Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
13-01-2023 07:02
Static task
static1
Behavioral task
behavioral1
Sample
FileZilla.msi
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
FileZilla.msi
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
FileZilla.msi
-
Size
12.2MB
-
MD5
b23ebe0d25c8857f6489b41ec533db9a
-
SHA1
e56e065632ace5cf55201cb97ac87add185080c9
-
SHA256
441c0b0fc1ae084303839f199c6f922795287116d0d1987ba80e5c92397c5275
-
SHA512
3f47f26a4e8ca89c9bbb9fba69f9036c0884ad17793d457a97f0ce4323485f006abb1d721597100abcd7fae5cac77b118e290d071c875dac2a8907e1fbc4238a
-
SSDEEP
393216:DM4JaaoGgucMvWe5tReEaIuGLNazOhiQ:DM4+hFm5tRTzuGLkOh1
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 1292 MsiExec.exe 1292 MsiExec.exe 1292 MsiExec.exe 1292 MsiExec.exe 1292 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1724 msiexec.exe Token: SeIncreaseQuotaPrivilege 1724 msiexec.exe Token: SeRestorePrivilege 1868 msiexec.exe Token: SeTakeOwnershipPrivilege 1868 msiexec.exe Token: SeSecurityPrivilege 1868 msiexec.exe Token: SeCreateTokenPrivilege 1724 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1724 msiexec.exe Token: SeLockMemoryPrivilege 1724 msiexec.exe Token: SeIncreaseQuotaPrivilege 1724 msiexec.exe Token: SeMachineAccountPrivilege 1724 msiexec.exe Token: SeTcbPrivilege 1724 msiexec.exe Token: SeSecurityPrivilege 1724 msiexec.exe Token: SeTakeOwnershipPrivilege 1724 msiexec.exe Token: SeLoadDriverPrivilege 1724 msiexec.exe Token: SeSystemProfilePrivilege 1724 msiexec.exe Token: SeSystemtimePrivilege 1724 msiexec.exe Token: SeProfSingleProcessPrivilege 1724 msiexec.exe Token: SeIncBasePriorityPrivilege 1724 msiexec.exe Token: SeCreatePagefilePrivilege 1724 msiexec.exe Token: SeCreatePermanentPrivilege 1724 msiexec.exe Token: SeBackupPrivilege 1724 msiexec.exe Token: SeRestorePrivilege 1724 msiexec.exe Token: SeShutdownPrivilege 1724 msiexec.exe Token: SeDebugPrivilege 1724 msiexec.exe Token: SeAuditPrivilege 1724 msiexec.exe Token: SeSystemEnvironmentPrivilege 1724 msiexec.exe Token: SeChangeNotifyPrivilege 1724 msiexec.exe Token: SeRemoteShutdownPrivilege 1724 msiexec.exe Token: SeUndockPrivilege 1724 msiexec.exe Token: SeSyncAgentPrivilege 1724 msiexec.exe Token: SeEnableDelegationPrivilege 1724 msiexec.exe Token: SeManageVolumePrivilege 1724 msiexec.exe Token: SeImpersonatePrivilege 1724 msiexec.exe Token: SeCreateGlobalPrivilege 1724 msiexec.exe Token: SeCreateTokenPrivilege 1724 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1724 msiexec.exe Token: SeLockMemoryPrivilege 1724 msiexec.exe Token: SeIncreaseQuotaPrivilege 1724 msiexec.exe Token: SeMachineAccountPrivilege 1724 msiexec.exe Token: SeTcbPrivilege 1724 msiexec.exe Token: SeSecurityPrivilege 1724 msiexec.exe Token: SeTakeOwnershipPrivilege 1724 msiexec.exe Token: SeLoadDriverPrivilege 1724 msiexec.exe Token: SeSystemProfilePrivilege 1724 msiexec.exe Token: SeSystemtimePrivilege 1724 msiexec.exe Token: SeProfSingleProcessPrivilege 1724 msiexec.exe Token: SeIncBasePriorityPrivilege 1724 msiexec.exe Token: SeCreatePagefilePrivilege 1724 msiexec.exe Token: SeCreatePermanentPrivilege 1724 msiexec.exe Token: SeBackupPrivilege 1724 msiexec.exe Token: SeRestorePrivilege 1724 msiexec.exe Token: SeShutdownPrivilege 1724 msiexec.exe Token: SeDebugPrivilege 1724 msiexec.exe Token: SeAuditPrivilege 1724 msiexec.exe Token: SeSystemEnvironmentPrivilege 1724 msiexec.exe Token: SeChangeNotifyPrivilege 1724 msiexec.exe Token: SeRemoteShutdownPrivilege 1724 msiexec.exe Token: SeUndockPrivilege 1724 msiexec.exe Token: SeSyncAgentPrivilege 1724 msiexec.exe Token: SeEnableDelegationPrivilege 1724 msiexec.exe Token: SeManageVolumePrivilege 1724 msiexec.exe Token: SeImpersonatePrivilege 1724 msiexec.exe Token: SeCreateGlobalPrivilege 1724 msiexec.exe Token: SeCreateTokenPrivilege 1724 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1292 1868 msiexec.exe 29 PID 1868 wrote to memory of 1292 1868 msiexec.exe 29 PID 1868 wrote to memory of 1292 1868 msiexec.exe 29 PID 1868 wrote to memory of 1292 1868 msiexec.exe 29 PID 1868 wrote to memory of 1292 1868 msiexec.exe 29 PID 1868 wrote to memory of 1292 1868 msiexec.exe 29 PID 1868 wrote to memory of 1292 1868 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FileZilla.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1724
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 343CDF74529FC00F81A7B1C715420317 C2⤵
- Loads dropped DLL
PID:1292
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
Filesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5