Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-12-2022 15:56
Static task
static1
Behavioral task
behavioral1
Sample
CNGB_Installer.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
CNGB_Installer.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
CNGB_Installer.exe
-
Size
36.3MB
-
MD5
9bbbcd32d4d99546d94e6f026501e32a
-
SHA1
986e306fc79ab6a650cdd516c5e7d97adbbe522a
-
SHA256
17039d8920c1a6f2302272b784383c4737df7e30adc2b6f42d8cde1be21eba66
-
SHA512
509e9fc35802415162c123779587d0416f2af4a0911656c21936bad473870df5a29747dcb60e227e2decb29aa38e086e7e7cff19d3237cba89f3dde165c47a18
-
SSDEEP
786432:YPjHMaI+OxsPtQL1sNyC/dz0Pkf4S87mEFn/GcZkIXK/:Yrl22tAW4qZQ+Utn/GcZJK/
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1572 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: CNGB_Installer.exe File opened (read-only) \??\M: CNGB_Installer.exe File opened (read-only) \??\N: CNGB_Installer.exe File opened (read-only) \??\R: CNGB_Installer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: CNGB_Installer.exe File opened (read-only) \??\X: CNGB_Installer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: CNGB_Installer.exe File opened (read-only) \??\T: CNGB_Installer.exe File opened (read-only) \??\Y: CNGB_Installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: CNGB_Installer.exe File opened (read-only) \??\L: CNGB_Installer.exe File opened (read-only) \??\S: CNGB_Installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: CNGB_Installer.exe File opened (read-only) \??\U: CNGB_Installer.exe File opened (read-only) \??\V: CNGB_Installer.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: CNGB_Installer.exe File opened (read-only) \??\I: CNGB_Installer.exe File opened (read-only) \??\K: CNGB_Installer.exe File opened (read-only) \??\P: CNGB_Installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: CNGB_Installer.exe File opened (read-only) \??\Z: CNGB_Installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: CNGB_Installer.exe File opened (read-only) \??\F: CNGB_Installer.exe File opened (read-only) \??\Q: CNGB_Installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeSecurityPrivilege 1780 msiexec.exe Token: SeCreateTokenPrivilege 1508 CNGB_Installer.exe Token: SeAssignPrimaryTokenPrivilege 1508 CNGB_Installer.exe Token: SeLockMemoryPrivilege 1508 CNGB_Installer.exe Token: SeIncreaseQuotaPrivilege 1508 CNGB_Installer.exe Token: SeMachineAccountPrivilege 1508 CNGB_Installer.exe Token: SeTcbPrivilege 1508 CNGB_Installer.exe Token: SeSecurityPrivilege 1508 CNGB_Installer.exe Token: SeTakeOwnershipPrivilege 1508 CNGB_Installer.exe Token: SeLoadDriverPrivilege 1508 CNGB_Installer.exe Token: SeSystemProfilePrivilege 1508 CNGB_Installer.exe Token: SeSystemtimePrivilege 1508 CNGB_Installer.exe Token: SeProfSingleProcessPrivilege 1508 CNGB_Installer.exe Token: SeIncBasePriorityPrivilege 1508 CNGB_Installer.exe Token: SeCreatePagefilePrivilege 1508 CNGB_Installer.exe Token: SeCreatePermanentPrivilege 1508 CNGB_Installer.exe Token: SeBackupPrivilege 1508 CNGB_Installer.exe Token: SeRestorePrivilege 1508 CNGB_Installer.exe Token: SeShutdownPrivilege 1508 CNGB_Installer.exe Token: SeDebugPrivilege 1508 CNGB_Installer.exe Token: SeAuditPrivilege 1508 CNGB_Installer.exe Token: SeSystemEnvironmentPrivilege 1508 CNGB_Installer.exe Token: SeChangeNotifyPrivilege 1508 