Analysis
- max time kernel
62s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
18/01/2023, 03:24
Static task
static1
Behavioral task
behavioral1
Sample
VLC_media_player_IIS.msi
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
VLC_media_player_IIS.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target VLC_media_player_IIS.msi
- Size 22.5MB
- Sample230118-dx3f5agf76
- SHA256 ff46fc75ad9f26aa82bb261feb5bc4c1b544764785c6a9cd79809cba6a01ec72
- MD5 2701b51f9add84949a704863405a278a
- SHA1 64b5685f598504335b144e71daf9333881368251
- SHA512 ff4597c282b4a7db505d100430910a128f43d5605f8d73f73fb97283b9fdec88d49028329b333302f93b8b2314cbfe61f77ed5be1a2de03b64ae0a45891d571b
- SSDEEP 393216:Dhi1i04ph6pVrsGJB1Mv42sgoYlC9nclm5wX11Q6xLbDUtAcDHqCyox1+:Dhimc5sm1g4f7YlsnclVQ6xLbjayox1
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 1412 MsiExec.exe 1412 MsiExec.exe 1412 MsiExec.exe 1412 MsiExec.exe 1412 MsiExec.exe 1412 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4884 msiexec.exe Token: SeIncreaseQuotaPrivilege 4884 msiexec.exe Token: SeSecurityPrivilege 4804 msiexec.exe Token: SeCreateTokenPrivilege 4884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4884 msiexec.exe Token: SeLockMemoryPrivilege 4884 msiexec.exe Token: SeIncreaseQuotaPrivilege 4884 msiexec.exe Token: SeMachineAccountPrivilege 4884 msiexec.exe Token: SeTcbPrivilege 4884 msiexec.exe Token: SeSecurityPrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeLoadDriverPrivilege 4884 msiexec.exe Token: SeSystemProfilePrivilege 4884 msiexec.exe Token: SeSystemtimePrivilege 4884 msiexec.exe Token: SeProfSingleProcessPrivilege 4884 msiexec.exe Token: SeIncBasePriorityPrivilege 4884 msiexec.exe Token: SeCreatePagefilePrivilege 4884 msiexec.exe Token: SeCreatePermanentPrivilege 4884 msiexec.exe Token: SeBackupPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeShutdownPrivilege 4884 msiexec.exe Token: SeDebugPrivilege 4884 msiexec.exe Token: SeAuditPrivilege 4884 msiexec.exe Token: SeSystemEnvironmentPrivilege 4884 msiexec.exe Token: SeChangeNotifyPrivilege 4884 msiexec.exe Token: SeRemoteShutdownPrivilege 4884 msiexec.exe Token: SeUndockPrivilege 4884 msiexec.exe Token: SeSyncAgentPrivilege 4884 msiexec.exe Token: SeEnableDelegationPrivilege 4884 msiexec.exe Token: SeManageVolumePrivilege 4884 msiexec.exe Token: SeImpersonatePrivilege 4884 msiexec.exe Token: SeCreateGlobalPrivilege 4884 msiexec.exe Token: SeCreateTokenPrivilege 4884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4884 msiexec.exe Token: SeLockMemoryPrivilege 4884 msiexec.exe Token: SeIncreaseQuotaPrivilege 4884 msiexec.exe Token: SeMachineAccountPrivilege 4884 msiexec.exe Token: SeTcbPrivilege 4884 msiexec.exe Token: SeSecurityPrivilege 4884 msiexec.exe Token: SeTakeOwnershipPrivilege 4884 msiexec.exe Token: SeLoadDriverPrivilege 4884 msiexec.exe Token: SeSystemProfilePrivilege 4884 msiexec.exe Token: SeSystemtimePrivilege 4884 msiexec.exe Token: SeProfSingleProcessPrivilege 4884 msiexec.exe Token: SeIncBasePriorityPrivilege 4884 msiexec.exe Token: SeCreatePagefilePrivilege 4884 msiexec.exe Token: SeCreatePermanentPrivilege 4884 msiexec.exe Token: SeBackupPrivilege 4884 msiexec.exe Token: SeRestorePrivilege 4884 msiexec.exe Token: SeShutdownPrivilege 4884 msiexec.exe Token: SeDebugPrivilege 4884 msiexec.exe Token: SeAuditPrivilege 4884 msiexec.exe Token: SeSystemEnvironmentPrivilege 4884 msiexec.exe Token: SeChangeNotifyPrivilege 4884 msiexec.exe Token: SeRemoteShutdownPrivilege 4884 msiexec.exe Token: SeUndockPrivilege 4884 msiexec.exe Token: SeSyncAgentPrivilege 4884 msiexec.exe Token: SeEnableDelegationPrivilege 4884 msiexec.exe Token: SeManageVolumePrivilege 4884 msiexec.exe Token: SeImpersonatePrivilege 4884 msiexec.exe Token: SeCreateGlobalPrivilege 4884 msiexec.exe Token: SeCreateTokenPrivilege 4884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4884 msiexec.exe Token: SeLockMemoryPrivilege 4884 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4884 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4804 wrote to memory of 1412 4804 msiexec.exe 84 PID 4804 wrote to memory of 1412 4804 msiexec.exe 84 PID 4804 wrote to memory of 1412 4804 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\VLC_media_player_IIS.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4884
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E21EBEE02A98D36C81EBF40355BBA9A2 C2⤵
- Loads dropped DLL
PID:1412
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI6E20.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI6E20.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI70D1.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI70D1.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI713F.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI713F.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI716F.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI716F.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI71BE.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI71BE.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI72A9.tmp
- Size 837KB
- SHA256 87388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
- MD5 e76f80f8c9a51813813c351e35bf0755
- SHA1 ec69253f3fd681d2829d60f3a14a48c779fabbb4
- SHA512 134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
- SSDEEP 24576:m+g2QI7NuYG3JGja8zotlm02wrgbVMy8JJy29IAan6Dr:mPsJ6ma8zotlmfwrgxMy+y29IAan6Dr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI72A9.tmp
- Size 837KB
- SHA256 87388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
- MD5 e76f80f8c9a51813813c351e35bf0755
- SHA1 ec69253f3fd681d2829d60f3a14a48c779fabbb4
- SHA512 134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
- SSDEEP 24576:m+g2QI7NuYG3JGja8zotlm02wrgbVMy8JJy29IAan6Dr:mPsJ6ma8zotlmfwrgxMy+y29IAan6Dr
- MD5 SHA1 SHA512 SSDEEP