Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-01-2023 08:45
Static task
static1
Behavioral task
behavioral1
Sample
Setup_Win_03-01-2023_08-37-05.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup_Win_03-01-2023_08-37-05.msi
Resource
win10v2004-20220812-en
General
-
Target
Setup_Win_03-01-2023_08-37-05.msi
-
Size
772KB
-
MD5
f2d5895a8e66ef63e687e356dac665cf
-
SHA1
d5ec3af492980df0bcbca26ceb864177978ef69d
-
SHA256
6b4239bdb1080b21570feba7058d87b35e18bc74c20c68611c2012002b8a0aa3
-
SHA512
d1ff00a258a811f395e91dcca6a22e8dd839aef606f74d2ef78391e01d4ce13d490903b6d9378c114ba0f880cb698d76027e62e3832ea1a97fe4ba8cfb4bb1a8
-
SSDEEP
12288:GwHL0DpPMX/wg4ZqU0UmmhtNOOdpxoPcrDnS34y9RPF8L:vHL02vwglMtNjjoGS3bRPF8L
Malware Config
Extracted
icedid
2957048208
whothitheka.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 1964 rundll32.exe 4 1964 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
MsiExec.exerundll32.exerundll32.exepid process 1744 MsiExec.exe 924 rundll32.exe 1964 rundll32.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Windows directory 15 IoCs
Processes:
msiexec.exeDrvInst.exerundll32.exedescription ioc process File opened for modification C:\Windows\Installer\MSI61B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c5faf.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\6c5fb1.msi msiexec.exe File created C:\Windows\Installer\6c5faf.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI625F.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\6c5fae.msi msiexec.exe File opened for modification C:\Windows\Installer\6c5fae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI625F.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI625F.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI625F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI625F.tmp-\test.cs.dll rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msiexec.exerundll32.exepid process 296 msiexec.exe 296 msiexec.exe 1964 rundll32.exe 1964 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeSecurityPrivilege 296 msiexec.exe Token: SeCreateTokenPrivilege 2024 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2024 msiexec.exe Token: SeLockMemoryPrivilege 2024 msiexec.exe Token: SeIncreaseQuotaPrivilege 2024 msiexec.exe Token: SeMachineAccountPrivilege 2024 msiexec.exe Token: SeTcbPrivilege 2024 msiexec.exe Token: SeSecurityPrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeLoadDriverPrivilege 2024 msiexec.exe Token: SeSystemProfilePrivilege 2024 msiexec.exe Token: SeSystemtimePrivilege 2024 msiexec.exe Token: SeProfSingleProcessPrivilege 2024 msiexec.exe Token: SeIncBasePriorityPrivilege 2024 msiexec.exe Token: SeCreatePagefilePrivilege 2024 msiexec.exe Token: SeCreatePermanentPrivilege 2024 msiexec.exe Token: SeBackupPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeShutdownPrivilege 2024 msiexec.exe Token: SeDebugPrivilege 2024 msiexec.exe Token: SeAuditPrivilege 2024 msiexec.exe Token: SeSystemEnvironmentPrivilege 2024 msiexec.exe Token: SeChangeNotifyPrivilege 2024 msiexec.exe Token: SeRemoteShutdownPrivilege 2024 msiexec.exe Token: SeUndockPrivilege 2024 msiexec.exe Token: SeSyncAgentPrivilege 2024 msiexec.exe Token: SeEnableDelegationPrivilege 2024 msiexec.exe Token: SeManageVolumePrivilege 2024 msiexec.exe Token: SeImpersonatePrivilege 2024 msiexec.exe Token: SeCreateGlobalPrivilege 2024 msiexec.exe Token: SeBackupPrivilege 1492 vssvc.exe Token: SeRestorePrivilege 1492 vssvc.exe Token: SeAuditPrivilege 1492 vssvc.exe Token: SeBackupPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeLoadDriverPrivilege 676 DrvInst.exe Token: SeLoadDriverPrivilege 676 DrvInst.exe Token: SeLoadDriverPrivilege 676 DrvInst.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe Token: SeTakeOwnershipPrivilege 296 msiexec.exe Token: SeRestorePrivilege 296 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2024 msiexec.exe 2024 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
