Analysis
-
max time kernel
69s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2023 13:59
Static task
static1
Behavioral task
behavioral1
Sample
aec7dcec94a1aef9db94d4a37d4a5abc.msi
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aec7dcec94a1aef9db94d4a37d4a5abc.msi
Resource
win10v2004-20220812-en
General
-
Target
aec7dcec94a1aef9db94d4a37d4a5abc.msi
-
Size
22.4MB
-
MD5
aec7dcec94a1aef9db94d4a37d4a5abc
-
SHA1
9c16f8091a3826ad5341b438f14869f1cf7d3e1e
-
SHA256
647d9d0d509ff57f5dc443e51e1ea37ad8322566ea94382a152f29bab5d0f5e1
-
SHA512
2ef7750d2237bf0750773340da8410d06340fe0aa52fb9d4bc6fd334cd42ca3812ba3fe81879adc5550a7ee642006330ef2c84db1d90e5d0f2da533d5270072e
-
SSDEEP
393216:488CG04ph6pVrsGJB1Mv42sgoYlC9nclm5wX11Q6xLbDUtAcDHqCyox1+:488Lc5sm1g4f7YlsnclVQ6xLbjayox1
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
Processes:
MsiExec.exepid process 4756 MsiExec.exe 4756 MsiExec.exe 4756 MsiExec.exe 4756 MsiExec.exe 4756 MsiExec.exe 4756 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 4776 msiexec.exe Token: SeIncreaseQuotaPrivilege 4776 msiexec.exe Token: SeSecurityPrivilege 1388 msiexec.exe Token: SeCreateTokenPrivilege 4776 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4776 msiexec.exe Token: SeLockMemoryPrivilege 4776 msiexec.exe Token: SeIncreaseQuotaPrivilege 4776 msiexec.exe Token: SeMachineAccountPrivilege 4776 msiexec.exe Token: SeTcbPrivilege 4776 msiexec.exe Token: SeSecurityPrivilege 4776 msiexec.exe Token: SeTakeOwnershipPrivilege 4776 msiexec.exe Token: SeLoadDriverPrivilege 4776 msiexec.exe Token: SeSystemProfilePrivilege 4776 msiexec.exe Token: SeSystemtimePrivilege 4776 msiexec.exe Token: SeProfSingleProcessPrivilege 4776 msiexec.exe Token: SeIncBasePriorityPrivilege 4776 msiexec.exe Token: SeCreatePagefilePrivilege 4776 msiexec.exe Token: SeCreatePermanentPrivilege 4776 msiexec.exe Token: SeBackupPrivilege 4776 msiexec.exe Token: SeRestorePrivilege 4776 msiexec.exe Token: SeShutdownPrivilege 4776 msiexec.exe Token: SeDebugPrivilege 4776 msiexec.exe Token: SeAuditPrivilege 4776 msiexec.exe Token: SeSystemEnvironmentPrivilege 4776 msiexec.exe Token: SeChangeNotifyPrivilege 4776 msiexec.exe Token: SeRemoteShutdownPrivilege 4776 msiexec.exe Token: SeUndockPrivilege 4776 msiexec.exe Token: SeSyncAgentPrivilege 4776 msiexec.exe Token: SeEnableDelegationPrivilege 4776 msiexec.exe Token: SeManageVolumePrivilege 4776 msiexec.exe Token: SeImpersonatePrivilege 4776 msiexec.exe Token: SeCreateGlobalPrivilege 4776 msiexec.exe Token: SeCreateTokenPrivilege 4776 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4776 msiexec.exe Token: SeLockMemoryPrivilege 4776 msiexec.exe Token: SeIncreaseQuotaPrivilege 4776 msiexec.exe Token: SeMachineAccountPrivilege 4776 msiexec.exe Token: SeTcbPrivilege 4776 msiexec.exe Token: SeSecurityPrivilege 4776 msiexec.exe Token: SeTakeOwnershipPrivilege 4776 msiexec.exe Token: SeLoadDriverPrivilege 4776 msiexec.exe Token: SeSystemProfilePrivilege 4776 msiexec.exe Token: SeSystemtimePrivilege 4776 msiexec.exe Token: SeProfSingleProcessPrivilege 4776 msiexec.exe Token: SeIncBasePriorityPrivilege 4776 msiexec.exe Token: SeCreatePagefilePrivilege 4776 msiexec.exe Token: SeCreatePermanentPrivilege 4776 msiexec.exe Token: SeBackupPrivilege 4776 msiexec.exe Token: SeRestorePrivilege 4776 msiexec.exe Token: SeShutdownPrivilege 4776 msiexec.exe Token: SeDebugPrivilege 4776 msiexec.exe Token: SeAuditPrivilege 4776 msiexec.exe Token: SeSystemEnvironmentPrivilege 4776 msiexec.exe Token: SeChangeNotifyPrivilege 4776 msiexec.exe Token: SeRemoteShutdownPrivilege 4776 msiexec.exe Token: SeUndockPrivilege 4776 msiexec.exe Token: SeSyncAgentPrivilege 4776 msiexec.exe Token: SeEnableDelegationPrivilege 4776 msiexec.exe Token: SeManageVolumePrivilege 4776 msiexec.exe Token: SeImpersonatePrivilege 4776 msiexec.exe Token: SeCreateGlobalPrivilege 4776 msiexec.exe Token: SeCreateTokenPrivilege 4776 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4776 msiexec.exe Token: SeLockMemoryPrivilege 4776 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 4776 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
msiexec.exedescription pid process target process PID 1388 wrote to memory of 4756 1388 msiexec.exe MsiExec.exe PID 1388 wrote to memory of 4756 1388 msiexec.exe MsiExec.exe PID 1388 wrote to memory of 4756 1388 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\aec7dcec94a1aef9db94d4a37d4a5abc.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5A5F4F79F6858DBB5DE407058F631C17 C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI790D.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI790D.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI7F38.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI7F38.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI7FD5.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI7FD5.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI8005.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI8005.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI8064.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI8064.tmpFilesize
377KB
MD5af61221c6f4e9ab3ac2440b25d751868
SHA1094f68ff354ac4c8dbdfe4689cb821f8d25880b8
SHA2561e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8
SHA512c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791
-
C:\Users\Admin\AppData\Local\Temp\MSI814F.tmpFilesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
C:\Users\Admin\AppData\Local\Temp\MSI814F.tmpFilesize
837KB
MD5e76f80f8c9a51813813c351e35bf0755
SHA1ec69253f3fd681d2829d60f3a14a48c779fabbb4
SHA25687388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161
SHA512134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5
-
memory/4756-132-0x0000000000000000-mapping.dmp