Analysis
-
max time kernel
42s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14/02/2023, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
FACT63eb9.msi
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
FACT63eb9.msi
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
FACT63eb9.msi
-
Size
7.2MB
-
MD5
d5ad2aed1360f13721756a52a9a47d12
-
SHA1
c3e11b221dc4591a4e8a5634d4a66b77ff8171c9
-
SHA256
6719c4bd451f0c988e20c4e6d4773c015fd98f2882ac1342ef4d48f31bde6cfe
-
SHA512
d61a280b47910055ffed83af2f59ba4bc645c0f171c1a526259fe7d10773bdb928d32fe8a645b9e5a69d621e9583cefb1b8f5deb320facf0a911c8700475d177
-
SSDEEP
196608:s8/r1/apIF/njBNqpVjShyC5NKj/C1B3:s8/mIFvVNqp1SYkK/C
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 4 1104 MsiExec.exe 6 1104 MsiExec.exe 8 1104 MsiExec.exe 10 1104 MsiExec.exe 12 1104 MsiExec.exe 14 1104 MsiExec.exe -
Loads dropped DLL 4 IoCs
pid Process 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ipinfo.io 4 ipinfo.io -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\syswow64\LOG\MsiExec.exe.DEBUG.log MsiExec.exe File created C:\Windows\syswow64\LOG\MsiExec.exe.DEBUG.log MsiExec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\6be9c4.msi msiexec.exe File opened for modification C:\Windows\Installer\6be9c4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEC54.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF4FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA60.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEFFD.tmp msiexec.exe File created C:\Windows\Installer\6be9c6.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF4BF.tmp msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1200 msiexec.exe 1200 msiexec.exe 1104 MsiExec.exe 1104 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 1788 msiexec.exe Token: SeIncreaseQuotaPrivilege 1788 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeSecurityPrivilege 1200 msiexec.exe Token: SeCreateTokenPrivilege 1788 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1788 msiexec.exe Token: SeLockMemoryPrivilege 1788 msiexec.exe Token: SeIncreaseQuotaPrivilege 1788 msiexec.exe Token: SeMachineAccountPrivilege 1788 msiexec.exe Token: SeTcbPrivilege 1788 msiexec.exe Token: SeSecurityPrivilege 1788 msiexec.exe Token: SeTakeOwnershipPrivilege 1788 msiexec.exe Token: SeLoadDriverPrivilege 1788 msiexec.exe Token: SeSystemProfilePrivilege 1788 msiexec.exe Token: SeSystemtimePrivilege 1788 msiexec.exe Token: SeProfSingleProcessPrivilege 1788 msiexec.exe Token: SeIncBasePriorityPrivilege 1788 msiexec.exe Token: SeCreatePagefilePrivilege 1788 msiexec.exe Token: SeCreatePermanentPrivilege 1788 msiexec.exe Token: SeBackupPrivilege 1788 msiexec.exe Token: SeRestorePrivilege 1788 msiexec.exe Token: SeShutdownPrivilege 1788 msiexec.exe Token: SeDebugPrivilege 1788 msiexec.exe Token: SeAuditPrivilege 1788 msiexec.exe Token: SeSystemEnvironmentPrivilege 1788 msiexec.exe Token: SeChangeNotifyPrivilege 1788 msiexec.exe Token: SeRemoteShutdownPrivilege 1788 msiexec.exe Token: SeUndockPrivilege 1788 msiexec.exe Token: SeSyncAgentPrivilege 1788 msiexec.exe Token: SeEnableDelegationPrivilege 1788 msiexec.exe Token: SeManageVolumePrivilege 1788 msiexec.exe Token: SeImpersonatePrivilege 1788 msiexec.exe Token: SeCreateGlobalPrivilege 1788 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1788 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1200 wrote to memory of 1104 1200 msiexec.exe 29 PID 1200 wrote to memory of 1104 1200 msiexec.exe 29 PID 1200 wrote to memory of 1104 1200 msiexec.exe 29 PID 1200 wrote to memory of 1104 1200 msiexec.exe 29 PID 1200 wrote to memory of 1104 1200 msiexec.exe 29 PID 1200 wrote to memory of 1104 1200 msiexec.exe 29 PID 1200 wrote to memory of 1104 1200 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FACT63eb9.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1788
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 29535B2EDC1B47150FE9FCC712B6D4032⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
Filesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
Filesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
Filesize
6.6MB
MD5a0a67d1601a367964146dbf4851593be
SHA1498a9231266eae7cf03590d004e51a734f45ee48
SHA2562992497461eebc63e53dd484b0a22fc6d864687353bbb29a3fa876242672b5f2
SHA5126c5d42158ddbae47c5e7c800c1f3cce5b9c26fc337e69d1e6a0750314364ddea949b427bc67c1350eba1fdcb20bdbdb77a6db6ca9ba5ef0e632b0ac990e49e8a
-
Filesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
Filesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
Filesize
376KB
MD5e12c5bcc254c953b1a46d1434804f4d2
SHA199f67acf34af1294f3c6e5eb521c862e1c772397
SHA2565316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b
SHA5129a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b
-
Filesize
6.6MB
MD5a0a67d1601a367964146dbf4851593be
SHA1498a9231266eae7cf03590d004e51a734f45ee48
SHA2562992497461eebc63e53dd484b0a22fc6d864687353bbb29a3fa876242672b5f2
SHA5126c5d42158ddbae47c5e7c800c1f3cce5b9c26fc337e69d1e6a0750314364ddea949b427bc67c1350eba1fdcb20bdbdb77a6db6ca9ba5ef0e632b0ac990e49e8a