Analysis

  • max time kernel
    992s
  • max time network
    1000s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-es
  • resource tags

    arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    11/02/2023, 02:11

General

  • Target

    correioseletronicoHXLKWUGYEZDZ.msi

  • Size

    21.2MB

  • MD5

    bf8e278fdcb2510822c07b45281eb7c1

  • SHA1

    c937f2370260ff90367bb52c90db783eb112899b

  • SHA256

    cb704305afe6f0f5869d8cabc63437fae2ec58293661d3ad486d3d77f83d7bca

  • SHA512

    68bea78f6270ce245ca9429d9bb60ed7e0d455870d53f243f72b0581a082724bb1f4dc6e4a54a6acd46cd1db6c1de1835caf83f3fe1b88dd41f3b078b5b7872f

  • SSDEEP

    393216:qZe+/s2bE9uf7bQRLbiKn0M3bhVKQnYjNJdRkDEmtHg:+bE91biCoQr4me

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\correioseletronicoHXLKWUGYEZDZ.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2552
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B2E7CAB05CD9AA1179EFDCBFCDB42BA7
      2⤵
      • Loads dropped DLL
      PID:4824
    • C:\Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2mupload.exe
      "C:\Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2mupload.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2m.dll

    Filesize

    1147.5MB

    MD5

    be81e3359b843ef8912ac56f8005eada

    SHA1

    86ef5591fa00f256294540a3693ef5b090ce8bba

    SHA256

    bb4c852286b9e19038d7dc29b232aa5299bfd2562ba9b12398a986b13498818a

    SHA512

    f645079c8c2d100d264ea2d77ed6934c5813b0dc80fda336e60765345763c97ddc4b1c48c8211be3c49db02243b9d7aab6412f89d9374339594281539d600b9a

  • C:\Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2mupload.exe

    Filesize

    30KB

    MD5

    2bd61ee91994b3e9f9ebc002498d02ea

    SHA1

    5a85836809782f06a6cdf8bcff5fa86f1b2cb315

    SHA256

    07762231da2a8ce1dd2a211c49a27a2f06d7d2b7d5426fc5b6b114f845f1eca6

    SHA512

    6e52884592c364a42f1acf2bbd7b867004f232e323e7673bce99e1ddaf39b32986d44120ab26d943e40105a2d2d870d003493154b46b9230921665a4719dd9f5

  • C:\Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2mupload.exe

    Filesize

    30KB

    MD5

    2bd61ee91994b3e9f9ebc002498d02ea

    SHA1

    5a85836809782f06a6cdf8bcff5fa86f1b2cb315

    SHA256

    07762231da2a8ce1dd2a211c49a27a2f06d7d2b7d5426fc5b6b114f845f1eca6

    SHA512

    6e52884592c364a42f1acf2bbd7b867004f232e323e7673bce99e1ddaf39b32986d44120ab26d943e40105a2d2d870d003493154b46b9230921665a4719dd9f5

  • C:\Windows\Installer\MSI16B5.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • C:\Windows\Installer\MSI1ED4.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • C:\Windows\Installer\MSI20BA.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • C:\Windows\Installer\MSIE19B.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • \Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2m.dll

    Filesize

    1147.5MB

    MD5

    be81e3359b843ef8912ac56f8005eada

    SHA1

    86ef5591fa00f256294540a3693ef5b090ce8bba

    SHA256

    bb4c852286b9e19038d7dc29b232aa5299bfd2562ba9b12398a986b13498818a

    SHA512

    f645079c8c2d100d264ea2d77ed6934c5813b0dc80fda336e60765345763c97ddc4b1c48c8211be3c49db02243b9d7aab6412f89d9374339594281539d600b9a

  • \Users\Admin\AppData\Roaming\gerando liberacao\gerando liberacao\g2m.dll

    Filesize

    1147.5MB

    MD5

    be81e3359b843ef8912ac56f8005eada

    SHA1

    86ef5591fa00f256294540a3693ef5b090ce8bba

    SHA256

    bb4c852286b9e19038d7dc29b232aa5299bfd2562ba9b12398a986b13498818a

    SHA512

    f645079c8c2d100d264ea2d77ed6934c5813b0dc80fda336e60765345763c97ddc4b1c48c8211be3c49db02243b9d7aab6412f89d9374339594281539d600b9a

  • \Windows\Installer\MSI16B5.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • \Windows\Installer\MSI1ED4.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • \Windows\Installer\MSI20BA.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • \Windows\Installer\MSIE19B.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • memory/4824-161-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-169-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-136-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-137-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-138-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-139-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-140-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-142-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-141-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-143-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-144-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-145-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-146-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-147-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-148-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-149-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-150-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-151-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-152-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-153-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-154-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-155-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-156-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-157-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-158-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-159-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-160-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-134-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-162-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-163-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-164-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-165-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-166-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-167-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-168-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-135-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-170-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-173-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-174-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-175-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-176-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-178-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-177-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-179-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-180-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-181-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-182-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-183-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-184-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-185-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-186-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-187-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-188-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-189-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-133-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-130-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-131-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-190-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-192-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-191-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-128-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-127-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-126-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4824-125-0x0000000077C80000-0x0000000077E0E000-memory.dmp

    Filesize

    1.6MB

  • memory/4848-312-0x00000000008C0000-0x0000000004F01000-memory.dmp

    Filesize

    70.3MB

  • memory/4848-316-0x00000000008C0000-0x0000000004F01000-memory.dmp

    Filesize

    70.3MB

  • memory/4848-344-0x00000000008C0000-0x0000000004F01000-memory.dmp

    Filesize

    70.3MB

  • memory/4848-374-0x00000000008C0000-0x0000000004F01000-memory.dmp

    Filesize

    70.3MB