Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-01-2023 10:02
Behavioral task
behavioral1
Sample
a5dc13abd8b4769fbd2a8cc1a4f70a73.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a5dc13abd8b4769fbd2a8cc1a4f70a73.msi
Resource
win10v2004-20221111-en
General
-
Target
a5dc13abd8b4769fbd2a8cc1a4f70a73.msi
-
Size
774KB
-
MD5
a5dc13abd8b4769fbd2a8cc1a4f70a73
-
SHA1
87cb437244076e1119b49aae7cf72b7ba0d1c1e3
-
SHA256
61ea7131b658175e023681829bad0d108d9d74c318c184bc5be456cfdaf670c6
-
SHA512
e65dc2601448d11706df7cb9a1cce7c2b21a386a1cf056a6c4c36a61f1f87a891bbcdd1a5ddfdbf4caf74d011474079eb0f7741ee04c5043a17ff3edef011429
-
SSDEEP
24576:GGOw7MAFZjiaZBuc2g4jocf6p2XHXNNpO:QwHnjis3M6p2X/pO
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 696 MsiExec.exe 696 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI89B.tmp msiexec.exe File opened for modification C:\Windows\Installer\6c0408.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI178.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI33D.tmp msiexec.exe File created C:\Windows\Installer\6c0408.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1632 msiexec.exe 1632 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1632 msiexec.exe Token: SeTakeOwnershipPrivilege 1632 msiexec.exe Token: SeSecurityPrivilege 1632 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1632 msiexec.exe Token: SeTakeOwnershipPrivilege 1632 msiexec.exe Token: SeRestorePrivilege 1632 msiexec.exe Token: SeTakeOwnershipPrivilege 1632 msiexec.exe Token: SeRestorePrivilege 1632 msiexec.exe Token: SeTakeOwnershipPrivilege 1632 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1960 msiexec.exe 1960 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe PID 1632 wrote to memory of 696 1632 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a5dc13abd8b4769fbd2a8cc1a4f70a73.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1960
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 05B2DB1B2999E903CFD027A7C743C1242⤵
- Loads dropped DLL
PID:696
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2