Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/01/2023, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
4de648f14a92b9085911b3fda8331e3e.msi
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4de648f14a92b9085911b3fda8331e3e.msi
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 4de648f14a92b9085911b3fda8331e3e.msi
- Size 2.4MB
- Sample230124-j15csaab72
- SHA256 00a1de538b552c482b649a878dc1f04aa729f6e0e5fd07a499776b45eab6759a
- MD5 4de648f14a92b9085911b3fda8331e3e
- SHA1 88383476e71523abf11417bff53faddbf15fc73e
- SHA512 73b59ca528b18df4f6c8c61469d7c701f189b80c4ddc19c574e30ad5b92382d2abfb3a34f9a3d5b37b2693010a4e5c9ae6bac239185655300c598279fa090077
- SSDEEP 49152:q/pPsJ6ma8zotlmfwrgxMy+y29IAan6DrA4vLNgmUESIEjPMN2lv+oBUYqMV3eV9:8Afwrty/4veHjPMNaQYqMV39TAA
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 2724 MsiExec.exe 2724 MsiExec.exe 2724 MsiExec.exe 2724 MsiExec.exe 2724 MsiExec.exe 2724 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3576 msiexec.exe Token: SeIncreaseQuotaPrivilege 3576 msiexec.exe Token: SeSecurityPrivilege 924 msiexec.exe Token: SeCreateTokenPrivilege 3576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3576 msiexec.exe Token: SeLockMemoryPrivilege 3576 msiexec.exe Token: SeIncreaseQuotaPrivilege 3576 msiexec.exe Token: SeMachineAccountPrivilege 3576 msiexec.exe Token: SeTcbPrivilege 3576 msiexec.exe Token: SeSecurityPrivilege 3576 msiexec.exe Token: SeTakeOwnershipPrivilege 3576 msiexec.exe Token: SeLoadDriverPrivilege 3576 msiexec.exe Token: SeSystemProfilePrivilege 3576 msiexec.exe Token: SeSystemtimePrivilege 3576 msiexec.exe Token: SeProfSingleProcessPrivilege 3576 msiexec.exe Token: SeIncBasePriorityPrivilege 3576 msiexec.exe Token: SeCreatePagefilePrivilege 3576 msiexec.exe Token: SeCreatePermanentPrivilege 3576 msiexec.exe Token: SeBackupPrivilege 3576 msiexec.exe Token: SeRestorePrivilege 3576 msiexec.exe Token: SeShutdownPrivilege 3576 msiexec.exe Token: SeDebugPrivilege 3576 msiexec.exe Token: SeAuditPrivilege 3576 msiexec.exe Token: SeSystemEnvironmentPrivilege 3576 msiexec.exe Token: SeChangeNotifyPrivilege 3576 msiexec.exe Token: SeRemoteShutdownPrivilege 3576 msiexec.exe Token: SeUndockPrivilege 3576 msiexec.exe Token: SeSyncAgentPrivilege 3576 msiexec.exe Token: SeEnableDelegationPrivilege 3576 msiexec.exe Token: SeManageVolumePrivilege 3576 msiexec.exe Token: SeImpersonatePrivilege 3576 msiexec.exe Token: SeCreateGlobalPrivilege 3576 msiexec.exe Token: SeCreateTokenPrivilege 3576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3576 msiexec.exe Token: SeLockMemoryPrivilege 3576 msiexec.exe Token: SeIncreaseQuotaPrivilege 3576 msiexec.exe Token: SeMachineAccountPrivilege 3576 msiexec.exe Token: SeTcbPrivilege 3576 msiexec.exe Token: SeSecurityPrivilege 3576 msiexec.exe Token: SeTakeOwnershipPrivilege 3576 msiexec.exe Token: SeLoadDriverPrivilege 3576 msiexec.exe Token: SeSystemProfilePrivilege 3576 msiexec.exe Token: SeSystemtimePrivilege 3576 msiexec.exe Token: SeProfSingleProcessPrivilege 3576 msiexec.exe Token: SeIncBasePriorityPrivilege 3576 msiexec.exe Token: SeCreatePagefilePrivilege 3576 msiexec.exe Token: SeCreatePermanentPrivilege 3576 msiexec.exe Token: SeBackupPrivilege 3576 msiexec.exe Token: SeRestorePrivilege 3576 msiexec.exe Token: SeShutdownPrivilege 3576 msiexec.exe Token: SeDebugPrivilege 3576 msiexec.exe Token: SeAuditPrivilege 3576 msiexec.exe Token: SeSystemEnvironmentPrivilege 3576 msiexec.exe Token: SeChangeNotifyPrivilege 3576 msiexec.exe Token: SeRemoteShutdownPrivilege 3576 msiexec.exe Token: SeUndockPrivilege 3576 msiexec.exe Token: SeSyncAgentPrivilege 3576 msiexec.exe Token: SeEnableDelegationPrivilege 3576 msiexec.exe Token: SeManageVolumePrivilege 3576 msiexec.exe Token: SeImpersonatePrivilege 3576 msiexec.exe Token: SeCreateGlobalPrivilege 3576 msiexec.exe Token: SeCreateTokenPrivilege 3576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3576 msiexec.exe Token: SeLockMemoryPrivilege 3576 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3576 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 924 wrote to memory of 2724 924 msiexec.exe 83 PID 924 wrote to memory of 2724 924 msiexec.exe 83 PID 924 wrote to memory of 2724 924 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4de648f14a92b9085911b3fda8331e3e.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3576
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 04D3A99795680F4550B6C3D1FB7EA3B5 C2⤵
- Loads dropped DLL
PID:2724
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI76DA.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI76DA.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI796C.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI796C.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7A09.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7A09.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7A68.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7A68.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7AB7.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7AB7.tmp
- Size 377KB
- SHA256 1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
- MD5 af61221c6f4e9ab3ac2440b25d751868
- SHA1 094f68ff354ac4c8dbdfe4689cb821f8d25880b8
- SHA512 c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
- SSDEEP 6144:n4Cl8lNPD2pVtho1xXVFpukDj3q/ntuXNj8ECBB/ELAOChVKgZErpsykgTr:7l86Jo1xXp7Dj3QuXNj8/fyYhVLEiyko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7C4E.tmp
- Size 837KB
- SHA256 87388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
- MD5 e76f80f8c9a51813813c351e35bf0755
- SHA1 ec69253f3fd681d2829d60f3a14a48c779fabbb4
- SHA512 134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
- SSDEEP 24576:m+g2QI7NuYG3JGja8zotlm02wrgbVMy8JJy29IAan6Dr:mPsJ6ma8zotlmfwrgxMy+y29IAan6Dr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7C4E.tmp
- Size 837KB
- SHA256 87388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
- MD5 e76f80f8c9a51813813c351e35bf0755
- SHA1 ec69253f3fd681d2829d60f3a14a48c779fabbb4
- SHA512 134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
- SSDEEP 24576:m+g2QI7NuYG3JGja8zotlm02wrgbVMy8JJy29IAan6Dr:mPsJ6ma8zotlmfwrgxMy+y29IAan6Dr
- MD5 SHA1 SHA512 SSDEEP