5d12af1bcac2c14156deada92e22d0dc7872ab548d343d97e7f58d4e4f84a653

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/02/2023, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Processo 09-02-2023 dfyc.msi
Size

48.1MB
MD5

38da942ba4401ee52f663781ddded2ca
SHA1

b4ae66a99499dd02cc21cb6b3e22463db7fa67f0
SHA256

9e9dbb8ac378eaf561a1d2ceef411cc3bd0e225f649f9c2de5f7eff05bde54ef
SHA512

43624f63bcb83534c8f8fb8955dd1b88447ad3f218ce78751cb7863990b8407d9d2669e85354325f8621ede078f8d0cbd228df90a3431e030b25af5364d85e22
SSDEEP

786432:LVB9oDvwu7MpTmGXKq9QVgglClybzPnrQsdkJQBqm:LH9oDwuopTmGL9OgNyE6Ggqm

Score

8^/10

upx

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4860	msiexec.exe

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022e55-141.dat	acprotect
behavioral2/files/0x0007000000022e55-142.dat	acprotect
behavioral2/files/0x0007000000022e55-143.dat	acprotect

Loads dropped DLL 6 IoCs

pid	Process
1784	MsiExec.exe
1784	MsiExec.exe
1784	MsiExec.exe
1784	MsiExec.exe
1784	MsiExec.exe
1784	MsiExec.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e55-141.dat	upx
behavioral2/files/0x0007000000022e55-142.dat	upx
behavioral2/files/0x0007000000022e55-143.dat	upx
behavioral2/memory/1784-144-0x0000000002850000-0x0000000003502000-memory.dmp	upx
behavioral2/memory/1784-145-0x0000000002850000-0x0000000003502000-memory.dmp	upx
behavioral2/memory/1784-146-0x0000000002850000-0x0000000003502000-memory.dmp	upx

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e566bce.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7268.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72C7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7681.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e566bce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI712E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9896FC3A-C1B8-4ACA-8C14-EE561FF95E41}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78D3.tmp	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	msiexec.exe
3956	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	3956	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeMachineAccountPrivilege	4860	msiexec.exe
Token: SeTcbPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeLoadDriverPrivilege	4860	msiexec.exe
Token: SeSystemProfilePrivilege	4860	msiexec.exe
Token: SeSystemtimePrivilege	4860	msiexec.exe
Token: SeProfSingleProcessPrivilege	4860	msiexec.exe
Token: SeIncBasePriorityPrivilege	4860	msiexec.exe
Token: SeCreatePagefilePrivilege	4860	msiexec.exe
Token: SeCreatePermanentPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeDebugPrivilege	4860	msiexec.exe
Token: SeAuditPrivilege	4860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4860	msiexec.exe
Token: SeChangeNotifyPrivilege	4860	msiexec.exe
Token: SeRemoteShutdownPrivilege	4860	msiexec.exe
Token: SeUndockPrivilege	4860	msiexec.exe
Token: SeSyncAgentPrivilege	4860	msiexec.exe
Token: SeEnableDelegationPrivilege	4860	msiexec.exe
Token: SeManageVolumePrivilege	4860	msiexec.exe
Token: SeImpersonatePrivilege	4860	msiexec.exe
Token: SeCreateGlobalPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 1784	3956	msiexec.exe	82
PID 3956 wrote to memory of 1784	3956	msiexec.exe	82
PID 3956 wrote to memory of 1784	3956	msiexec.exe	82

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Processo 09-02-2023 dfyc.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F428D8D34A754445E031EDCE6AE75D1B
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI6E6E.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI6E6E.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI712E.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI712E.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI7268.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI7268.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI72C7.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI72C7.tmp

Filesize
381KB

MD5
e2b1df34e19a3ce763747b12ab33fdd2

SHA1
e9cc67780be7e148950870ee4a812349b6255f39

SHA256
14daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8

SHA512
a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0

Download Submit
C:\Windows\Installer\MSI78D3.tmp

Filesize
26.5MB

MD5
dd735cf27f5e3d684e3112f15f442dfc

SHA1
17efa740cdb76b6c59cc90f16b7693d7b3742785

SHA256
65cdb22633adb79b4904e3e14e843c16a3f7c13546e93679f29f0c57a195a851

SHA512
5ef3ad3e488027c9261a15f167aded8ce45428b36b4040c4149d34a709a008a8baaa8b474f01b9a4fd5eeb9a92a5027d71560867909183a82751b7b6ae0fc944

Download Submit
C:\Windows\Installer\MSI78D3.tmp

Filesize
26.5MB

MD5
dd735cf27f5e3d684e3112f15f442dfc

SHA1
17efa740cdb76b6c59cc90f16b7693d7b3742785

SHA256
65cdb22633adb79b4904e3e14e843c16a3f7c13546e93679f29f0c57a195a851

SHA512
5ef3ad3e488027c9261a15f167aded8ce45428b36b4040c4149d34a709a008a8baaa8b474f01b9a4fd5eeb9a92a5027d71560867909183a82751b7b6ae0fc944

Download Submit
C:\Windows\Installer\MSI78D3.tmp

Filesize
26.5MB

MD5
dd735cf27f5e3d684e3112f15f442dfc

SHA1
17efa740cdb76b6c59cc90f16b7693d7b3742785

SHA256
65cdb22633adb79b4904e3e14e843c16a3f7c13546e93679f29f0c57a195a851

SHA512
5ef3ad3e488027c9261a15f167aded8ce45428b36b4040c4149d34a709a008a8baaa8b474f01b9a4fd5eeb9a92a5027d71560867909183a82751b7b6ae0fc944

Download Submit
memory/1784-144-0x0000000002850000-0x0000000003502000-memory.dmp

Filesize
12.7MB

Download
memory/1784-145-0x0000000002850000-0x0000000003502000-memory.dmp

Filesize
12.7MB

Download
memory/1784-146-0x0000000002850000-0x0000000003502000-memory.dmp

Filesize
12.7MB

Download