Analysis
- max time kernel
192s - max time network
211s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2023, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
Utorrent_IIS.msi
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Utorrent_IIS.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Utorrent_IIS.msi
- Size 1.4MB
- Sample230116-qfhrlsfe84
- SHA256 dc2666c86b512a0b4455943b1275a628e2d4f64a45f20ff8ad3fc58f4ceda057
- MD5 f5a1d7cc137de40e51de0c9235777421
- SHA1 06ca92e8b8a9e10ff7a6d7665f75cf433ae8a169
- SHA512 a44141557b076c26840d715442172cf9285442e94bfeef18f0b761249f3cb6187d8de334d3281eacd641f43ac42e2cbf40a3025dc81781e5c2d7a736622c70a3
- SSDEEP 24576:bqWY186JyV3OhVoirgT4A2tiNJdRNgmUESIEn7Pn5aIMN2owCQn+oBMhLbGaqrw5:bqWYrMV3eVougT4A24vLNgmUESIEjPMw
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 5020 MsiExec.exe 5020 MsiExec.exe 5020 MsiExec.exe 5020 MsiExec.exe 5020 MsiExec.exe 5020 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 4680 msiexec.exe Token: SeCreateTokenPrivilege 1812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1812 msiexec.exe Token: SeLockMemoryPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeMachineAccountPrivilege 1812 msiexec.exe Token: SeTcbPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeLoadDriverPrivilege 1812 msiexec.exe Token: SeSystemProfilePrivilege 1812 msiexec.exe Token: SeSystemtimePrivilege 1812 msiexec.exe Token: SeProfSingleProcessPrivilege 1812 msiexec.exe Token: SeIncBasePriorityPrivilege 1812 msiexec.exe Token: SeCreatePagefilePrivilege 1812 msiexec.exe Token: SeCreatePermanentPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeDebugPrivilege 1812 msiexec.exe Token: SeAuditPrivilege 1812 msiexec.exe Token: SeSystemEnvironmentPrivilege 1812 msiexec.exe Token: SeChangeNotifyPrivilege 1812 msiexec.exe Token: SeRemoteShutdownPrivilege 1812 msiexec.exe Token: SeUndockPrivilege 1812 msiexec.exe Token: SeSyncAgentPrivilege 1812 msiexec.exe Token: SeEnableDelegationPrivilege 1812 msiexec.exe Token: SeManageVolumePrivilege 1812 msiexec.exe Token: SeImpersonatePrivilege 1812 msiexec.exe Token: SeCreateGlobalPrivilege 1812 msiexec.exe Token: SeCreateTokenPrivilege 1812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1812 msiexec.exe Token: SeLockMemoryPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeMachineAccountPrivilege 1812 msiexec.exe Token: SeTcbPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeLoadDriverPrivilege 1812 msiexec.exe Token: SeSystemProfilePrivilege 1812 msiexec.exe Token: SeSystemtimePrivilege 1812 msiexec.exe Token: SeProfSingleProcessPrivilege 1812 msiexec.exe Token: SeIncBasePriorityPrivilege 1812 msiexec.exe Token: SeCreatePagefilePrivilege 1812 msiexec.exe Token: SeCreatePermanentPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeDebugPrivilege 1812 msiexec.exe Token: SeAuditPrivilege 1812 msiexec.exe Token: SeSystemEnvironmentPrivilege 1812 msiexec.exe Token: SeChangeNotifyPrivilege 1812 msiexec.exe Token: SeRemoteShutdownPrivilege 1812 msiexec.exe Token: SeUndockPrivilege 1812 msiexec.exe Token: SeSyncAgentPrivilege 1812 msiexec.exe Token: SeEnableDelegationPrivilege 1812 msiexec.exe Token: SeManageVolumePrivilege 1812 msiexec.exe Token: SeImpersonatePrivilege 1812 msiexec.exe Token: SeCreateGlobalPrivilege 1812 msiexec.exe Token: SeCreateTokenPrivilege 1812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1812 msiexec.exe Token: SeLockMemoryPrivilege 1812 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4680 wrote to memory of 5020 4680 msiexec.exe 82 PID 4680 wrote to memory of 5020 4680 msiexec.exe 82 PID 4680 wrote to memory of 5020 4680 msiexec.exe 82
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Utorrent_IIS.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34E23B9DB185B7669C0A0D56725B9459 C2⤵
- Loads dropped DLL
PID:5020
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIB006.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB006.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB6ED.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB6ED.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB7A9.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB7A9.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB7E9.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB7E9.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB819.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB819.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB962.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB962.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP