Analysis

  • max time kernel
    262s
  • max time network
    242s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:31

General

  • Target

    3c2a5970a483c50e58bf5fb669c6415a48d3782a5b2b996982ed9a823672ccec.msi

  • Size

    2.4MB

  • MD5

    31c4df7e1828b1ddd9e4844974932c50

  • SHA1

    a853817ebd51d9a6a7ac6550c7ce4ef6dffa60cd

  • SHA256

    3c2a5970a483c50e58bf5fb669c6415a48d3782a5b2b996982ed9a823672ccec

  • SHA512

    8d38fb73d65b706a8503722332f7ec414e326bd64faadcef0005d2683f7f182f2c355087871ca1b92dd97f0602f029dd20e1fa059690fff068134fa42941a724

  • SSDEEP

    49152:2eAJFzCDuiCIVUH+N6hfyRjXSkUwF3PswkemIC638eDGlS6DtQ:mpCDu/nHBhxwF5keJJcS0Q

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3c2a5970a483c50e58bf5fb669c6415a48d3782a5b2b996982ed9a823672ccec.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3168
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8FB3217211C4EBA40916A71EB7355D99 C
      2⤵
      • Loads dropped DLL
      PID:908

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI28BD.tmp

    Filesize

    231KB

    MD5

    def1669123bc5bd8e9a3a93e7f68b58c

    SHA1

    101e1f6e9795672319543b9e69f9cb62a3d55055

    SHA256

    82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9

    SHA512

    b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c

  • C:\Users\Admin\AppData\Local\Temp\MSI28BD.tmp

    Filesize

    231KB

    MD5

    def1669123bc5bd8e9a3a93e7f68b58c

    SHA1

    101e1f6e9795672319543b9e69f9cb62a3d55055

    SHA256

    82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9

    SHA512

    b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c

  • C:\Users\Admin\AppData\Local\Temp\MSID656.tmp

    Filesize

    231KB

    MD5

    def1669123bc5bd8e9a3a93e7f68b58c

    SHA1

    101e1f6e9795672319543b9e69f9cb62a3d55055

    SHA256

    82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9

    SHA512

    b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c

  • C:\Users\Admin\AppData\Local\Temp\MSID656.tmp

    Filesize

    231KB

    MD5

    def1669123bc5bd8e9a3a93e7f68b58c

    SHA1

    101e1f6e9795672319543b9e69f9cb62a3d55055

    SHA256

    82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9

    SHA512

    b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c

  • memory/908-132-0x0000000000000000-mapping.dmp