b0742cf240a780998f6f9797e7398080596f36eed1c4d28cb3dee45b01888683

Analysis

max time kernel
85s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0742cf240a780998f6f9797e7398080596f36eed1c4d28cb3dee45b01888683.msi
Size

5.4MB
MD5

0d34f089103bc46a2860449fa715a9d6
SHA1

5866dac430b162131bf8e5ffaaf7f2e4894248fb
SHA256

b0742cf240a780998f6f9797e7398080596f36eed1c4d28cb3dee45b01888683
SHA512

24c06a02a79823e2fcb70ebe139362ce3fd99f2ab95391bbaa21eccdadb82a3b405251fc1c612baf9bbe3279e8c5acbfb32237b8e2a44b75eaf0bdd1dca35721
SSDEEP

98304:7X2gEIKUIRklwb1ByyMOjyNgEym8Jr1Eal0w/fKpYPglm/UA:7pEIKVksIOq+m8J590w/fX/t

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

2 1436 msiexec.exe
10 1436 msiexec.exe
11 1436 msiexec.exe
12 1436 msiexec.exe

flow	pid	process
2	1436	msiexec.exe
10	1436	msiexec.exe
11	1436	msiexec.exe
12	1436	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1436	msiexec.exe
Token: SeSecurityPrivilege	3552	msiexec.exe
Token: SeCreateTokenPrivilege	1436	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1436	msiexec.exe
Token: SeLockMemoryPrivilege	1436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1436	msiexec.exe
Token: SeMachineAccountPrivilege	1436	msiexec.exe
Token: SeTcbPrivilege	1436	msiexec.exe
Token: SeSecurityPrivilege	1436	msiexec.exe
Token: SeTakeOwnershipPrivilege	1436	msiexec.exe
Token: SeLoadDriverPrivilege	1436	msiexec.exe
Token: SeSystemProfilePrivilege	1436	msiexec.exe
Token: SeSystemtimePrivilege	1436	msiexec.exe
Token: SeProfSingleProcessPrivilege	1436	msiexec.exe
Token: SeIncBasePriorityPrivilege	1436	msiexec.exe
Token: SeCreatePagefilePrivilege	1436	msiexec.exe
Token: SeCreatePermanentPrivilege	1436	msiexec.exe
Token: SeBackupPrivilege	1436	msiexec.exe
Token: SeRestorePrivilege	1436	msiexec.exe
Token: SeShutdownPrivilege	1436	msiexec.exe
Token: SeDebugPrivilege	1436	msiexec.exe
Token: SeAuditPrivilege	1436	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1436	msiexec.exe
Token: SeChangeNotifyPrivilege	1436	msiexec.exe
Token: SeRemoteShutdownPrivilege	1436	msiexec.exe
Token: SeUndockPrivilege	1436	msiexec.exe
Token: SeSyncAgentPrivilege	1436	msiexec.exe
Token: SeEnableDelegationPrivilege	1436	msiexec.exe
Token: SeManageVolumePrivilege	1436	msiexec.exe
Token: SeImpersonatePrivilege	1436	msiexec.exe
Token: SeCreateGlobalPrivilege	1436	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1436 msiexec.exe

pid	process
1436	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b0742cf240a780998f6f9797e7398080596f36eed1c4d28cb3dee45b01888683.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads