0038c99f2a5285acd2d4ed02c9a444b93c01e8e632b995cf30103e2e4f067329

General

Target

8f07ea738d1c69b74fac16cabe39e858.msi
Size

730KB
MD5

8f07ea738d1c69b74fac16cabe39e858
SHA1

2a4c4e73106b0dcb87fbfc4a14426e72e0c368b6
SHA256

0038c99f2a5285acd2d4ed02c9a444b93c01e8e632b995cf30103e2e4f067329
SHA512

db3a5884f0c71923ff5aee2e4341d495cd863f68894bab5a8d7426c31e53f2362bc55ec74da76c065e54625f5eb9e3ba07fcb040d3320771a44da6eed34fab66
SSDEEP

12288:GGpswznMosyIa3FZjiazH1BpQc2Yf4U4oXMf6p2XHJZNNNh:GGOw7MAFZjiaZBuc2g4jocf6p2XHXNNr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

876 MsiExec.exe
876 MsiExec.exe

pid	process
876	MsiExec.exe
876	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in Windows directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIFE4D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFA5.tmp	msiexec.exe
File created	C:\Windows\Installer\6c008f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c008f.ipi	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1484 msiexec.exe
1484 msiexec.exe

pid	process
1484	msiexec.exe
1484	msiexec.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1404	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeSecurityPrivilege	1484	msiexec.exe
Token: SeCreateTokenPrivilege	1404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1404	msiexec.exe
Token: SeLockMemoryPrivilege	1404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1404	msiexec.exe
Token: SeMachineAccountPrivilege	1404	msiexec.exe
Token: SeTcbPrivilege	1404	msiexec.exe
Token: SeSecurityPrivilege	1404	msiexec.exe
Token: SeTakeOwnershipPrivilege	1404	msiexec.exe
Token: SeLoadDriverPrivilege	1404	msiexec.exe
Token: SeSystemProfilePrivilege	1404	msiexec.exe
Token: SeSystemtimePrivilege	1404	msiexec.exe
Token: SeProfSingleProcessPrivilege	1404	msiexec.exe
Token: SeIncBasePriorityPrivilege	1404	msiexec.exe
Token: SeCreatePagefilePrivilege	1404	msiexec.exe
Token: SeCreatePermanentPrivilege	1404	msiexec.exe
Token: SeBackupPrivilege	1404	msiexec.exe
Token: SeRestorePrivilege	1404	msiexec.exe
Token: SeShutdownPrivilege	1404	msiexec.exe
Token: SeDebugPrivilege	1404	msiexec.exe
Token: SeAuditPrivilege	1404	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1404	msiexec.exe
Token: SeChangeNotifyPrivilege	1404	msiexec.exe
Token: SeRemoteShutdownPrivilege	1404	msiexec.exe
Token: SeUndockPrivilege	1404	msiexec.exe
Token: SeSyncAgentPrivilege	1404	msiexec.exe
Token: SeEnableDelegationPrivilege	1404	msiexec.exe
Token: SeManageVolumePrivilege	1404	msiexec.exe
Token: SeImpersonatePrivilege	1404	msiexec.exe
Token: SeCreateGlobalPrivilege	1404	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1404 msiexec.exe
1404 msiexec.exe

pid	process
1404	msiexec.exe
1404	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe
PID 1484 wrote to memory of 876	1484	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8f07ea738d1c69b74fac16cabe39e858.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DC8EDB8634B612178CDBF457C1AF4959
2⤵
- Loads dropped DLL
PID:876

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSIFE4D.tmp
Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSIFFA5.tmp
Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSIFE4D.tmp
Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSIFFA5.tmp
Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
memory/876-56-0x0000000000000000-mapping.dmp

Download
memory/876-57-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1404-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads