Analysis
- max time kernel
136s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
16/12/2022, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
Factura639b5.msi
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Factura639b5.msi
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Factura639b5.msi
- Size 5.7MB
- Sample221216-h4c72aec83
- SHA256 635329a3e60baf7fc0d50d16b87c4ddc8f9300c710696dde863c3d90abb1b4a3
- MD5 b4f3c46a6da8e0163b848d6e5d6ce1b4
- SHA1 4f0325e16c1bfa806deffce2eb9467ea100c3a09
- SHA512 c35707d6de3cecd19669661c5a046802c135ac17a57fcf08c9ca9ce42de6759920b09c83f58de8d4bafce61f40749a8d3b531846272fb648f537992247f9b07d
- SSDEEP 98304:ZYntMEAd/I+xrYpt9jR2bUFhhUWRW/f8FmXFtIQSxpfPHpq75rFXbge8:WA/HrYpHRqU5RRif8wcQSLHod
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 9 IoCs
flow pid Process 15 1576 MsiExec.exe 17 1576 MsiExec.exe 18 1576 MsiExec.exe 28 1576 MsiExec.exe 40 1576 MsiExec.exe 44 1576 MsiExec.exe 45 1576 MsiExec.exe 46 1576 MsiExec.exe 47 1576 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io 15 ipinfo.io - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1576 MsiExec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI9573.tmp msiexec.exe File opened for modification C:\Windows\Installer\e568f93.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI903E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI93FB.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{15E0F5AE-9FDF-4BCD-A677-0ABC8044DB48} msiexec.exe File opened for modification C:\Windows\Installer\MSI95D1.tmp msiexec.exe File created C:\Windows\Installer\e568f93.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI92C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI937D.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4812 msiexec.exe 4812 msiexec.exe 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe 1576 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 1572 msiexec.exe Token: SeIncreaseQuotaPrivilege 1572 msiexec.exe Token: SeSecurityPrivilege 4812 msiexec.exe Token: SeCreateTokenPrivilege 1572 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1572 msiexec.exe Token: SeLockMemoryPrivilege 1572 msiexec.exe Token: SeIncreaseQuotaPrivilege 1572 msiexec.exe Token: SeMachineAccountPrivilege 1572 msiexec.exe Token: SeTcbPrivilege 1572 msiexec.exe Token: SeSecurityPrivilege 1572 msiexec.exe Token: SeTakeOwnershipPrivilege 1572 msiexec.exe Token: SeLoadDriverPrivilege 1572 msiexec.exe Token: SeSystemProfilePrivilege 1572 msiexec.exe Token: SeSystemtimePrivilege 1572 msiexec.exe Token: SeProfSingleProcessPrivilege 1572 msiexec.exe Token: SeIncBasePriorityPrivilege 1572 msiexec.exe Token: SeCreatePagefilePrivilege 1572 msiexec.exe Token: SeCreatePermanentPrivilege 1572 msiexec.exe Token: SeBackupPrivilege 1572 msiexec.exe Token: SeRestorePrivilege 1572 msiexec.exe Token: SeShutdownPrivilege 1572 msiexec.exe Token: SeDebugPrivilege 1572 msiexec.exe Token: SeAuditPrivilege 1572 msiexec.exe Token: SeSystemEnvironmentPrivilege 1572 msiexec.exe Token: SeChangeNotifyPrivilege 1572 msiexec.exe Token: SeRemoteShutdownPrivilege 1572 msiexec.exe Token: SeUndockPrivilege 1572 msiexec.exe Token: SeSyncAgentPrivilege 1572 msiexec.exe Token: SeEnableDelegationPrivilege 1572 msiexec.exe Token: SeManageVolumePrivilege 1572 msiexec.exe Token: SeImpersonatePrivilege 1572 msiexec.exe Token: SeCreateGlobalPrivilege 1572 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1572 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4812 wrote to memory of 1576 4812 msiexec.exe 83 PID 4812 wrote to memory of 1576 4812 msiexec.exe 83 PID 4812 wrote to memory of 1576 4812 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Factura639b5.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1572
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7A0CD8DBC350535A975F74218F8B80A32⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI903E.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI903E.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI92C0.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI92C0.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI937D.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI937D.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI93FB.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI93FB.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI95D1.tmp
- Size 5.2MB
- SHA256 e00e5142a4c5959bbd1c962efa2f298f8765788c542455680a8bf87b1090a64f
- MD5 5a6c9cd12571a13c0b1205f46edbe35c
- SHA1 209bdf83764db2b44464e52bd1acba215ae51987
- SHA512 e3c13577fe038e211ae61a79597762c66ef5a810ec4ac6187dca51a07d738ae6e604ffa7d610943e267d0a007c6c0af5bef470f1f2dbefd6302ec704885827b5
- SSDEEP 98304:JI+xrYpt9jR2bUFhhUWRW/f8FmXFtIQSxpfPHpq75rFXbge8:JHrYpHRqU5RRif8wcQSLHod
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI95D1.tmp
- Size 5.2MB
- SHA256 e00e5142a4c5959bbd1c962efa2f298f8765788c542455680a8bf87b1090a64f
- MD5 5a6c9cd12571a13c0b1205f46edbe35c
- SHA1 209bdf83764db2b44464e52bd1acba215ae51987
- SHA512 e3c13577fe038e211ae61a79597762c66ef5a810ec4ac6187dca51a07d738ae6e604ffa7d610943e267d0a007c6c0af5bef470f1f2dbefd6302ec704885827b5
- SSDEEP 98304:JI+xrYpt9jR2bUFhhUWRW/f8FmXFtIQSxpfPHpq75rFXbge8:JHrYpHRqU5RRif8wcQSLHod
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI95D1.tmp
- Size 5.2MB
- SHA256 e00e5142a4c5959bbd1c962efa2f298f8765788c542455680a8bf87b1090a64f
- MD5 5a6c9cd12571a13c0b1205f46edbe35c
- SHA1 209bdf83764db2b44464e52bd1acba215ae51987
- SHA512 e3c13577fe038e211ae61a79597762c66ef5a810ec4ac6187dca51a07d738ae6e604ffa7d610943e267d0a007c6c0af5bef470f1f2dbefd6302ec704885827b5
- SSDEEP 98304:JI+xrYpt9jR2bUFhhUWRW/f8FmXFtIQSxpfPHpq75rFXbge8:JHrYpHRqU5RRif8wcQSLHod
- MD5 SHA1 SHA512 SSDEEP