Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
27/01/2023, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
Factura63d40.msi
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Factura63d40.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Factura63d40.msi
- Size 5.7MB
- Sample230127-xcwydsea21
- SHA256 db0e7ecf7d7934cc0a0620372cb5dfb554efab090662b51830097dac3d37ca87
- MD5 0ca5bc94ad2fb76712926f1f03064a3e
- SHA1 40f032c3d6481a94b810b29d125bc0be3e039a4d
- SHA512 053ce30098a209a950e2a9bc8cc7368404a62a6606867608c6dff08a9aa588edc34989d3a48a56bee085bfe58370b7a97c061bcfaa58f7a2ccd38b039bc26a36
- SSDEEP 98304:qYgtMHAr01JGiG3m97YLxB0xgCP+fxQR3xtRlBHCjUvoUq8hLOWK8MMx7BaxioHW:a/01N97YLx/fWRBlBHDvoUHhSj7MRB64
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 10 IoCs
flow pid Process 12 2172 MsiExec.exe 14 2172 MsiExec.exe 16 2172 MsiExec.exe 22 2172 MsiExec.exe 35 2172 MsiExec.exe 42 2172 MsiExec.exe 45 2172 MsiExec.exe 46 2172 MsiExec.exe 47 2172 MsiExec.exe 48 2172 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 2172 MsiExec.exe 2172 MsiExec.exe 2172 MsiExec.exe 2172 MsiExec.exe 2172 MsiExec.exe 2172 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ipinfo.io 12 ipinfo.io - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6950.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{15D4FC92-5115-4406-A585-CEB0B9D7EF02} msiexec.exe File created C:\Windows\Installer\e56614f.msi msiexec.exe File opened for modification C:\Windows\Installer\e56614f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI68C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B07.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B18.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI622A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI69BE.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4976 msiexec.exe 4976 msiexec.exe 2172 MsiExec.exe 2172 MsiExec.exe 2172 MsiExec.exe 2172 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2672 msiexec.exe Token: SeIncreaseQuotaPrivilege 2672 msiexec.exe Token: SeSecurityPrivilege 4976 msiexec.exe Token: SeCreateTokenPrivilege 2672 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2672 msiexec.exe Token: SeLockMemoryPrivilege 2672 msiexec.exe Token: SeIncreaseQuotaPrivilege 2672 msiexec.exe Token: SeMachineAccountPrivilege 2672 msiexec.exe Token: SeTcbPrivilege 2672 msiexec.exe Token: SeSecurityPrivilege 2672 msiexec.exe Token: SeTakeOwnershipPrivilege 2672 msiexec.exe Token: SeLoadDriverPrivilege 2672 msiexec.exe Token: SeSystemProfilePrivilege 2672 msiexec.exe Token: SeSystemtimePrivilege 2672 msiexec.exe Token: SeProfSingleProcessPrivilege 2672 msiexec.exe Token: SeIncBasePriorityPrivilege 2672 msiexec.exe Token: SeCreatePagefilePrivilege 2672 msiexec.exe Token: SeCreatePermanentPrivilege 2672 msiexec.exe Token: SeBackupPrivilege 2672 msiexec.exe Token: SeRestorePrivilege 2672 msiexec.exe Token: SeShutdownPrivilege 2672 msiexec.exe Token: SeDebugPrivilege 2672 msiexec.exe Token: SeAuditPrivilege 2672 msiexec.exe Token: SeSystemEnvironmentPrivilege 2672 msiexec.exe Token: SeChangeNotifyPrivilege 2672 msiexec.exe Token: SeRemoteShutdownPrivilege 2672 msiexec.exe Token: SeUndockPrivilege 2672 msiexec.exe Token: SeSyncAgentPrivilege 2672 msiexec.exe Token: SeEnableDelegationPrivilege 2672 msiexec.exe Token: SeManageVolumePrivilege 2672 msiexec.exe Token: SeImpersonatePrivilege 2672 msiexec.exe Token: SeCreateGlobalPrivilege 2672 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4976 wrote to memory of 2172 4976 msiexec.exe 83 PID 4976 wrote to memory of 2172 4976 msiexec.exe 83 PID 4976 wrote to memory of 2172 4976 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Factura63d40.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2672
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8B581B5AE7425616FA7364D30F21286B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI622A.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI622A.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI68C2.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI68C2.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6950.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6950.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI69BE.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI69BE.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6B18.tmp
- Size 5.2MB
- SHA256 6ba903b28527091c246101d85bf6358f47a2a05d0d8a441a89d005480903270c
- MD5 50733dcf7a33a7ef056bcd9659ba8d27
- SHA1 40fec343b720b724020502ca653d5a5256dfbbd6
- SHA512 a2e3dd3ce696211e7805353e20c3abce0bdbd8b43f1c7f9975994322af693fe98690797525c79ffe3033383748387d291683a67e2023664be32f00b6d065f15b
- SSDEEP 98304:b1JGiG3m97YLxB0xgCP+fxQR3xtRlBHCjUvoUq8hLOWK8MMx7BaxioHAhirWb5:b1N97YLx/fWRBlBHDvoUHhSj7MRB6iWU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6B18.tmp
- Size 5.2MB
- SHA256 6ba903b28527091c246101d85bf6358f47a2a05d0d8a441a89d005480903270c
- MD5 50733dcf7a33a7ef056bcd9659ba8d27
- SHA1 40fec343b720b724020502ca653d5a5256dfbbd6
- SHA512 a2e3dd3ce696211e7805353e20c3abce0bdbd8b43f1c7f9975994322af693fe98690797525c79ffe3033383748387d291683a67e2023664be32f00b6d065f15b
- SSDEEP 98304:b1JGiG3m97YLxB0xgCP+fxQR3xtRlBHCjUvoUq8hLOWK8MMx7BaxioHAhirWb5:b1N97YLx/fWRBlBHDvoUHhSj7MRB6iWU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6B18.tmp
- Size 5.2MB
- SHA256 6ba903b28527091c246101d85bf6358f47a2a05d0d8a441a89d005480903270c
- MD5 50733dcf7a33a7ef056bcd9659ba8d27
- SHA1 40fec343b720b724020502ca653d5a5256dfbbd6
- SHA512 a2e3dd3ce696211e7805353e20c3abce0bdbd8b43f1c7f9975994322af693fe98690797525c79ffe3033383748387d291683a67e2023664be32f00b6d065f15b
- SSDEEP 98304:b1JGiG3m97YLxB0xgCP+fxQR3xtRlBHCjUvoUq8hLOWK8MMx7BaxioHAhirWb5:b1N97YLx/fWRBlBHDvoUHhSj7MRB6iWU
- MD5 SHA1 SHA512 SSDEEP