b8c3e54d1fe3211eea24de7d7ac23f49c3458420724dd8ceb7e8c1c123e3765e

General

Target

setup Project64 1.6.exe
Size

2.0MB
MD5

eb2d62ed23c4d4486b6649e7b162038a
SHA1

005954395994c0a355c06abae3fc88d10ae84934
SHA256

b8c3e54d1fe3211eea24de7d7ac23f49c3458420724dd8ceb7e8c1c123e3765e
SHA512

4f324a5cd7005213176eb13945f0fcd17c4cd8675ecf76dde70e54d06de6839d0783c99c7dbf66403b1e2e67f099779934207075b4060a90aad3d8ac79434ff5
SSDEEP

49152:bHgGjjjru2mZIem786Btv2KSA8Wt86/fRCUHOZR1lhJQs:LhHgm37BBl2U8WB/JC6OhDJQs

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

MSIEXEC.EXE

description	ioc	process
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\F:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSIEXEC.EXE

pid process

960 MSIEXEC.EXE

pid	process
960	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

MSIEXEC.EXEmsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	960	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	960	MSIEXEC.EXE
Token: SeRestorePrivilege	1108	msiexec.exe
Token: SeTakeOwnershipPrivilege	1108	msiexec.exe
Token: SeSecurityPrivilege	1108	msiexec.exe
Token: SeCreateTokenPrivilege	960	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	960	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	960	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	960	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	960	MSIEXEC.EXE
Token: SeTcbPrivilege	960	MSIEXEC.EXE
Token: SeSecurityPrivilege	960	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	960	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	960	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	960	MSIEXEC.EXE
Token: SeSystemtimePrivilege	960	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	960	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	960	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	960	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	960	MSIEXEC.EXE
Token: SeBackupPrivilege	960	MSIEXEC.EXE
Token: SeRestorePrivilege	960	MSIEXEC.EXE
Token: SeShutdownPrivilege	960	MSIEXEC.EXE
Token: SeDebugPrivilege	960	MSIEXEC.EXE
Token: SeAuditPrivilege	960	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	960	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	960	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	960	MSIEXEC.EXE
Token: SeUndockPrivilege	960	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	960	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	960	MSIEXEC.EXE
Token: SeManageVolumePrivilege	960	MSIEXEC.EXE
Token: SeImpersonatePrivilege	960	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	960	MSIEXEC.EXE
Token: SeBackupPrivilege	1028	vssvc.exe
Token: SeRestorePrivilege	1028	vssvc.exe
Token: SeAuditPrivilege	1028	vssvc.exe
Token: SeBackupPrivilege	1108	msiexec.exe
Token: SeRestorePrivilege	1108	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MSIEXEC.EXE

pid process

960 MSIEXEC.EXE

pid	process
960	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

setup Project64 1.6.exe

description	pid	process	target process
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE
PID 1964 wrote to memory of 960	1964	setup Project64 1.6.exe	MSIEXEC.EXE

C:\Users\Admin\AppData\Local\Temp\setup Project64 1.6.exe
"C:\Users\Admin\AppData\Local\Temp\setup Project64 1.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\MSIEXEC.EXE
MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\_is36CB\Project64 1.6.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:960

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_is36CB\Project64 1.6.msi
Filesize
1.8MB

MD5
3bb7516962c50f2bbd6c922c8e397561

SHA1
37495a93ef0190993cd74a1c4d277dab2e37e3b7

SHA256
359e0e05c52f5c62680064e8716c95889dafe8f23972162feb6d6148d2ff9ada

SHA512
919ff915f3c2799585f5795bef27fa062100cc86bd913df45e1275703feda1c584643cf2c763579b1a5d86229cd87d5aa089bb5a1b09ff8770bb0bff9b7215e6

Download Submit
memory/960-55-0x0000000000000000-mapping.dmp

Download
memory/1108-58-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1964-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads