Analysis
- max time kernel
65s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2023, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
8000217HJX5SD71253A2.msi
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
8000217HJX5SD71253A2.msi
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 8000217HJX5SD71253A2.msi
- Size 5.8MB
- Sample230119-s8rw4add7s
- SHA256 d27fc5641cadee2fe89f1a23264ae10879cde5702397a4bb3c6ace6e583bc4b7
- MD5 a9f85da3d8367497b7fe30190bfb9031
- SHA1 d12aee1a906d1c24fd3f1d8817f150e4300e5637
- SHA512 15df5b4d2a0fb28fc787f473d3ae89c553cf24b9aa290577d316c97fefc0b985c15ed54f5c3f6865218e75b45b368171c73bdc1f849cd76cb799e42d499652f8
- SSDEEP 98304:IYStMHAjYkllEspbROdAhNDIalOqV5GSRcUrjXUX5B2R5Zj173pu5grmPYpVsYU:2fFlrpbAdAvD4qfGhUrjmGj7ql0VsY
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 4 IoCs
flow pid Process 18 2976 MsiExec.exe 20 2976 MsiExec.exe 22 2976 MsiExec.exe 33 2976 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ipinfo.io 18 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{DB57D30B-CFDB-4937-9DC9-991BA2DBF6F3} msiexec.exe File opened for modification C:\Windows\Installer\MSI7304.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7372.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6FC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7267.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7529.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7559.tmp msiexec.exe File created C:\Windows\Installer\e566f0a.msi msiexec.exe File opened for modification C:\Windows\Installer\e566f0a.msi msiexec.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3428 2976 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1920 msiexec.exe 1920 msiexec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe 2976 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 4656 msiexec.exe Token: SeIncreaseQuotaPrivilege 4656 msiexec.exe Token: SeSecurityPrivilege 1920 msiexec.exe Token: SeCreateTokenPrivilege 4656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4656 msiexec.exe Token: SeLockMemoryPrivilege 4656 msiexec.exe Token: SeIncreaseQuotaPrivilege 4656 msiexec.exe Token: SeMachineAccountPrivilege 4656 msiexec.exe Token: SeTcbPrivilege 4656 msiexec.exe Token: SeSecurityPrivilege 4656 msiexec.exe Token: SeTakeOwnershipPrivilege 4656 msiexec.exe Token: SeLoadDriverPrivilege 4656 msiexec.exe Token: SeSystemProfilePrivilege 4656 msiexec.exe Token: SeSystemtimePrivilege 4656 msiexec.exe Token: SeProfSingleProcessPrivilege 4656 msiexec.exe Token: SeIncBasePriorityPrivilege 4656 msiexec.exe Token: SeCreatePagefilePrivilege 4656 msiexec.exe Token: SeCreatePermanentPrivilege 4656 msiexec.exe Token: SeBackupPrivilege 4656 msiexec.exe Token: SeRestorePrivilege 4656 msiexec.exe Token: SeShutdownPrivilege 4656 msiexec.exe Token: SeDebugPrivilege 4656 msiexec.exe Token: SeAuditPrivilege 4656 msiexec.exe Token: SeSystemEnvironmentPrivilege 4656 msiexec.exe Token: SeChangeNotifyPrivilege 4656 msiexec.exe Token: SeRemoteShutdownPrivilege 4656 msiexec.exe Token: SeUndockPrivilege 4656 msiexec.exe Token: SeSyncAgentPrivilege 4656 msiexec.exe Token: SeEnableDelegationPrivilege 4656 msiexec.exe Token: SeManageVolumePrivilege 4656 msiexec.exe Token: SeImpersonatePrivilege 4656 msiexec.exe Token: SeCreateGlobalPrivilege 4656 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe Token: SeRestorePrivilege 1920 msiexec.exe Token: SeTakeOwnershipPrivilege 1920 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4656 msiexec.exe 4656 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2976 1920 msiexec.exe 83 PID 1920 wrote to memory of 2976 1920 msiexec.exe 83 PID 1920 wrote to memory of 2976 1920 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8000217HJX5SD71253A2.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4656
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 90DF7B9A30F9C78AAE332977CC2F297D2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 8363⤵
- Program crash
PID:3428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2976 -ip 29761⤵PID:4392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI6FC6.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6FC6.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7267.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7267.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7304.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7304.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7372.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7372.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7559.tmp
- Size 5.3MB
- SHA256 78aab285004b1d3dd3101afeb0de6c3f5b5899931f57110274ec5908b410c157
- MD5 9112dae7a29cd58581bdc831167b0d66
- SHA1 c371598b8774bde914c0c5bccb39f75ee1ad36a2
- SHA512 409106e7de6a2362f2218118e870146074fdf077f9be2e59bbb2ba312db61622c0b8a02bd1b507c073f3459b44efe12478804964930aa714ad3cdc93d03dd58b
- SSDEEP 98304:fkllEspbROdAhNDIalOqV5GSRcUrjXUX5B2R5Zj173pu5grmPYpVsYU:clrpbAdAvD4qfGhUrjmGj7ql0VsY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7559.tmp
- Size 5.3MB
- SHA256 78aab285004b1d3dd3101afeb0de6c3f5b5899931f57110274ec5908b410c157
- MD5 9112dae7a29cd58581bdc831167b0d66
- SHA1 c371598b8774bde914c0c5bccb39f75ee1ad36a2
- SHA512 409106e7de6a2362f2218118e870146074fdf077f9be2e59bbb2ba312db61622c0b8a02bd1b507c073f3459b44efe12478804964930aa714ad3cdc93d03dd58b
- SSDEEP 98304:fkllEspbROdAhNDIalOqV5GSRcUrjXUX5B2R5Zj173pu5grmPYpVsYU:clrpbAdAvD4qfGhUrjmGj7ql0VsY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7559.tmp
- Size 5.3MB
- SHA256 78aab285004b1d3dd3101afeb0de6c3f5b5899931f57110274ec5908b410c157
- MD5 9112dae7a29cd58581bdc831167b0d66
- SHA1 c371598b8774bde914c0c5bccb39f75ee1ad36a2
- SHA512 409106e7de6a2362f2218118e870146074fdf077f9be2e59bbb2ba312db61622c0b8a02bd1b507c073f3459b44efe12478804964930aa714ad3cdc93d03dd58b
- SSDEEP 98304:fkllEspbROdAhNDIalOqV5GSRcUrjXUX5B2R5Zj173pu5grmPYpVsYU:clrpbAdAvD4qfGhUrjmGj7ql0VsY
- MD5 SHA1 SHA512 SSDEEP