Analysis
- max time kernel
133s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
08/02/2023, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
FACT63e39.msi
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
FACT63e39.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target FACT63e39.msi
- Size 7.1MB
- Sample230208-xa7bcaed44
- SHA256 a7bc65dc16eb4c1a40ce37aacb8f2efbe613d25dee7e996b7baf579213d9fc46
- MD5 025bbdef6f92b45631344bd9affa51d2
- SHA1 20f28f94fd3b79c3b6a114d9cc45a73bc5d07cab
- SHA512 612bffaa4e4acd9f677a45e31d15debc6cbcaf809334c3e7b3f2f7fde8291681ecfcd49078af5a0796683d13a1c3928d7565625af9f08c5e89a0dc1cb1de3e0b
- SSDEEP 196608:vAWjuxRAzk7c7tLJZAx99l1FBSBsdQmxxcP:vAguxd7c7tdZ+99KWx0
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 11 1124 MsiExec.exe - Loads dropped DLL 6 IoCs
pid Process 1124 MsiExec.exe 1124 MsiExec.exe 1124 MsiExec.exe 1124 MsiExec.exe 1124 MsiExec.exe 1124 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ipinfo.io - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\LOG\MsiExec.exe.DEBUG.log MsiExec.exe File created C:\Windows\SysWOW64\LOG\MsiExec.exe.DEBUG.log MsiExec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e566d65.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI72B6.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI748D.tmp msiexec.exe File opened for modification C:\Windows\Installer\e566d65.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6ECC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI71EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7315.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{E1374409-9C72-41B0-A3BD-D5B4C1358E05} msiexec.exe File opened for modification C:\Windows\Installer\MSI74AD.tmp msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5020 msiexec.exe 5020 msiexec.exe 1124 MsiExec.exe 1124 MsiExec.exe 1124 MsiExec.exe 1124 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2796 msiexec.exe Token: SeIncreaseQuotaPrivilege 2796 msiexec.exe Token: SeSecurityPrivilege 5020 msiexec.exe Token: SeCreateTokenPrivilege 2796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2796 msiexec.exe Token: SeLockMemoryPrivilege 2796 msiexec.exe Token: SeIncreaseQuotaPrivilege 2796 msiexec.exe Token: SeMachineAccountPrivilege 2796 msiexec.exe Token: SeTcbPrivilege 2796 msiexec.exe Token: SeSecurityPrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeLoadDriverPrivilege 2796 msiexec.exe Token: SeSystemProfilePrivilege 2796 msiexec.exe Token: SeSystemtimePrivilege 2796 msiexec.exe Token: SeProfSingleProcessPrivilege 2796 msiexec.exe Token: SeIncBasePriorityPrivilege 2796 msiexec.exe Token: SeCreatePagefilePrivilege 2796 msiexec.exe Token: SeCreatePermanentPrivilege 2796 msiexec.exe Token: SeBackupPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeShutdownPrivilege 2796 msiexec.exe Token: SeDebugPrivilege 2796 msiexec.exe Token: SeAuditPrivilege 2796 msiexec.exe Token: SeSystemEnvironmentPrivilege 2796 msiexec.exe Token: SeChangeNotifyPrivilege 2796 msiexec.exe Token: SeRemoteShutdownPrivilege 2796 msiexec.exe Token: SeUndockPrivilege 2796 msiexec.exe Token: SeSyncAgentPrivilege 2796 msiexec.exe Token: SeEnableDelegationPrivilege 2796 msiexec.exe Token: SeManageVolumePrivilege 2796 msiexec.exe Token: SeImpersonatePrivilege 2796 msiexec.exe Token: SeCreateGlobalPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2796 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5020 wrote to memory of 1124 5020 msiexec.exe 84 PID 5020 wrote to memory of 1124 5020 msiexec.exe 84 PID 5020 wrote to memory of 1124 5020 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FACT63e39.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2796
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8C18F1B0FE4CC2BF58E93E0F4418187A2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI6ECC.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6ECC.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI71EA.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI71EA.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI72B6.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI72B6.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7315.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7315.tmp
- Size 376KB
- SHA256 5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
- MD5 e12c5bcc254c953b1a46d1434804f4d2
- SHA1 99f67acf34af1294f3c6e5eb521c862e1c772397
- SHA512 9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
- SSDEEP 6144:krDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyX:Mowv43bqKlRH1Vq9iyX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI74AD.tmp
- Size 6.5MB
- SHA256 728c0f25362a2b9d91b6bba4929d31f9d1af97d0397b5a9a9bde1443a47fa35f
- MD5 4954f88fcad319938e30c6710f6fa01d
- SHA1 56222aaceb5841d48ea3bd6f10c7c6c2597711f1
- SHA512 373115b76efaa17b067a9afd8d989d4f421abcbfd477dda35665100d7aa33bf0dcfac485d5199021d9a5d14fe5b5f3f9da96a9db91643f6b4350b501c55f8ca6
- SSDEEP 196608:4WjuxRAzk7c7tLJZAx99l1FBSBsdQmxxc:4guxd7c7tdZ+99KWx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI74AD.tmp
- Size 6.5MB
- SHA256 728c0f25362a2b9d91b6bba4929d31f9d1af97d0397b5a9a9bde1443a47fa35f
- MD5 4954f88fcad319938e30c6710f6fa01d
- SHA1 56222aaceb5841d48ea3bd6f10c7c6c2597711f1
- SHA512 373115b76efaa17b067a9afd8d989d4f421abcbfd477dda35665100d7aa33bf0dcfac485d5199021d9a5d14fe5b5f3f9da96a9db91643f6b4350b501c55f8ca6
- SSDEEP 196608:4WjuxRAzk7c7tLJZAx99l1FBSBsdQmxxc:4guxd7c7tdZ+99KWx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI74AD.tmp
- Size 6.5MB
- SHA256 728c0f25362a2b9d91b6bba4929d31f9d1af97d0397b5a9a9bde1443a47fa35f
- MD5 4954f88fcad319938e30c6710f6fa01d
- SHA1 56222aaceb5841d48ea3bd6f10c7c6c2597711f1
- SHA512 373115b76efaa17b067a9afd8d989d4f421abcbfd477dda35665100d7aa33bf0dcfac485d5199021d9a5d14fe5b5f3f9da96a9db91643f6b4350b501c55f8ca6
- SSDEEP 196608:4WjuxRAzk7c7tLJZAx99l1FBSBsdQmxxc:4guxd7c7tdZ+99KWx
- MD5 SHA1 SHA512 SSDEEP