223acd242d8d3d1952aa17194b9eb44faa44b9c7c7e898e7d7b36d1cead4a9de

General

Target

SYSTEM.Critical.Upgrade.Win10.0.14129a18398ef3d.msi
Size

2.7MB
MD5

c4b90f7b86d6a1656f0d40d3cbae8aec
SHA1

893368a6b1f00b5665ba0a403042ca955842246a
SHA256

8d8c15da905c23fb964b0d77e18ba404a59222f08c8eb992e5092b735a66bf5e
SHA512

06ed7a65f9009e529438996184984d4d5d0689878eff8ba5e7be2e58bb6a1657ef06ca7e1e803a3773a67e3c4201ee9a7c48727626b91a91f2a2ccf813799da8
SSDEEP

3072:NOiggXYJ4SsWzlV3lXHXNX9XXXDC/9MvuMz7/822I:N8gXPr/9Mv5z7/822

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid process

1188 MsiExec.exe

pid	process
1188	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	900	msiexec.exe
Token: SeRestorePrivilege	936	msiexec.exe
Token: SeTakeOwnershipPrivilege	936	msiexec.exe
Token: SeSecurityPrivilege	936	msiexec.exe
Token: SeCreateTokenPrivilege	900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	900	msiexec.exe
Token: SeLockMemoryPrivilege	900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	900	msiexec.exe
Token: SeMachineAccountPrivilege	900	msiexec.exe
Token: SeTcbPrivilege	900	msiexec.exe
Token: SeSecurityPrivilege	900	msiexec.exe
Token: SeTakeOwnershipPrivilege	900	msiexec.exe
Token: SeLoadDriverPrivilege	900	msiexec.exe
Token: SeSystemProfilePrivilege	900	msiexec.exe
Token: SeSystemtimePrivilege	900	msiexec.exe
Token: SeProfSingleProcessPrivilege	900	msiexec.exe
Token: SeIncBasePriorityPrivilege	900	msiexec.exe
Token: SeCreatePagefilePrivilege	900	msiexec.exe
Token: SeCreatePermanentPrivilege	900	msiexec.exe
Token: SeBackupPrivilege	900	msiexec.exe
Token: SeRestorePrivilege	900	msiexec.exe
Token: SeShutdownPrivilege	900	msiexec.exe
Token: SeDebugPrivilege	900	msiexec.exe
Token: SeAuditPrivilege	900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	900	msiexec.exe
Token: SeChangeNotifyPrivilege	900	msiexec.exe
Token: SeRemoteShutdownPrivilege	900	msiexec.exe
Token: SeUndockPrivilege	900	msiexec.exe
Token: SeSyncAgentPrivilege	900	msiexec.exe
Token: SeEnableDelegationPrivilege	900	msiexec.exe
Token: SeManageVolumePrivilege	900	msiexec.exe
Token: SeImpersonatePrivilege	900	msiexec.exe
Token: SeCreateGlobalPrivilege	900	msiexec.exe
Token: SeCreateTokenPrivilege	900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	900	msiexec.exe
Token: SeLockMemoryPrivilege	900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	900	msiexec.exe
Token: SeMachineAccountPrivilege	900	msiexec.exe
Token: SeTcbPrivilege	900	msiexec.exe
Token: SeSecurityPrivilege	900	msiexec.exe
Token: SeTakeOwnershipPrivilege	900	msiexec.exe
Token: SeLoadDriverPrivilege	900	msiexec.exe
Token: SeSystemProfilePrivilege	900	msiexec.exe
Token: SeSystemtimePrivilege	900	msiexec.exe
Token: SeProfSingleProcessPrivilege	900	msiexec.exe
Token: SeIncBasePriorityPrivilege	900	msiexec.exe
Token: SeCreatePagefilePrivilege	900	msiexec.exe
Token: SeCreatePermanentPrivilege	900	msiexec.exe
Token: SeBackupPrivilege	900	msiexec.exe
Token: SeRestorePrivilege	900	msiexec.exe
Token: SeShutdownPrivilege	900	msiexec.exe
Token: SeDebugPrivilege	900	msiexec.exe
Token: SeAuditPrivilege	900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	900	msiexec.exe
Token: SeChangeNotifyPrivilege	900	msiexec.exe
Token: SeRemoteShutdownPrivilege	900	msiexec.exe
Token: SeUndockPrivilege	900	msiexec.exe
Token: SeSyncAgentPrivilege	900	msiexec.exe
Token: SeEnableDelegationPrivilege	900	msiexec.exe
Token: SeManageVolumePrivilege	900	msiexec.exe
Token: SeImpersonatePrivilege	900	msiexec.exe
Token: SeCreateGlobalPrivilege	900	msiexec.exe
Token: SeCreateTokenPrivilege	900	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

900 msiexec.exe

pid	process
900	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 936 wrote to memory of 1188	936	msiexec.exe	MsiExec.exe
PID 936 wrote to memory of 1188	936	msiexec.exe	MsiExec.exe
PID 936 wrote to memory of 1188	936	msiexec.exe	MsiExec.exe
PID 936 wrote to memory of 1188	936	msiexec.exe	MsiExec.exe
PID 936 wrote to memory of 1188	936	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SYSTEM.Critical.Upgrade.Win10.0.14129a18398ef3d.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 4746B66ECFE963A6BA51AA81A071F13C C
  2⤵
  - Loads dropped DLL
  PID:1188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI1028.tmp

Filesize
84KB

MD5
0345408e69f9976c645c0df33b36f708

SHA1
82d6140eb4b09ed215e564d86e6a47c0e26a065d

SHA256
9bb14d25e7bcae1d8249bd94d365f2c2b05896c94925d82f65cbc595ca8d6616

SHA512
de04cb10b6c1905d6584797467878569613608e99308749c2cad40901ae11b6e82eaee82ff907631bc89ba5bd09fd9f337071e5685b1c2b1a693d39e78ed679b

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1028.tmp

Filesize
84KB

MD5
0345408e69f9976c645c0df33b36f708

SHA1
82d6140eb4b09ed215e564d86e6a47c0e26a065d

SHA256
9bb14d25e7bcae1d8249bd94d365f2c2b05896c94925d82f65cbc595ca8d6616

SHA512
de04cb10b6c1905d6584797467878569613608e99308749c2cad40901ae11b6e82eaee82ff907631bc89ba5bd09fd9f337071e5685b1c2b1a693d39e78ed679b

Download Submit
memory/900-54-0x000007FEFC3B1000-0x000007FEFC3B3000-memory.dmp

Filesize
8KB

Download
memory/1188-56-0x0000000000000000-mapping.dmp

Download
memory/1188-60-0x0000000180000000-0x0000000180018000-memory.dmp

Filesize
96KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads