Token: SeSystemtimePrivilege 1648 msiexec.exe Token: SeProfSingleProcessPrivilege 1648 msiexec.exe Token: SeIncBasePriorityPrivilege 1648 msiexec.exe Token: SeCreatePagefilePrivilege 1648 msiexec.exe Token: SeCreatePermanentPrivilege 1648 msiexec.exe Token: SeBackupPrivilege 1648 msiexec.exe Token: SeRestorePrivilege 1648 msiexec.exe Token: SeShutdownPrivilege 1648 msiexec.exe Token: SeDebugPrivilege 1648 msiexec.exe Token: SeAuditPrivilege 1648 msiexec.exe Token: SeSystemEnvironmentPrivilege 1648 msiexec.exe Token: SeChangeNotifyPrivilege 1648 msiexec.exe Token: SeRemoteShutdownPrivilege 1648 msiexec.exe Token: SeUndockPrivilege 1648 msiexec.exe Token: SeSyncAgentPrivilege 1648 msiexec.exe Token: SeEnableDelegationPrivilege 1648 msiexec.exe Token: SeManageVolumePrivilege 1648 msiexec.exe Token: SeImpersonatePrivilege 1648 msiexec.exe Token: SeCreateGlobalPrivilege 1648 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe Token: SeRestorePrivilege 1264 msiexec.exe Token: SeTakeOwnershipPrivilege 1264 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1648 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1264 wrote to memory of 624 1264 msiexec.exe 29 PID 1264 wrote to memory of 624 1264 msiexec.exe 29 PID 1264 wrote to memory of 624 1264 msiexec.exe 29 PID 1264 wrote to memory of 624 1264 msiexec.exe 29 PID 1264 wrote to memory of 624 1264 msiexec.exe 29 PID 1264 wrote to memory of 624 1264 msiexec.exe 29 PID 1264 wrote to memory of 624 1264 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CEP_COMPROBANTE-ELECTRONICO-PAGO-CEP-41136d968a589ee7f4bf39cd15d31bd8e9fc.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1648
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5E29A14217DF710FE98E4924BA0EF5B22⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:624
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD5d90ab57e6c584f90fbbea74b566216e3
SHA14616e59aed33848f5870e5e1fe865f932721a162
SHA25644ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
SHA5125b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
-
Filesize
381KB
MD5d90ab57e6c584f90fbbea74b566216e3
SHA14616e59aed33848f5870e5e1fe865f932721a162
SHA25644ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
SHA5125b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
-
Filesize
381KB
MD5d90ab57e6c584f90fbbea74b566216e3
SHA14616e59aed33848f5870e5e1fe865f932721a162
SHA25644ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
SHA5125b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
-
Filesize
5.1MB
MD561b08b23b5f5191a707e7960edb887a1
SHA1647ba301e2d99775ae7c818ab8cbc33cbabcca88
SHA2564f31e3f3431f5cbb6c55e224d094b7e03a64dd1fbfc383f3a6a0abdd6fb87ad1
SHA512e95fe5d5a00f38c1b7ab26288555813b16bfe59af7022c26af26609d2e8f5e75863afdac157333057f9df19da1b2b8f815ecab4c14e0f78ec4471d20ed76b5c2
-
Filesize
381KB
MD5d90ab57e6c584f90fbbea74b566216e3
SHA14616e59aed33848f5870e5e1fe865f932721a162
SHA25644ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
SHA5125b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
-
Filesize
381KB
MD5d90ab57e6c584f90fbbea74b566216e3
SHA14616e59aed33848f5870e5e1fe865f932721a162
SHA25644ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
SHA5125b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
-
Filesize
381KB
MD5d90ab57e6c584f90fbbea74b566216e3
SHA14616e59aed33848f5870e5e1fe865f932721a162
SHA25644ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
SHA5125b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
-
Filesize
5.1MB
MD561b08b23b5f5191a707e7960edb887a1
SHA1647ba301e2d99775ae7c818ab8cbc33cbabcca88
SHA2564f31e3f3431f5cbb6c55e224d094b7e03a64dd1fbfc383f3a6a0abdd6fb87ad1
SHA512e95fe5d5a00f38c1b7ab26288555813b16bfe59af7022c26af26609d2e8f5e75863afdac157333057f9df19da1b2b8f815ecab4c14e0f78ec4471d20ed76b5c2