Analysis
-
max time kernel
500s -
max time network
509s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-es -
resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
29-11-2022 21:25
Static task
static1
Behavioral task
behavioral1
Sample
Fact63867.msi
Resource
win7-20220812-es
Behavioral task
behavioral2
Sample
Fact63867.msi
Resource
win10v2004-20220812-es
General
-
Target
Fact63867.msi
-
Size
6.2MB
-
MD5
ed4a51080ca004ea566ac94a3c73e89d
-
SHA1
6928d42a8324c0d93be8655d32c9c5712c8ffcd9
-
SHA256
b324bf2765637c425eea72826c3a1524873fc8b2dc7c06cf9f5b3312bde8861a
-
SHA512
9e5c2f08639edd4bf3a05463a031a4e60a51854bf4f3ed213a1b5e06878e28a7dc951a8039fa35b3024ea8b6c15b833c439ac81908828545a062a0a152e7d14f
-
SSDEEP
98304:5YItM2AfnWKKLLS4MDCMPXbGSfK/8JzDuXcVCfDH22JG3w392SscX7e8iN:pMnlKLO4OLO2DuXcVyvKy2
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
MsiExec.exeflow pid process 4 3456 MsiExec.exe -
Loads dropped DLL 6 IoCs
Processes:
MsiExec.exepid process 3456 MsiExec.exe 3456 MsiExec.exe 3456 MsiExec.exe 3456 MsiExec.exe 3456 MsiExec.exe 3456 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
MsiExec.exepid process 3456 MsiExec.exe -
Drops file in Windows directory 12 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{E12CC978-1278-41DF-B989-1A6CA608FCF4} msiexec.exe File opened for modification C:\Windows\Installer\MSIA496.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9CE1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9FFF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA0BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA149.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4E5.tmp msiexec.exe File created C:\Windows\Installer\e569be7.msi msiexec.exe File opened for modification C:\Windows\Installer\e569be7.msi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msiexec.exeMsiExec.exepid process 4884 msiexec.exe 4884 msiexec.exe 3456 MsiExec.exe 3456 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2276 msiexec.exe Token: SeIncreaseQuotaPrivilege 2276 msiexec.exe Token: SeSecurityPrivilege 4884 msiexec.exe Token: SeCreateTokenPrivilege 2276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2276 msiexec.exe Token: SeLockMemoryPrivilege 2276 msiexec.exe Token: SeIncreaseQuotaPrivilege 2276 msiexec.exe Token: SeMachineAccountPrivilege 2276 msiexec.exe Token: SeTcbPrivilege 2276 msiexec.exe Token: SeSecurityPrivilege 2276 msiexec.exe Token: SeTakeOwnershipPrivilege 2276 msiexec.exe Token: SeLoadDriverPrivilege 2276 msiexec.exe Token: SeSystemProfilePrivilege 2276 msiexec.exe Token: SeSystemtimePrivilege 2276 msiexec.exe Token: SeProfSingleProcessPrivilege 2276 msiexec.exe Token: SeIncBasePriorityPrivilege 2276 msiexec.exe Token: SeCreatePagefilePrivilege 2276 msiexec.exe Token: SeCreatePermanentPrivilege 2276 msiexec.exe Token: SeBackupPrivilege 2276 msiexec.exe Token: SeRestorePrivilege 2276 msiexec.exe Token: SeShutdownPrivilege 2276 msiexec.exe Token: SeDebugPrivilege 2276 msiexec.exe Token: SeAuditPrivilege 2276 msiexec.exe Token: SeSystemEnvironmentPrivilege 2276 msiexec.exe Token: SeChangeNotifyPrivilege 2276 msiexec.exe Token: SeRemoteShutdownPrivilege 2276 msiexec.exe Token: SeUndockPrivilege 2276 msiexec.exe Token: SeSyncAgentPrivilege 2276 msiexec.exe Token: SeEnableDelegationPrivilege 2276 msiexec.exe Token: SeManageVolumePrivilege 2276 msiexec.exe Token: SeImpersonatePrivilege 2276 msiexec.exe Token: SeCreateGlobalPrivilege 2276 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 2276 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
msiexec.exedescription pid process target process PID 4884 wrote to memory of 3456 4884 msiexec.exe MsiExec.exe PID 4884 wrote to memory of 3456 4884 msiexec.exe MsiExec.exe PID 4884 wrote to memory of 3456 4884 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Fact63867.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 440F16839D9E89DAC9334566062ED8302⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI9CE1.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSI9CE1.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSI9FFF.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSI9FFF.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSIA0BB.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSIA0BB.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSIA149.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSIA149.tmpFilesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
C:\Windows\Installer\MSIA4E5.tmpFilesize
5.6MB
MD5afb959b80485c54d9826079f19f082fb
SHA11ccd9c54b0cbcf2430bf7e6da9b3848702cf0b2c
SHA25650c6fd23e092687df69dfd82ed40e14fe55e667a47e8dd2884ab936de75d7a4f
SHA512c0165196d2ca411dc15e34cb9d30bd09a14a0049c78d6c6e647ea55d5de6f84f3c2813db56e5fe19f26c901690d55145835d317826bbe7aded898515a4f690c8
-
C:\Windows\Installer\MSIA4E5.tmpFilesize
5.6MB
MD5afb959b80485c54d9826079f19f082fb
SHA11ccd9c54b0cbcf2430bf7e6da9b3848702cf0b2c
SHA25650c6fd23e092687df69dfd82ed40e14fe55e667a47e8dd2884ab936de75d7a4f
SHA512c0165196d2ca411dc15e34cb9d30bd09a14a0049c78d6c6e647ea55d5de6f84f3c2813db56e5fe19f26c901690d55145835d317826bbe7aded898515a4f690c8
-
C:\Windows\Installer\MSIA4E5.tmpFilesize
5.6MB
MD5afb959b80485c54d9826079f19f082fb
SHA11ccd9c54b0cbcf2430bf7e6da9b3848702cf0b2c
SHA25650c6fd23e092687df69dfd82ed40e14fe55e667a47e8dd2884ab936de75d7a4f
SHA512c0165196d2ca411dc15e34cb9d30bd09a14a0049c78d6c6e647ea55d5de6f84f3c2813db56e5fe19f26c901690d55145835d317826bbe7aded898515a4f690c8
-
memory/3456-132-0x0000000000000000-mapping.dmp
-
memory/3456-144-0x0000000003470000-0x0000000004128000-memory.dmpFilesize
12.7MB
-
memory/3456-147-0x0000000003470000-0x0000000004128000-memory.dmpFilesize
12.7MB
-
memory/3456-148-0x0000000003470000-0x0000000004128000-memory.dmpFilesize
12.7MB