Analysis
-
max time kernel
180s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:50
Static task
static1
Behavioral task
behavioral1
Sample
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe
-
Size
1.8MB
-
MD5
66c518b52c4dad0446e55281d55f3885
-
SHA1
7839594d385e071d21667f75a1166354ebef3eef
-
SHA256
81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1
-
SHA512
f1ec0fb1135d9328c5cf9b92b94ca5d05554cc11c62980f7b3affde60d73236fec0eca2ee07e41b8a1a35d96f789dab6c24553c5b4b287f3efe930d4597e44e7
-
SSDEEP
49152:McbVoF4YyQ7yXSc607o5wGp+fTu9LhJwM:McXYybXSH07o5byTqyM
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1464 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 228 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 228 MSIEXEC.EXE Token: SeSecurityPrivilege 4864 msiexec.exe Token: SeCreateTokenPrivilege 228 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 228 MSIEXEC.EXE Token: SeLockMemoryPrivilege 228 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 228 MSIEXEC.EXE Token: SeMachineAccountPrivilege 228 MSIEXEC.EXE Token: SeTcbPrivilege 228 MSIEXEC.EXE Token: SeSecurityPrivilege 228 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 228 MSIEXEC.EXE Token: SeLoadDriverPrivilege 228 MSIEXEC.EXE Token: SeSystemProfilePrivilege 228 MSIEXEC.EXE Token: SeSystemtimePrivilege 228 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 228 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 228 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 228 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 228 MSIEXEC.EXE Token: SeBackupPrivilege 228 MSIEXEC.EXE Token: SeRestorePrivilege 228 MSIEXEC.EXE Token: SeShutdownPrivilege 228 MSIEXEC.EXE Token: SeDebugPrivilege 228 MSIEXEC.EXE Token: SeAuditPrivilege 228 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 228 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 228 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 228 MSIEXEC.EXE Token: SeUndockPrivilege 228 MSIEXEC.EXE Token: SeSyncAgentPrivilege 228 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 228 MSIEXEC.EXE Token: SeManageVolumePrivilege 228 MSIEXEC.EXE Token: SeImpersonatePrivilege 228 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 228 MSIEXEC.EXE Token: SeCreateTokenPrivilege 228 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 228 MSIEXEC.EXE Token: SeLockMemoryPrivilege 228 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 228 MSIEXEC.EXE Token: SeMachineAccountPrivilege 228 MSIEXEC.EXE Token: SeTcbPrivilege 228 MSIEXEC.EXE Token: SeSecurityPrivilege 228 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 228 MSIEXEC.EXE Token: SeLoadDriverPrivilege 228 MSIEXEC.EXE Token: SeSystemProfilePrivilege 228 MSIEXEC.EXE Token: SeSystemtimePrivilege 228 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 228 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 228 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 228 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 228 MSIEXEC.EXE Token: SeBackupPrivilege 228 MSIEXEC.EXE Token: SeRestorePrivilege 228 MSIEXEC.EXE Token: SeShutdownPrivilege 228 MSIEXEC.EXE Token: SeDebugPrivilege 228 MSIEXEC.EXE Token: SeAuditPrivilege 228 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 228 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 228 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 228 MSIEXEC.EXE Token: SeUndockPrivilege 228 MSIEXEC.EXE Token: SeSyncAgentPrivilege 228 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 228 MSIEXEC.EXE Token: SeManageVolumePrivilege 228 MSIEXEC.EXE Token: SeImpersonatePrivilege 228 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 228 MSIEXEC.EXE Token: SeCreateTokenPrivilege 228 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 228 MSIEXEC.EXE Token: SeLockMemoryPrivilege 228 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 228 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2948 wrote to memory of 228 2948 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 83 PID 2948 wrote to memory of 228 2948 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 83 PID 2948 wrote to memory of 228 2948 81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe 83 PID 4864 wrote to memory of 1464 4864 msiexec.exe 86 PID 4864 wrote to memory of 1464 4864 msiexec.exe 86 PID 4864 wrote to memory of 1464 4864 msiexec.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe"C:\Users\Admin\AppData\Local\Temp\81dfe6a0d274edc833c5114fa856bd503256c681bda39de6337e0d0fd4cef6e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\_is3E52\DuDu Accelerator For Internet Explorer.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:228
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 07E49CD25846FA9988AFC513E18A8876 C2⤵
- Loads dropped DLL
PID:1464
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5ad295c6facfa36b7342f53823aa5f17a
SHA1b55669a3f0a63310aca8a0b07186bdd6692e6683
SHA256f2d8832961cdaccf55f1affd8aeaac7c6efc25d6dd36b616bb89594c383ce68b
SHA512a9a43ef89c6b834fc0376742f46788afd61c9ada39ccf5e4167f5e0526dca6cc46e36c3b50ed54c6c3b593bb64d6849cd6225a391643f41a5c19b4d76a7f9dcd
-
Filesize
84KB
MD5ad295c6facfa36b7342f53823aa5f17a
SHA1b55669a3f0a63310aca8a0b07186bdd6692e6683
SHA256f2d8832961cdaccf55f1affd8aeaac7c6efc25d6dd36b616bb89594c383ce68b
SHA512a9a43ef89c6b834fc0376742f46788afd61c9ada39ccf5e4167f5e0526dca6cc46e36c3b50ed54c6c3b593bb64d6849cd6225a391643f41a5c19b4d76a7f9dcd
-
Filesize
1.5MB
MD5c21e20465ca8d9c64175748867601d30
SHA15eeae98b5a0cbb03b4aad983d8e76d4cf6473acf
SHA256871753da2539056afe35b66d6579fb0d0601a80cedbf43f37aeefdc1664e7a8b
SHA512695a47a7fb490bad9a5bebf8b6fc3286a2370de60d97908326d828f2e332b4edd4bddc0dbf0a9fb1a06fd301ee2328b97809a09f7c42ca094a1a7b2edbb71c84