Analysis
-
max time kernel
186s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:45
Static task
static1
Behavioral task
behavioral1
Sample
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe
Resource
win10v2004-20220812-en
General
-
Target
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe
-
Size
167KB
-
MD5
98ef819f3d8f7c63fd64c818c575f54b
-
SHA1
b6f7dec83a2d7e7fc2b39f92797c17d839186291
-
SHA256
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806
-
SHA512
0e2cb23d3c8e1751dc187c200ba6dac8bd2c43366495d2728aa2eaecf81b70fae6394fbdf73c354ef7daf8e8668beb0ccd1994eeb94420c9d0d15c7299d07f8c
-
SSDEEP
3072:w6lLYNrblBWBcywybPj8J2QTHPl4c0FkTC6fUNRD5byFW:hIdfyb3WPlr0FkTCuUjD5uW
Malware Config
Signatures
-
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\25773 = "c:\\progra~3\\msijhet.exe" msiexec.exe -
Blocklisted process makes network request 5 IoCs
Processes:
msiexec.exeflow pid process 27 1016 msiexec.exe 29 1016 msiexec.exe 58 1016 msiexec.exe 64 1016 msiexec.exe 72 1016 msiexec.exe -
Disables taskbar notifications via registry modification
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exedescription pid process target process PID 4984 set thread context of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created \??\c:\progra~3\msijhet.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exemsiexec.exepid process 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exemsiexec.exepid process 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe 1016 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
msiexec.exedescription pid process Token: SeDebugPrivilege 1016 msiexec.exe Token: SeBackupPrivilege 1016 msiexec.exe Token: SeRestorePrivilege 1016 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exemsiexec.exedescription pid process target process PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4984 wrote to memory of 4752 4984 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe PID 4752 wrote to memory of 1016 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe msiexec.exe PID 4752 wrote to memory of 1016 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe msiexec.exe PID 4752 wrote to memory of 1016 4752 684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe msiexec.exe PID 1016 wrote to memory of 848 1016 msiexec.exe msiexec.exe PID 1016 wrote to memory of 848 1016 msiexec.exe msiexec.exe PID 1016 wrote to memory of 848 1016 msiexec.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe"C:\Users\Admin\AppData\Local\Temp\684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe"C:\Users\Admin\AppData\Local\Temp\684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"4⤵PID:848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\progra~3\msijhet.exeFilesize
167KB
MD598ef819f3d8f7c63fd64c818c575f54b
SHA1b6f7dec83a2d7e7fc2b39f92797c17d839186291
SHA256684d9a6f22dbeaade18db4926d86c3eb4b0b92d01845c50d122e79df6fb33806
SHA5120e2cb23d3c8e1751dc187c200ba6dac8bd2c43366495d2728aa2eaecf81b70fae6394fbdf73c354ef7daf8e8668beb0ccd1994eeb94420c9d0d15c7299d07f8c
-
memory/848-142-0x0000000000000000-mapping.dmp
-
memory/1016-138-0x0000000000000000-mapping.dmp
-
memory/1016-139-0x0000000000A10000-0x0000000000A22000-memory.dmpFilesize
72KB
-
memory/1016-140-0x00000000007C0000-0x00000000007C7000-memory.dmpFilesize
28KB
-
memory/1016-141-0x000000007F3A0000-0x000000007F3A7000-memory.dmpFilesize
28KB
-
memory/1016-144-0x000000007F3A0000-0x000000007F3A7000-memory.dmpFilesize
28KB
-
memory/4752-133-0x0000000000000000-mapping.dmp
-
memory/4752-134-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4752-136-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4752-137-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4984-132-0x0000000000630000-0x0000000000637000-memory.dmpFilesize
28KB