msiexec.exeMsiExec.exerundll32.exedescription pid process target process PID 296 wrote to memory of 1744 296 msiexec.exe MsiExec.exe PID 296 wrote to memory of 1744 296 msiexec.exe MsiExec.exe PID 296 wrote to memory of 1744 296 msiexec.exe MsiExec.exe PID 296 wrote to memory of 1744 296 msiexec.exe MsiExec.exe PID 296 wrote to memory of 1744 296 msiexec.exe MsiExec.exe PID 1744 wrote to memory of 924 1744 MsiExec.exe rundll32.exe PID 1744 wrote to memory of 924 1744 MsiExec.exe rundll32.exe PID 1744 wrote to memory of 924 1744 MsiExec.exe rundll32.exe PID 924 wrote to memory of 1964 924 rundll32.exe rundll32.exe PID 924 wrote to memory of 1964 924 rundll32.exe rundll32.exe PID 924 wrote to memory of 1964 924 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Win_03-01-2023_08-37-05.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding E9D074B6D032FCE9539954C127382EA42⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI625F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7103271 1 test.cs!X1X3X2.Y1yY.Z3z1Z3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSI6ecf3bb5.msi",init4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000004BC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\MSI6ecf3bb5.msiFilesize
323KB
MD5460cf4e821b22e1b3df659a01ee8fb0a
SHA11c5ea14ff5f7be7e3d3a62a0d531fc7d0d0a3bf8
SHA256338c4e044fcd4f8b7429558c283eb13769e0e6afcbf14e9c6bc64d5cc9e3d79a
SHA512c7bf8859feb207a1178e82402c82c8e4dbaaeae1de4c5220f22a874a8d01fa1944ad91c1d3157bc3f6c1b964a8ac16ab8d00c65fbfdc5d67c7b390afcbe3aec4
-
C:\Windows\Installer\MSI625F.tmpFilesize
414KB
MD51ba38de0f34cc60b881c2e4cc37ea294
SHA1e0d60e2843bbfa08cbf825f1c638cd67c7a2c5c0
SHA256092ee0c919a6c8266113102ff4391363bb0ef9e067c21ee2d33d9d83d029527d
SHA512ca9a9c8e44d1deda0b0f3ac10163b50e1c5e84db12acb1f7fca2305a6ebd21930e769f9a2f0a8261eeebdcb4276f3083466bb87841cc063cbaf5cebbabd51314
-
\Users\Admin\AppData\Local\MSI6ecf3bb5.msiFilesize
323KB
MD5460cf4e821b22e1b3df659a01ee8fb0a
SHA11c5ea14ff5f7be7e3d3a62a0d531fc7d0d0a3bf8
SHA256338c4e044fcd4f8b7429558c283eb13769e0e6afcbf14e9c6bc64d5cc9e3d79a
SHA512c7bf8859feb207a1178e82402c82c8e4dbaaeae1de4c5220f22a874a8d01fa1944ad91c1d3157bc3f6c1b964a8ac16ab8d00c65fbfdc5d67c7b390afcbe3aec4
-
\Windows\Installer\MSI625F.tmpFilesize
414KB
MD51ba38de0f34cc60b881c2e4cc37ea294
SHA1e0d60e2843bbfa08cbf825f1c638cd67c7a2c5c0
SHA256092ee0c919a6c8266113102ff4391363bb0ef9e067c21ee2d33d9d83d029527d
SHA512ca9a9c8e44d1deda0b0f3ac10163b50e1c5e84db12acb1f7fca2305a6ebd21930e769f9a2f0a8261eeebdcb4276f3083466bb87841cc063cbaf5cebbabd51314
-
\Windows\Installer\MSI625F.tmpFilesize
414KB
MD51ba38de0f34cc60b881c2e4cc37ea294
SHA1e0d60e2843bbfa08cbf825f1c638cd67c7a2c5c0
SHA256092ee0c919a6c8266113102ff4391363bb0ef9e067c21ee2d33d9d83d029527d
SHA512ca9a9c8e44d1deda0b0f3ac10163b50e1c5e84db12acb1f7fca2305a6ebd21930e769f9a2f0a8261eeebdcb4276f3083466bb87841cc063cbaf5cebbabd51314
-
memory/924-62-0x0000000000220000-0x000000000024E000-memory.dmpFilesize
184KB
-
memory/924-63-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/924-64-0x0000000001DD0000-0x0000000001E40000-memory.dmpFilesize
448KB
-
memory/924-60-0x0000000000000000-mapping.dmp
-
memory/1744-56-0x0000000000000000-mapping.dmp
-
memory/1964-66-0x0000000000000000-mapping.dmp
-
memory/1964-69-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB
-
memory/2024-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB