Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 20:32
Static task
static1
Behavioral task
behavioral1
Sample
VLC_3.0.18_X64.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
VLC_3.0.18_X64.msi
Resource
win10v2004-20220901-en
General
-
Target
VLC_3.0.18_X64.msi
-
Size
22.4MB
-
MD5
aec7dcec94a1aef9db94d4a37d4a5abc
-
SHA1
9c16f8091a3826ad5341b438f14869f1cf7d3e1e
-
SHA256
647d9d0d509ff57f5dc443e51e1ea37ad8322566ea94382a152f29bab5d0f5e1
-
SHA512
2ef7750d2237bf0750773340da8410d06340fe0aa52fb9d4bc6fd334cd42ca3812ba3fe81879adc5550a7ee642006330ef2c84db1d90e5d0f2da533d5270072e
-
SSDEEP
393216:488CG04ph6pVrsGJB1Mv42sgoYlC9nclm5wX11Q6xLbDUtAcDHqCyox1+:488Lc5sm1g4f7YlsnclVQ6xLbjayox1
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exepid process 1924 MsiExec.exe 1924 MsiExec.exe 1924 MsiExec.exe 1924 MsiExec.exe 1924 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeSecurityPrivilege 1972 msiexec.exe Token: SeCreateTokenPrivilege 1396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1396 msiexec.exe Token: SeLockMemoryPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeMachineAccountPrivilege 1396 msiexec.exe Token: SeTcbPrivilege 1396 msiexec.exe Token: SeSecurityPrivilege 1396 msiexec.exe Token: SeTakeOwnershipPrivilege 1396 msiexec.exe Token: SeLoadDriverPrivilege 1396 msiexec.exe Token: SeSystemProfilePrivilege 1396 msiexec.exe Token: SeSystemtimePrivilege 1396 msiexec.exe Token: SeProfSingleProcessPrivilege 1396 msiexec.exe Token: SeIncBasePriorityPrivilege 1396 msiexec.exe Token: SeCreatePagefilePrivilege 1396 msiexec.exe Token: SeCreatePermanentPrivilege 1396 msiexec.exe Token: SeBackupPrivilege 1396 msiexec.exe Token: SeRestorePrivilege 1396 msiexec.exe Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeDebugPrivilege 1396 msiexec.exe Token: SeAuditPrivilege 1396 msiexec.exe Token: SeSystemEnvironmentPrivilege 1396 msiexec.exe Token: SeChangeNotifyPrivilege 1396 msiexec.exe Token: SeRemoteShutdownPrivilege 1396 msiexec.exe Token: SeUndockPrivilege 1396 msiexec.exe Token: SeSyncAgentPrivilege 1396 msiexec.exe Token: SeEnableDelegationPrivilege 1396 msiexec.exe Token: SeManageVolumePrivilege 1396 msiexec.exe Token: SeImpersonatePrivilege 1396 msiexec.exe Token: SeCreateGlobalPrivilege 1396 msiexec.exe Token: SeCreateTokenPrivilege 1396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1396 msiexec.exe Token: SeLockMemoryPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeMachineAccountPrivilege 1396 msiexec.exe Token: SeTcbPrivilege 1396 msiexec.exe Token: SeSecurityPrivilege 1396 msiexec.exe Token: SeTakeOwnershipPrivilege 1396 msiexec.exe Token: SeLoadDriverPrivilege 1396 msiexec.exe Token: SeSystemProfilePrivilege 1396 msiexec.exe Token: SeSystemtimePrivilege 1396 msiexec.exe Token: SeProfSingleProcessPrivilege 1396 msiexec.exe Token: SeIncBasePriorityPrivilege 1396 msiexec.exe Token: SeCreatePagefilePrivilege 1396 msiexec.exe Token: SeCreatePermanentPrivilege 1396 msiexec.exe Token: SeBackupPrivilege 1396 msiexec.exe Token: SeRestorePrivilege 1396 msiexec.exe Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeDebugPrivilege 1396 msiexec.exe Token: SeAuditPrivilege 1396 msiexec.exe Token: SeSystemEnvironmentPrivilege 1396 msiexec.exe Token: SeChangeNotifyPrivilege 1396 msiexec.exe Token: SeRemoteShutdownPrivilege 1396 msiexec.exe Token: SeUndockPrivilege 1396 msiexec.exe Token: SeSyncAgentPrivilege 1396 msiexec.exe Token: SeEnableDelegationPrivilege 1396 msiexec.exe Token: SeManageVolumePrivilege 1396 msiexec.exe Token: SeImpersonatePrivilege 1396 msiexec.exe Token: SeCreateGlobalPrivilege 1396 msiexec.exe Token: SeCreateTokenPrivilege 1396 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1396 msiexec.exe 1396 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 1924 1972 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\VLC_3.0.18_X64.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53FC225FF3A40571E1DBDC6B8157F8D0 C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI22AE.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI2500.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI27EE.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI284C.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI2B88.tmpFilesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
\Users\Admin\AppData\Local\Temp\MSI22AE.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI2500.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI27EE.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI284C.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
\Users\Admin\AppData\Local\Temp\MSI2B88.tmpFilesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
memory/1396-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmpFilesize
8KB
-
memory/1924-57-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB
-
memory/1924-56-0x0000000000000000-mapping.dmp