Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2022 19:28
Static task
static1
Behavioral task
behavioral1
Sample
Setup_Win_29-12-2022_17-21-18.msi
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Setup_Win_29-12-2022_17-21-18.msi
Resource
win10v2004-20220812-en
General
-
Target
Setup_Win_29-12-2022_17-21-18.msi
-
Size
772KB
-
MD5
37d819630a3536847fd4617c661695e2
-
SHA1
134da7d0bbda94b054cb20cd9f6e759cd010c166
-
SHA256
38a68c48a2cb002af6c7bd36412ce920202e04c5ef73d7ea58a1303122142891
-
SHA512
47b5aed5ae382b56d3197c3ca53a5bfe55fc9f9c4be3b5503daac2223261373ae1e791e7dc3823365460f2df16a9ee72bfa358a21ebb46bf5597f72949da2165
-
SSDEEP
12288:ewHL0DpxMX/wg4ZqU0UmmhtNOOdpxoPcrDnS34y9RPF8L:XHL0EvwglMtNjjoGS3bRPF8L
Malware Config
Extracted
icedid
2957048208
whothitheka.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 42 4732 rundll32.exe 46 4732 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
MsiExec.exerundll32.exerundll32.exepid process 4724 MsiExec.exe 4680 rundll32.exe 4732 rundll32.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 13 IoCs
Processes:
msiexec.exerundll32.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{6F330B47-2577-43AD-9095-1861BA25889B} msiexec.exe File opened for modification C:\Windows\Installer\MSICC97.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICD92.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSICD92.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\e57cab2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICD92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICD92.tmp-\test.cs.dll rundll32.exe File opened for modification C:\Windows\Installer\MSICD92.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\e57cab2.msi msiexec.exe File created C:\Windows\Installer\e57cab4.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007c4a2b5d7b48cb040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007c4a2b5d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809007c4a2b5d000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msiexec.exerundll32.exepid process 3808 msiexec.exe 3808 msiexec.exe 4732 rundll32.exe 4732 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 4624 msiexec.exe Token: SeIncreaseQuotaPrivilege 4624 msiexec.exe Token: SeSecurityPrivilege 3808 msiexec.exe Token: SeCreateTokenPrivilege 4624 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4624 msiexec.exe Token: SeLockMemoryPrivilege 4624 msiexec.exe Token: SeIncreaseQuotaPrivilege 4624 msiexec.exe Token: SeMachineAccountPrivilege 4624 msiexec.exe Token: SeTcbPrivilege 4624 msiexec.exe Token: SeSecurityPrivilege 4624 msiexec.exe Token: SeTakeOwnershipPrivilege 4624 msiexec.exe Token: SeLoadDriverPrivilege 4624 msiexec.exe Token: SeSystemProfilePrivilege 4624 msiexec.exe Token: SeSystemtimePrivilege 4624 msiexec.exe Token: SeProfSingleProcessPrivilege 4624 msiexec.exe Token: SeIncBasePriorityPrivilege 4624 msiexec.exe Token: SeCreatePagefilePrivilege 4624 msiexec.exe Token: SeCreatePermanentPrivilege 4624 msiexec.exe Token: SeBackupPrivilege 4624 msiexec.exe Token: SeRestorePrivilege 4624 msiexec.exe Token: SeShutdownPrivilege 4624 msiexec.exe Token: SeDebugPrivilege 4624 msiexec.exe Token: SeAuditPrivilege 4624 msiexec.exe Token: SeSystemEnvironmentPrivilege 4624 msiexec.exe Token: SeChangeNotifyPrivilege 4624 msiexec.exe Token: SeRemoteShutdownPrivilege 4624 msiexec.exe Token: SeUndockPrivilege 4624 msiexec.exe Token: SeSyncAgentPrivilege 4624 msiexec.exe Token: SeEnableDelegationPrivilege 4624 msiexec.exe Token: SeManageVolumePrivilege 4624 msiexec.exe Token: SeImpersonatePrivilege 4624 msiexec.exe Token: SeCreateGlobalPrivilege 4624 msiexec.exe Token: SeBackupPrivilege 1340 vssvc.exe Token: SeRestorePrivilege 1340 vssvc.exe Token: SeAuditPrivilege 1340 vssvc.exe Token: SeBackupPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 4624 msiexec.exe 4624 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
