Analysis

  • max time kernel
    37s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2022, 11:43

General

  • Target

    File_Part.1.msi

  • Size

    484.3MB

  • MD5

    c970f7ea3af14415cc2a47eba0d86f9c

  • SHA1

    eaf1b4bdbbc5adfd7b9959ba898305f2277b57c1

  • SHA256

    fdf27fedc4ee0afda54f5ad05b490570d9bf025636b18b74fcda5a604aabee6f

  • SHA512

    8b96d0780bbb476937ecc1a148e34666bb821aaf576f18276fafe746c329fefa3d10728a44863caa3191db7d5ae9c5f07650893923a277a178c9b65e3110d79e

  • SSDEEP

    49152:PCbnqiTqLNEfjQpamz+IgtxSPuPzB29FQN:Uqdqfuamz+IgtB7BaFQN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\File_Part.1.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1480
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:520
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8C85DF53125131742033B1D0B7B2C1FC
      2⤵
      • Loads dropped DLL
      PID:1332

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Installer\MSI6A67.tmp

          Filesize

          483.8MB

          MD5

          99f2f92fc126e2a1d74f29973bbc48f9

          SHA1

          988ab2fa002cc60e9c286dbdb3774043a72a1c46

          SHA256

          b8bf60526783aff6a053a1a9aa8c5b781b7af7b55bbfe44fbb7d63c8f08094f5

          SHA512

          5b0f07be7bd6c6c13291b4bbf8a8661ff97590df30f10998362cd1f6453b194c483a0273366e8183547509087231cb544e776eb0e69d9ccc8e1ccf2bb31d74dc

        • \Windows\Installer\MSI6A67.tmp

          Filesize

          483.8MB

          MD5

          99f2f92fc126e2a1d74f29973bbc48f9

          SHA1

          988ab2fa002cc60e9c286dbdb3774043a72a1c46

          SHA256

          b8bf60526783aff6a053a1a9aa8c5b781b7af7b55bbfe44fbb7d63c8f08094f5

          SHA512

          5b0f07be7bd6c6c13291b4bbf8a8661ff97590df30f10998362cd1f6453b194c483a0273366e8183547509087231cb544e776eb0e69d9ccc8e1ccf2bb31d74dc

        • memory/1332-57-0x0000000076261000-0x0000000076263000-memory.dmp

          Filesize

          8KB

        • memory/1332-60-0x0000000020860000-0x000000002099A000-memory.dmp

          Filesize

          1.2MB

        • memory/1332-61-0x0000000002490000-0x0000000003490000-memory.dmp

          Filesize

          16.0MB

        • memory/1332-62-0x0000000002490000-0x00000000025B0000-memory.dmp

          Filesize

          1.1MB

        • memory/1480-54-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

          Filesize

          8KB