Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31-12-2022 10:41
Behavioral task
behavioral1
Sample
8f07ea738d1c69b74fac16cabe39e858.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8f07ea738d1c69b74fac16cabe39e858.msi
Resource
win10v2004-20220812-en
General
-
Target
8f07ea738d1c69b74fac16cabe39e858.msi
-
Size
730KB
-
MD5
8f07ea738d1c69b74fac16cabe39e858
-
SHA1
2a4c4e73106b0dcb87fbfc4a14426e72e0c368b6
-
SHA256
0038c99f2a5285acd2d4ed02c9a444b93c01e8e632b995cf30103e2e4f067329
-
SHA512
db3a5884f0c71923ff5aee2e4341d495cd863f68894bab5a8d7426c31e53f2362bc55ec74da76c065e54625f5eb9e3ba07fcb040d3320771a44da6eed34fab66
-
SSDEEP
12288:GGpswznMosyIa3FZjiazH1BpQc2Yf4U4oXMf6p2XHJZNNNh:GGOw7MAFZjiaZBuc2g4jocf6p2XHXNNr
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 876 MsiExec.exe 876 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIFE4D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFFA5.tmp msiexec.exe File created C:\Windows\Installer\6c008f.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c008f.ipi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1484 msiexec.exe 1484 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1404 msiexec.exe Token: SeIncreaseQuotaPrivilege 1404 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeSecurityPrivilege 1484 msiexec.exe Token: SeCreateTokenPrivilege 1404 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1404 msiexec.exe Token: SeLockMemoryPrivilege 1404 msiexec.exe Token: SeIncreaseQuotaPrivilege 1404 msiexec.exe Token: SeMachineAccountPrivilege 1404 msiexec.exe Token: SeTcbPrivilege 1404 msiexec.exe Token: SeSecurityPrivilege 1404 msiexec.exe Token: SeTakeOwnershipPrivilege 1404 msiexec.exe Token: SeLoadDriverPrivilege 1404 msiexec.exe Token: SeSystemProfilePrivilege 1404 msiexec.exe Token: SeSystemtimePrivilege 1404 msiexec.exe Token: SeProfSingleProcessPrivilege 1404 msiexec.exe Token: SeIncBasePriorityPrivilege 1404 msiexec.exe Token: SeCreatePagefilePrivilege 1404 msiexec.exe Token: SeCreatePermanentPrivilege 1404 msiexec.exe Token: SeBackupPrivilege 1404 msiexec.exe Token: SeRestorePrivilege 1404 msiexec.exe Token: SeShutdownPrivilege 1404 msiexec.exe Token: SeDebugPrivilege 1404 msiexec.exe Token: SeAuditPrivilege 1404 msiexec.exe Token: SeSystemEnvironmentPrivilege 1404 msiexec.exe Token: SeChangeNotifyPrivilege 1404 msiexec.exe Token: SeRemoteShutdownPrivilege 1404 msiexec.exe Token: SeUndockPrivilege 1404 msiexec.exe Token: SeSyncAgentPrivilege 1404 msiexec.exe Token: SeEnableDelegationPrivilege 1404 msiexec.exe Token: SeManageVolumePrivilege 1404 msiexec.exe Token: SeImpersonatePrivilege 1404 msiexec.exe Token: SeCreateGlobalPrivilege 1404 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1404 msiexec.exe 1404 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 876 1484 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8f07ea738d1c69b74fac16cabe39e858.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1404
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DC8EDB8634B612178CDBF457C1AF49592⤵
- Loads dropped DLL
PID:876
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2