Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 11:43

General

  • Target

    File_Part.1.msi

  • Size

    484.3MB

  • MD5

    c970f7ea3af14415cc2a47eba0d86f9c

  • SHA1

    eaf1b4bdbbc5adfd7b9959ba898305f2277b57c1

  • SHA256

    fdf27fedc4ee0afda54f5ad05b490570d9bf025636b18b74fcda5a604aabee6f

  • SHA512

    8b96d0780bbb476937ecc1a148e34666bb821aaf576f18276fafe746c329fefa3d10728a44863caa3191db7d5ae9c5f07650893923a277a178c9b65e3110d79e

  • SSDEEP

    49152:PCbnqiTqLNEfjQpamz+IgtxSPuPzB29FQN:Uqdqfuamz+IgtB7BaFQN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\File_Part.1.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2460
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0FB318747A2D0B61BD8BFC449E2FE9EE
      2⤵
      • Loads dropped DLL
      PID:4792

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Installer\MSIEFB4.tmp

          Filesize

          483.8MB

          MD5

          99f2f92fc126e2a1d74f29973bbc48f9

          SHA1

          988ab2fa002cc60e9c286dbdb3774043a72a1c46

          SHA256

          b8bf60526783aff6a053a1a9aa8c5b781b7af7b55bbfe44fbb7d63c8f08094f5

          SHA512

          5b0f07be7bd6c6c13291b4bbf8a8661ff97590df30f10998362cd1f6453b194c483a0273366e8183547509087231cb544e776eb0e69d9ccc8e1ccf2bb31d74dc

        • C:\Windows\Installer\MSIEFB4.tmp

          Filesize

          483.8MB

          MD5

          99f2f92fc126e2a1d74f29973bbc48f9

          SHA1

          988ab2fa002cc60e9c286dbdb3774043a72a1c46

          SHA256

          b8bf60526783aff6a053a1a9aa8c5b781b7af7b55bbfe44fbb7d63c8f08094f5

          SHA512

          5b0f07be7bd6c6c13291b4bbf8a8661ff97590df30f10998362cd1f6453b194c483a0273366e8183547509087231cb544e776eb0e69d9ccc8e1ccf2bb31d74dc

        • memory/4792-135-0x0000000002E70000-0x0000000002FAA000-memory.dmp

          Filesize

          1.2MB

        • memory/4792-136-0x00000000563A0000-0x00000000573A0000-memory.dmp

          Filesize

          16.0MB

        • memory/4792-137-0x0000000002E70000-0x0000000002FAA000-memory.dmp

          Filesize

          1.2MB

        • memory/4792-138-0x00000000563A0000-0x00000000573A0000-memory.dmp

          Filesize

          16.0MB

        • memory/4792-139-0x0000000002E70000-0x0000000002F3B000-memory.dmp

          Filesize

          812KB

        • memory/4792-140-0x0000000002F40000-0x0000000002FF8000-memory.dmp

          Filesize

          736KB

        • memory/4792-143-0x00000000563A0000-0x00000000564C0000-memory.dmp

          Filesize

          1.1MB