CNGB_Installer.exe Token: SeRemoteShutdownPrivilege 1508 CNGB_Installer.exe Token: SeUndockPrivilege 1508 CNGB_Installer.exe Token: SeSyncAgentPrivilege 1508 CNGB_Installer.exe Token: SeEnableDelegationPrivilege 1508 CNGB_Installer.exe Token: SeManageVolumePrivilege 1508 CNGB_Installer.exe Token: SeImpersonatePrivilege 1508 CNGB_Installer.exe Token: SeCreateGlobalPrivilege 1508 CNGB_Installer.exe Token: SeCreateTokenPrivilege 1508 CNGB_Installer.exe Token: SeAssignPrimaryTokenPrivilege 1508 CNGB_Installer.exe Token: SeLockMemoryPrivilege 1508 CNGB_Installer.exe Token: SeIncreaseQuotaPrivilege 1508 CNGB_Installer.exe Token: SeMachineAccountPrivilege 1508 CNGB_Installer.exe Token: SeTcbPrivilege 1508 CNGB_Installer.exe Token: SeSecurityPrivilege 1508 CNGB_Installer.exe Token: SeTakeOwnershipPrivilege 1508 CNGB_Installer.exe Token: SeLoadDriverPrivilege 1508 CNGB_Installer.exe Token: SeSystemProfilePrivilege 1508 CNGB_Installer.exe Token: SeSystemtimePrivilege 1508 CNGB_Installer.exe Token: SeProfSingleProcessPrivilege 1508 CNGB_Installer.exe Token: SeIncBasePriorityPrivilege 1508 CNGB_Installer.exe Token: SeCreatePagefilePrivilege 1508 CNGB_Installer.exe Token: SeCreatePermanentPrivilege 1508 CNGB_Installer.exe Token: SeBackupPrivilege 1508 CNGB_Installer.exe Token: SeRestorePrivilege 1508 CNGB_Installer.exe Token: SeShutdownPrivilege 1508 CNGB_Installer.exe Token: SeDebugPrivilege 1508 CNGB_Installer.exe Token: SeAuditPrivilege 1508 CNGB_Installer.exe Token: SeSystemEnvironmentPrivilege 1508 CNGB_Installer.exe Token: SeChangeNotifyPrivilege 1508 CNGB_Installer.exe Token: SeRemoteShutdownPrivilege 1508 CNGB_Installer.exe Token: SeUndockPrivilege 1508 CNGB_Installer.exe Token: SeSyncAgentPrivilege 1508 CNGB_Installer.exe Token: SeEnableDelegationPrivilege 1508 CNGB_Installer.exe Token: SeManageVolumePrivilege 1508 CNGB_Installer.exe Token: SeImpersonatePrivilege 1508 CNGB_Installer.exe Token: SeCreateGlobalPrivilege 1508 CNGB_Installer.exe Token: SeCreateTokenPrivilege 1508 CNGB_Installer.exe Token: SeAssignPrimaryTokenPrivilege 1508 CNGB_Installer.exe Token: SeLockMemoryPrivilege 1508 CNGB_Installer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1508 CNGB_Installer.exe 1508 CNGB_Installer.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1572 1780 msiexec.exe 27 PID 1780 wrote to memory of 1572 1780 msiexec.exe 27 PID 1780 wrote to memory of 1572 1780 msiexec.exe 27 PID 1780 wrote to memory of 1572 1780 msiexec.exe 27 PID 1780 wrote to memory of 1572 1780 msiexec.exe 27 PID 1780 wrote to memory of 1572 1780 msiexec.exe 27 PID 1780 wrote to memory of 1572 1780 msiexec.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe"C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1508
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 76AD1C31246E49633815BB8985AD9FC2 C2⤵
- Loads dropped DLL
PID:1572
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
259KB
MD5f4856ffe500e45f2ee07ccebb06f9958
SHA1905bfb953d755d965a900a0d4ba05619bfe0ef3f
SHA2567238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8
SHA51231d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820
-
Filesize
259KB
MD5f4856ffe500e45f2ee07ccebb06f9958
SHA1905bfb953d755d965a900a0d4ba05619bfe0ef3f
SHA2567238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8
SHA51231d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820