Analysis

  • max time kernel
    59s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2022 23:38

General

  • Target

    fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55.msi

  • Size

    1.1MB

  • MD5

    250a23219a576180547734430d71b0e6

  • SHA1

    a5bcdb824d325d44c5e0feb5bf9389da520e6f82

  • SHA256

    fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55

  • SHA512

    e0c26cceff37d9328dddc9989ff75070b51a3ccd35c93e82fdcda3a828a90ac53d8604524f5195cc9d4865aa8680ccfd79f6d85710b46496ab9efea321c13417

  • SSDEEP

    1536:j66iqjTbG3VvotZmMi0W7Ap0Ds0Dm78x:jAGelvoW0dQx

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1684
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding CEDB4DA5A15ECFDD24F1AD731CE9DBE9
      2⤵
      • Loads dropped DLL
      PID:1596
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1060
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B0" "0000000000000548"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:888
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\WaitApprove.lock
    1⤵
    • Modifies registry class
    PID:432
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:940
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1700

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\Installer\MSI72A1.tmp

        Filesize

        1.1MB

        MD5

        13e790d06a0eb1e0135f5d3e2cd0ba02

        SHA1

        7fba1f17c598679c0676d04db5c891b2f04003a2

        SHA256

        9f2dbba04b9b3cdb7a90b691d74372f7314421986a33ef0340d7a3451474c0dd

        SHA512

        212c6abc51cd8ad262f1a88f41e9f961f19affd610c757a0c522a65412fef26d5cb826dc83518cd9aede768270a5901de2bd7e588c7b4ce4980b15b2394cd417

      • \Windows\Installer\MSI72A1.tmp

        Filesize

        1.1MB

        MD5

        13e790d06a0eb1e0135f5d3e2cd0ba02

        SHA1

        7fba1f17c598679c0676d04db5c891b2f04003a2

        SHA256

        9f2dbba04b9b3cdb7a90b691d74372f7314421986a33ef0340d7a3451474c0dd

        SHA512

        212c6abc51cd8ad262f1a88f41e9f961f19affd610c757a0c522a65412fef26d5cb826dc83518cd9aede768270a5901de2bd7e588c7b4ce4980b15b2394cd417

      • memory/1684-54-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

        Filesize

        8KB