Analysis
-
max time kernel
169s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:50
Static task
static1
Behavioral task
behavioral1
Sample
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe
-
Size
1.8MB
-
MD5
66c518b52c4dad0446e55281d55f3885
-
SHA1
7839594d385e071d21667f75a1166354ebef3eef
-
SHA256
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1
-
SHA512
f1ec0fb1135d9328c5cf9b92b94ca5d05554cc11c62980f7b3affde60d73236fec0eca2ee07e41b8a1a35d96f789dab6c24553c5b4b287f3efe930d4597e44e7
-
SSDEEP
49152:McbVoF4YyQ7yXSc607o5wGp+fTu9LhJwM:McXYybXSH07o5byTqyM
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 572 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\V: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1600 MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1600 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1600 MSIEXEC.EXE Token: SeRestorePrivilege 1128 msiexec.exe Token: SeTakeOwnershipPrivilege 1128 msiexec.exe Token: SeSecurityPrivilege 1128 msiexec.exe Token: SeCreateTokenPrivilege 1600 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 1600 MSIEXEC.EXE Token: SeLockMemoryPrivilege 1600 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1600 MSIEXEC.EXE Token: SeMachineAccountPrivilege 1600 MSIEXEC.EXE Token: SeTcbPrivilege 1600 MSIEXEC.EXE Token: SeSecurityPrivilege 1600 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 1600 MSIEXEC.EXE Token: SeLoadDriverPrivilege 1600 MSIEXEC.EXE Token: SeSystemProfilePrivilege 1600 MSIEXEC.EXE Token: SeSystemtimePrivilege 1600 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 1600 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 1600 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 1600 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 1600 MSIEXEC.EXE Token: SeBackupPrivilege 1600 MSIEXEC.EXE Token: SeRestorePrivilege 1600 MSIEXEC.EXE Token: SeShutdownPrivilege 1600 MSIEXEC.EXE Token: SeDebugPrivilege 1600 MSIEXEC.EXE Token: SeAuditPrivilege 1600 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 1600 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 1600 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 1600 MSIEXEC.EXE Token: SeUndockPrivilege 1600 MSIEXEC.EXE Token: SeSyncAgentPrivilege 1600 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 1600 MSIEXEC.EXE Token: SeManageVolumePrivilege 1600 MSIEXEC.EXE Token: SeImpersonatePrivilege 1600 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 1600 MSIEXEC.EXE Token: SeCreateTokenPrivilege 1600 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 1600 MSIEXEC.EXE Token: SeLockMemoryPrivilege 1600 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1600 MSIEXEC.EXE Token: SeMachineAccountPrivilege 1600 MSIEXEC.EXE Token: SeTcbPrivilege 1600 MSIEXEC.EXE Token: SeSecurityPrivilege 1600 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 1600 MSIEXEC.EXE Token: SeLoadDriverPrivilege 1600 MSIEXEC.EXE Token: SeSystemProfilePrivilege 1600 MSIEXEC.EXE Token: SeSystemtimePrivilege 1600 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 1600 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 1600 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 1600 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 1600 MSIEXEC.EXE Token: SeBackupPrivilege 1600 MSIEXEC.EXE Token: SeRestorePrivilege 1600 MSIEXEC.EXE Token: SeShutdownPrivilege 1600 MSIEXEC.EXE Token: SeDebugPrivilege 1600 MSIEXEC.EXE Token: SeAuditPrivilege 1600 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 1600 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 1600 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 1600 MSIEXEC.EXE Token: SeUndockPrivilege 1600 MSIEXEC.EXE Token: SeSyncAgentPrivilege 1600 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 1600 MSIEXEC.EXE Token: SeManageVolumePrivilege 1600 MSIEXEC.EXE Token: SeImpersonatePrivilege 1600 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 1600 MSIEXEC.EXE Token: SeCreateTokenPrivilege 1600 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1600 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1364 wrote to memory of 1600 1364 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 28 PID 1128 wrote to memory of 572 1128 msiexec.exe 30 PID 1128 wrote to memory of 572 1128 msiexec.exe 30 PID 1128 wrote to memory of 572 1128 msiexec.exe 30 PID 1128 wrote to memory of 572 1128 msiexec.exe 30 PID 1128 wrote to memory of 572 1128 msiexec.exe 30 PID 1128 wrote to memory of 572 1128 msiexec.exe 30 PID 1128 wrote to memory of 572 1128 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe"C:\Users\Admin\AppData\Local\Temp\81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\_isBEBF\DuDu Accelerator For Internet Explorer.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1600
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 22D91729DB99F85485DB27A5C2580059 C2⤵
- Loads dropped DLL
PID:572
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5ad295c6facfa36b7342f53823aa5f17a
SHA1b55669a3f0a63310aca8a0b07186bdd6692e6683
SHA256f2d8832961cdaccf55f1affd8aeaac7c6efc25d6dd36b616bb89594c383ce68b
SHA512a9a43ef89c6b834fc0376742f46788afd61c9ada39ccf5e4167f5e0526dca6cc46e36c3b50ed54c6c3b593bb64d6849cd6225a391643f41a5c19b4d76a7f9dcd
-
Filesize
1.5MB
MD5c21e20465ca8d9c64175748867601d30
SHA15eeae98b5a0cbb03b4aad983d8e76d4cf6473acf
SHA256871753da2539056afe35b66d6579fb0d0601a80cedbf43f37aeefdc1664e7a8b
SHA512695a47a7fb490bad9a5bebf8b6fc3286a2370de60d97908326d828f2e332b4edd4bddc0dbf0a9fb1a06fd301ee2328b97809a09f7c42ca094a1a7b2edbb71c84
-
Filesize
84KB
MD5ad295c6facfa36b7342f53823aa5f17a
SHA1b55669a3f0a63310aca8a0b07186bdd6692e6683
SHA256f2d8832961cdaccf55f1affd8aeaac7c6efc25d6dd36b616bb89594c383ce68b
SHA512a9a43ef89c6b834fc0376742f46788afd61c9ada39ccf5e4167f5e0526dca6cc46e36c3b50ed54c6c3b593bb64d6849cd6225a391643f41a5c19b4d76a7f9dcd