msiexec.exeMsiExec.exerundll32.exedescription pid process target process PID 3808 wrote to memory of 2688 3808 msiexec.exe srtasks.exe PID 3808 wrote to memory of 2688 3808 msiexec.exe srtasks.exe PID 3808 wrote to memory of 4724 3808 msiexec.exe MsiExec.exe PID 3808 wrote to memory of 4724 3808 msiexec.exe MsiExec.exe PID 4724 wrote to memory of 4680 4724 MsiExec.exe rundll32.exe PID 4724 wrote to memory of 4680 4724 MsiExec.exe rundll32.exe PID 4680 wrote to memory of 4732 4680 rundll32.exe rundll32.exe PID 4680 wrote to memory of 4732 4680 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Win_29-12-2022_17-21-18.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A3DA1DAD783541103E56EAB4E4BEB3772⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSICD92.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240635578 2 test.cs!X1X3X2.Y1yY.Z3z1Z3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSI54d6c2ca.msi",init4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\MSI54d6c2ca.msiFilesize
323KB
MD5460cf4e821b22e1b3df659a01ee8fb0a
SHA11c5ea14ff5f7be7e3d3a62a0d531fc7d0d0a3bf8
SHA256338c4e044fcd4f8b7429558c283eb13769e0e6afcbf14e9c6bc64d5cc9e3d79a
SHA512c7bf8859feb207a1178e82402c82c8e4dbaaeae1de4c5220f22a874a8d01fa1944ad91c1d3157bc3f6c1b964a8ac16ab8d00c65fbfdc5d67c7b390afcbe3aec4
-
C:\Users\Admin\AppData\Local\MSI54d6c2ca.msiFilesize
323KB
MD5460cf4e821b22e1b3df659a01ee8fb0a
SHA11c5ea14ff5f7be7e3d3a62a0d531fc7d0d0a3bf8
SHA256338c4e044fcd4f8b7429558c283eb13769e0e6afcbf14e9c6bc64d5cc9e3d79a
SHA512c7bf8859feb207a1178e82402c82c8e4dbaaeae1de4c5220f22a874a8d01fa1944ad91c1d3157bc3f6c1b964a8ac16ab8d00c65fbfdc5d67c7b390afcbe3aec4
-
C:\Windows\Installer\MSICD92.tmpFilesize
414KB
MD585d31c51c042a434aa8ae209fb5ce686
SHA1712f12f2f497cb911484456fc151db897eecff28
SHA256aac98ff611d211b36c5e9624a535abb3d3854764af0ab066252bccdf193e3365
SHA512a11d905583965d99ecf4256277ab17bea4e2214cde923db10ab90ab869459486d25f2f80abb9a748c8f68ace593d52ff8d08fccfb40f25bb41f9059036c448d5
-
C:\Windows\Installer\MSICD92.tmpFilesize
414KB
MD585d31c51c042a434aa8ae209fb5ce686
SHA1712f12f2f497cb911484456fc151db897eecff28
SHA256aac98ff611d211b36c5e9624a535abb3d3854764af0ab066252bccdf193e3365
SHA512a11d905583965d99ecf4256277ab17bea4e2214cde923db10ab90ab869459486d25f2f80abb9a748c8f68ace593d52ff8d08fccfb40f25bb41f9059036c448d5
-
C:\Windows\Installer\MSICD92.tmpFilesize
414KB
MD585d31c51c042a434aa8ae209fb5ce686
SHA1712f12f2f497cb911484456fc151db897eecff28
SHA256aac98ff611d211b36c5e9624a535abb3d3854764af0ab066252bccdf193e3365
SHA512a11d905583965d99ecf4256277ab17bea4e2214cde923db10ab90ab869459486d25f2f80abb9a748c8f68ace593d52ff8d08fccfb40f25bb41f9059036c448d5
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD55cd521d02eca34562db0fdf7aa23c9e0
SHA12a1ea0d8588b8522e4df1396f32b56616a202344
SHA256f6603f368423d22b6aa32859071b33a6b508b1ec0f080a815cfb81dd38ed4855
SHA5121d3a782fb56da8e55a3a4c7fed283254c37637660f7599edf4d53b777a48292acce8b739a5d23396a8404b234083924a838c3ddd40b0a01255b57ff899e7d25c
-
\??\Volume{5d2b4a7c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cf5cc573-e5b7-43ec-abc4-588419d9b700}_OnDiskSnapshotPropFilesize
5KB
MD5108bf6617681695d74dfaf3dbabd87e3
SHA1962945e5d3a1ca9a457691bb336fdc1d16a12728
SHA256a1939a753122d974d01fc7eea979841348ed48c092feed1e543e62cf83782d61
SHA5125a9a85c9e392fa91b93c6efddd92aa2bf4f1fb51cdfb45fe526f7245b98ad8e894929c93131eecd652cfb39d37b4fbd11aa76ea1fd88e552bc16466e2835da1b
-
memory/2688-132-0x0000000000000000-mapping.dmp
-
memory/4680-136-0x0000000000000000-mapping.dmp
-
memory/4680-141-0x0000021D7E710000-0x0000021D7E780000-memory.dmpFilesize
448KB
-
memory/4680-139-0x0000021D7CCA0000-0x0000021D7CCAA000-memory.dmpFilesize
40KB
-
memory/4680-140-0x00007FFDE3F80000-0x00007FFDE4A41000-memory.dmpFilesize
10.8MB
-
memory/4680-148-0x00007FFDE3F80000-0x00007FFDE4A41000-memory.dmpFilesize
10.8MB
-
memory/4680-138-0x0000021D7E610000-0x0000021D7E63E000-memory.dmpFilesize
184KB
-
memory/4724-133-0x0000000000000000-mapping.dmp
-
memory/4732-142-0x0000000000000000-mapping.dmp
-
memory/4732-145-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB