Analysis
-
max time kernel
151s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 07:47
Static task
static1
Behavioral task
behavioral1
Sample
setup Project64 1.6.exe
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
setup Project64 1.6.exe
Resource
win7-20221111-en
General
-
Target
setup Project64 1.6.exe
-
Size
2.0MB
-
MD5
eb2d62ed23c4d4486b6649e7b162038a
-
SHA1
005954395994c0a355c06abae3fc88d10ae84934
-
SHA256
b8c3e54d1fe3211eea24de7d7ac23f49c3458420724dd8ceb7e8c1c123e3765e
-
SHA512
4f324a5cd7005213176eb13945f0fcd17c4cd8675ecf76dde70e54d06de6839d0783c99c7dbf66403b1e2e67f099779934207075b4060a90aad3d8ac79434ff5
-
SSDEEP
49152:bHgGjjjru2mZIem786Btv2KSA8Wt86/fRCUHOZR1lhJQs:LhHgm37BBl2U8WB/JC6OhDJQs
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MSIEXEC.EXEdescription ioc process File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSIEXEC.EXEpid process 960 MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 39 IoCs
Processes:
MSIEXEC.EXEmsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 960 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 960 MSIEXEC.EXE Token: SeRestorePrivilege 1108 msiexec.exe Token: SeTakeOwnershipPrivilege 1108 msiexec.exe Token: SeSecurityPrivilege 1108 msiexec.exe Token: SeCreateTokenPrivilege 960 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 960 MSIEXEC.EXE Token: SeLockMemoryPrivilege 960 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 960 MSIEXEC.EXE Token: SeMachineAccountPrivilege 960 MSIEXEC.EXE Token: SeTcbPrivilege 960 MSIEXEC.EXE Token: SeSecurityPrivilege 960 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 960 MSIEXEC.EXE Token: SeLoadDriverPrivilege 960 MSIEXEC.EXE Token: SeSystemProfilePrivilege 960 MSIEXEC.EXE Token: SeSystemtimePrivilege 960 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 960 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 960 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 960 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 960 MSIEXEC.EXE Token: SeBackupPrivilege 960 MSIEXEC.EXE Token: SeRestorePrivilege 960 MSIEXEC.EXE Token: SeShutdownPrivilege 960 MSIEXEC.EXE Token: SeDebugPrivilege 960 MSIEXEC.EXE Token: SeAuditPrivilege 960 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 960 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 960 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 960 MSIEXEC.EXE Token: SeUndockPrivilege 960 MSIEXEC.EXE Token: SeSyncAgentPrivilege 960 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 960 MSIEXEC.EXE Token: SeManageVolumePrivilege 960 MSIEXEC.EXE Token: SeImpersonatePrivilege 960 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 960 MSIEXEC.EXE Token: SeBackupPrivilege 1028 vssvc.exe Token: SeRestorePrivilege 1028 vssvc.exe Token: SeAuditPrivilege 1028 vssvc.exe Token: SeBackupPrivilege 1108 msiexec.exe Token: SeRestorePrivilege 1108 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
MSIEXEC.EXEpid process 960 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
setup Project64 1.6.exedescription pid process target process PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE PID 1964 wrote to memory of 960 1964 setup Project64 1.6.exe MSIEXEC.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup Project64 1.6.exe"C:\Users\Admin\AppData\Local\Temp\setup Project64 1.6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\_is36CB\Project64 1.6.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_is36CB\Project64 1.6.msiFilesize
1.8MB
MD53bb7516962c50f2bbd6c922c8e397561
SHA137495a93ef0190993cd74a1c4d277dab2e37e3b7
SHA256359e0e05c52f5c62680064e8716c95889dafe8f23972162feb6d6148d2ff9ada
SHA512919ff915f3c2799585f5795bef27fa062100cc86bd913df45e1275703feda1c584643cf2c763579b1a5d86229cd87d5aa089bb5a1b09ff8770bb0bff9b7215e6
-
memory/960-55-0x0000000000000000-mapping.dmp
-
memory/1108-58-0x000007FEFB771000-0x000007FEFB773000-memory.dmpFilesize
8KB
-
memory/1964-54-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB