Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 21:46
Static task
static1
Behavioral task
behavioral1
Sample
VLC_3.0.18_X64.msi
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
VLC_3.0.18_X64.msi
Resource
win10v2004-20220812-en
General
-
Target
VLC_3.0.18_X64.msi
-
Size
22.4MB
-
MD5
aec7dcec94a1aef9db94d4a37d4a5abc
-
SHA1
9c16f8091a3826ad5341b438f14869f1cf7d3e1e
-
SHA256
647d9d0d509ff57f5dc443e51e1ea37ad8322566ea94382a152f29bab5d0f5e1
-
SHA512
2ef7750d2237bf0750773340da8410d06340fe0aa52fb9d4bc6fd334cd42ca3812ba3fe81879adc5550a7ee642006330ef2c84db1d90e5d0f2da533d5270072e
-
SSDEEP
393216:488CG04ph6pVrsGJB1Mv42sgoYlC9nclm5wX11Q6xLbDUtAcDHqCyox1+:488Lc5sm1g4f7YlsnclVQ6xLbjayox1
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exepid process 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1516 msiexec.exe Token: SeIncreaseQuotaPrivilege 1516 msiexec.exe Token: SeRestorePrivilege 552 msiexec.exe Token: SeTakeOwnershipPrivilege 552 msiexec.exe Token: SeSecurityPrivilege 552 msiexec.exe Token: SeCreateTokenPrivilege 1516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1516 msiexec.exe Token: SeLockMemoryPrivilege 1516 msiexec.exe Token: SeIncreaseQuotaPrivilege 1516 msiexec.exe Token: SeMachineAccountPrivilege 1516 msiexec.exe Token: SeTcbPrivilege 1516 msiexec.exe Token: SeSecurityPrivilege 1516 msiexec.exe Token: SeTakeOwnershipPrivilege 1516 msiexec.exe Token: SeLoadDriverPrivilege 1516 msiexec.exe Token: SeSystemProfilePrivilege 1516 msiexec.exe Token: SeSystemtimePrivilege 1516 msiexec.exe Token: SeProfSingleProcessPrivilege 1516 msiexec.exe Token: SeIncBasePriorityPrivilege 1516 msiexec.exe Token: SeCreatePagefilePrivilege 1516 msiexec.exe Token: SeCreatePermanentPrivilege 1516 msiexec.exe Token: SeBackupPrivilege 1516 msiexec.exe Token: SeRestorePrivilege 1516 msiexec.exe Token: SeShutdownPrivilege 1516 msiexec.exe Token: SeDebugPrivilege 1516 msiexec.exe Token: SeAuditPrivilege 1516 msiexec.exe Token: SeSystemEnvironmentPrivilege 1516 msiexec.exe Token: SeChangeNotifyPrivilege 1516 msiexec.exe Token: SeRemoteShutdownPrivilege 1516 msiexec.exe Token: SeUndockPrivilege 1516 msiexec.exe Token: SeSyncAgentPrivilege 1516 msiexec.exe Token: SeEnableDelegationPrivilege 1516 msiexec.exe Token: SeManageVolumePrivilege 1516 msiexec.exe Token: SeImpersonatePrivilege 1516 msiexec.exe Token: SeCreateGlobalPrivilege 1516 msiexec.exe Token: SeCreateTokenPrivilege 1516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1516 msiexec.exe Token: SeLockMemoryPrivilege 1516 msiexec.exe Token: SeIncreaseQuotaPrivilege 1516 msiexec.exe Token: SeMachineAccountPrivilege 1516 msiexec.exe Token: SeTcbPrivilege 1516 msiexec.exe Token: SeSecurityPrivilege 1516 msiexec.exe Token: SeTakeOwnershipPrivilege 1516 msiexec.exe Token: SeLoadDriverPrivilege 1516 msiexec.exe Token: SeSystemProfilePrivilege 1516 msiexec.exe Token: SeSystemtimePrivilege 1516 msiexec.exe Token: SeProfSingleProcessPrivilege 1516 msiexec.exe Token: SeIncBasePriorityPrivilege 1516 msiexec.exe Token: SeCreatePagefilePrivilege 1516 msiexec.exe Token: SeCreatePermanentPrivilege 1516 msiexec.exe Token: SeBackupPrivilege 1516 msiexec.exe Token: SeRestorePrivilege 1516 msiexec.exe Token: SeShutdownPrivilege 1516 msiexec.exe Token: SeDebugPrivilege 1516 msiexec.exe Token: SeAuditPrivilege 1516 msiexec.exe Token: SeSystemEnvironmentPrivilege 1516 msiexec.exe Token: SeChangeNotifyPrivilege 1516 msiexec.exe Token: SeRemoteShutdownPrivilege 1516 msiexec.exe Token: SeUndockPrivilege 1516 msiexec.exe Token: SeSyncAgentPrivilege 1516 msiexec.exe Token: SeEnableDelegationPrivilege 1516 msiexec.exe Token: SeManageVolumePrivilege 1516 msiexec.exe Token: SeImpersonatePrivilege 1516 msiexec.exe Token: SeCreateGlobalPrivilege 1516 msiexec.exe Token: SeCreateTokenPrivilege 1516 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 1516 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe PID 552 wrote to memory of 1932 552 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\VLC_3.0.18_X64.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9D71B0E71B7C9E952D9000658AD564A C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI20AB.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI2223.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI25AD.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI262A.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI29E3.tmpFilesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
\Users\Admin\AppData\Local\Temp\MSI20AB.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI2223.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI25AD.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI262A.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI29E3.tmpFilesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
memory/1516-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmpFilesize
8KB
-
memory/1932-57-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1932-56-0x0000000000000000-mapping.dmp