Analysis
- max time kernel
150s - max time network
143s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
08/02/2023, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
FACT63e39.msi
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
FACT63e39.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target FACT63e39.msi
- Size 7.1MB
- Sample230208-xa7bcaed44
- SHA256 a7bc65dc16eb4c1a40ce37aacb8f2efbe613d25dee7e996b7baf579213d9fc46
- MD5 025bbdef6f92b45631344bd9affa51d2
- SHA1 20f28f94fd3b79c3b6a114d9cc45a73bc5d07cab
- SHA512 612bffaa4e4acd9f677a45e31d15debc6cbcaf809334c3e7b3f2f7fde8291681ecfcd49078af5a0796683d13a1c3928d7565625af9f08c5e89a0dc1cb1de3e0b
- SSDEEP 196608:vAWjuxRAzk7c7tLJZAx99l1FBSBsdQmxxcP:vAguxd7c7tdZ+99KWx0
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 4 576 MsiExec.exe 6 576 MsiExec.exe 8 576 MsiExec.exe 10 576 MsiExec.exe 12 576 MsiExec.exe - Loads dropped DLL 4 IoCs
pid Process 576 MsiExec.exe 576 MsiExec.exe 576 MsiExec.exe 576 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ipinfo.io 4 ipinfo.io - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\syswow64\LOG\MsiExec.exe.DEBUG.log MsiExec.exe File created C:\Windows\syswow64\LOG\MsiExec.exe.DEBUG.log MsiExec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\6c0197.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI224.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI408.tmp msiexec.exe File created C:\Windows\Installer\6c0197.msi msiexec.exe File created C:\Windows\Installer\6c0199.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI211C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI215B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI476.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1500 msiexec.exe 1500 msiexec.exe 576 MsiExec.exe 576 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeSecurityPrivilege 1500 msiexec.exe Token: SeCreateTokenPrivilege 2044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2044 msiexec.exe Token: SeLockMemoryPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeMachineAccountPrivilege 2044 msiexec.exe Token: SeTcbPrivilege 2044 msiexec.exe Token: SeSecurityPrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeLoadDriverPrivilege 2044 msiexec.exe Token: SeSystemProfilePrivilege 2044 msiexec.exe Token: SeSystemtimePrivilege 2044 msiexec.exe Token: SeProfSingleProcessPrivilege 2044 msiexec.exe Token: SeIncBasePriorityPrivilege 2044 msiexec.exe Token: SeCreatePagefilePrivilege 2044 msiexec.exe Token: SeCreatePermanentPrivilege 2044 msiexec.exe Token: SeBackupPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeDebugPrivilege 2044 msiexec.exe Token: SeAuditPrivilege 2044 msiexec.exe Token: SeSystemEnvironmentPrivilege 2044 msiexec.exe Token: SeChangeNotifyPrivilege 2044 msiexec.exe Token: SeRemoteShutdownPrivilege 2044 msiexec.exe Token: SeUndockPrivilege 2044 msiexec.exe Token: SeSyncAgentPrivilege 2044 msiexec.exe Token: SeEnableDelegationPrivilege 2044 msiexec.exe Token: SeManageVolumePrivilege 2044 msiexec.exe Token: SeImpersonatePrivilege 2044 msiexec.exe Token: SeCreateGlobalPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2044 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1500 wrote to memory of 576 1500 msiexec.exe 29 PID 1500 wrote to memory of 576 1500 msiexec.exe 29 PID 1500 wrote to memory of 576 1500 msiexec.exe 29 PID 1500 wrote to memory of 576 1500 msiexec.exe 29 PID 1500 wrote to memory of 576 1500 msiexec.exe 29 PID 1500 wrote to memory of 576 1500 msiexec.exe 29 PID 1500 wrote to memory of 576 1500 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FACT63e39.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 63C047DB8C99FCE9B18E315F420EEC122⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI215B.tmp
- Size 6.5MB
- SHA256 728c0f25362a2b9d91b6bba4929d31f9d1af97d0397b5a9a9bde1443a47fa35f
- MD5 4954f88fcad319938e30c6710f6fa01d
- SHA1 56222aaceb5841d48ea3bd6f10c7c6c2597711f1
- SHA512 373115b76efaa17b067a9afd8d989d4f421abcbfd477dda35665100d7aa33bf0dcfac485d5199021d9a5d14fe5b5f3f9da96a9db91643f6b4350b501c55f8ca6
- SSDEEP 196608:4WjuxRAzk7c7tLJZAx99l1FBSBsdQmxxc:4guxd7c7tdZ+99KWx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI224.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI408.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI476.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI215B.tmp
- Size 6.5MB
- SHA256 728c0f25362a2b9d91b6bba4929d31f9d1af97d0397b5a9a9bde1443a47fa35f
- MD5 4954f88fcad319938e30c6710f6fa01d
- SHA1 56222aaceb5841d48ea3bd6f10c7c6c2597711f1
- SHA512 373115b76efaa17b067a9afd8d989d4f421abcbfd477dda35665100d7aa33bf0dcfac485d5199021d9a5d14fe5b5f3f9da96a9db91643f6b4350b501c55f8ca6
- SSDEEP 196608:4WjuxRAzk7c7tLJZAx99l1FBSBsdQmxxc:4guxd7c7tdZ+99KWx
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI224.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI408.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSI476.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP