223acd242d8d3d1952aa17194b9eb44faa44b9c7c7e898e7d7b36d1cead4a9de

General

Target

SYSTEM.Critical.Upgrade.Win10.0.14129a18398ef3d.msi
Size

2.7MB
MD5

c4b90f7b86d6a1656f0d40d3cbae8aec
SHA1

893368a6b1f00b5665ba0a403042ca955842246a
SHA256

8d8c15da905c23fb964b0d77e18ba404a59222f08c8eb992e5092b735a66bf5e
SHA512

06ed7a65f9009e529438996184984d4d5d0689878eff8ba5e7be2e58bb6a1657ef06ca7e1e803a3773a67e3c4201ee9a7c48727626b91a91f2a2ccf813799da8
SSDEEP

3072:NOiggXYJ4SsWzlV3lXHXNX9XXXDC/9MvuMz7/822I:N8gXPr/9Mv5z7/822

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid process

2748 MsiExec.exe

pid	process
2748	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MsiExec.exe

pid process

2748 MsiExec.exe
2748 MsiExec.exe

pid	process
2748	MsiExec.exe
2748	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4440	msiexec.exe
Token: SeSecurityPrivilege	4988	msiexec.exe
Token: SeCreateTokenPrivilege	4440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4440	msiexec.exe
Token: SeLockMemoryPrivilege	4440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4440	msiexec.exe
Token: SeMachineAccountPrivilege	4440	msiexec.exe
Token: SeTcbPrivilege	4440	msiexec.exe
Token: SeSecurityPrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeLoadDriverPrivilege	4440	msiexec.exe
Token: SeSystemProfilePrivilege	4440	msiexec.exe
Token: SeSystemtimePrivilege	4440	msiexec.exe
Token: SeProfSingleProcessPrivilege	4440	msiexec.exe
Token: SeIncBasePriorityPrivilege	4440	msiexec.exe
Token: SeCreatePagefilePrivilege	4440	msiexec.exe
Token: SeCreatePermanentPrivilege	4440	msiexec.exe
Token: SeBackupPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeShutdownPrivilege	4440	msiexec.exe
Token: SeDebugPrivilege	4440	msiexec.exe
Token: SeAuditPrivilege	4440	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4440	msiexec.exe
Token: SeChangeNotifyPrivilege	4440	msiexec.exe
Token: SeRemoteShutdownPrivilege	4440	msiexec.exe
Token: SeUndockPrivilege	4440	msiexec.exe
Token: SeSyncAgentPrivilege	4440	msiexec.exe
Token: SeEnableDelegationPrivilege	4440	msiexec.exe
Token: SeManageVolumePrivilege	4440	msiexec.exe
Token: SeImpersonatePrivilege	4440	msiexec.exe
Token: SeCreateGlobalPrivilege	4440	msiexec.exe
Token: SeCreateTokenPrivilege	4440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4440	msiexec.exe
Token: SeLockMemoryPrivilege	4440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4440	msiexec.exe
Token: SeMachineAccountPrivilege	4440	msiexec.exe
Token: SeTcbPrivilege	4440	msiexec.exe
Token: SeSecurityPrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeLoadDriverPrivilege	4440	msiexec.exe
Token: SeSystemProfilePrivilege	4440	msiexec.exe
Token: SeSystemtimePrivilege	4440	msiexec.exe
Token: SeProfSingleProcessPrivilege	4440	msiexec.exe
Token: SeIncBasePriorityPrivilege	4440	msiexec.exe
Token: SeCreatePagefilePrivilege	4440	msiexec.exe
Token: SeCreatePermanentPrivilege	4440	msiexec.exe
Token: SeBackupPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeShutdownPrivilege	4440	msiexec.exe
Token: SeDebugPrivilege	4440	msiexec.exe
Token: SeAuditPrivilege	4440	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4440	msiexec.exe
Token: SeChangeNotifyPrivilege	4440	msiexec.exe
Token: SeRemoteShutdownPrivilege	4440	msiexec.exe
Token: SeUndockPrivilege	4440	msiexec.exe
Token: SeSyncAgentPrivilege	4440	msiexec.exe
Token: SeEnableDelegationPrivilege	4440	msiexec.exe
Token: SeManageVolumePrivilege	4440	msiexec.exe
Token: SeImpersonatePrivilege	4440	msiexec.exe
Token: SeCreateGlobalPrivilege	4440	msiexec.exe
Token: SeCreateTokenPrivilege	4440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4440	msiexec.exe
Token: SeLockMemoryPrivilege	4440	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

4440 msiexec.exe

pid	process
4440	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

msiexec.exeMsiExec.exe

description	pid	process	target process
PID 4988 wrote to memory of 2748	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 2748	4988	msiexec.exe	MsiExec.exe
PID 2748 wrote to memory of 2752	2748	MsiExec.exe	sihost.exe
PID 2748 wrote to memory of 2824	2748	MsiExec.exe	svchost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2752

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SYSTEM.Critical.Upgrade.Win10.0.14129a18398ef3d.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 86833C28843E601D54E18057F84E06DD C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSIA60.tmp

Filesize
84KB

MD5
0345408e69f9976c645c0df33b36f708

SHA1
82d6140eb4b09ed215e564d86e6a47c0e26a065d

SHA256
9bb14d25e7bcae1d8249bd94d365f2c2b05896c94925d82f65cbc595ca8d6616

SHA512
de04cb10b6c1905d6584797467878569613608e99308749c2cad40901ae11b6e82eaee82ff907631bc89ba5bd09fd9f337071e5685b1c2b1a693d39e78ed679b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA60.tmp

Filesize
84KB

MD5
0345408e69f9976c645c0df33b36f708

SHA1
82d6140eb4b09ed215e564d86e6a47c0e26a065d

SHA256
9bb14d25e7bcae1d8249bd94d365f2c2b05896c94925d82f65cbc595ca8d6616

SHA512
de04cb10b6c1905d6584797467878569613608e99308749c2cad40901ae11b6e82eaee82ff907631bc89ba5bd09fd9f337071e5685b1c2b1a693d39e78ed679b

Download Submit
memory/2748-132-0x0000000000000000-mapping.dmp

Download
memory/2748-135-0x0000000180000000-0x0000000180018000-memory.dmp

Filesize
96KB

Download
memory/2748-136-0x0000020C7BE60000-0x0000020C7BE74000-memory.dmp

Filesize
80KB

Download
memory/2752-137-0x000002D371CE0000-0x000002D371CF3000-memory.dmp

Filesize
76KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads