59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983

General

Target

3CXDesktopApp-18.12.416.msi
Size

97.8MB
MD5

0eeb1c0133eb4d571178b2d9d14ce3e9
SHA1

bfecb8ce89a312d2ef4afc64a63847ae11c6f69e
SHA256

59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
SHA512

85923f35da3638c9aefa152a0a6b7e8f2b8ec6aa6791b4d4a758c8899d04be25fb480253a9fbf27d9c108c6635347af2705d97d962faea497a6649f8b63ec2fc
SSDEEP

3145728:Ujlq80AfkRGgGGo4yrtD1PQLzth2TBcMa8uGj2A:8lqmijypD1YPthSkS

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exe

flow pid process

3 1700 msiexec.exe
5 1700 msiexec.exe
7 1700 msiexec.exe
9 1700 msiexec.exe
11 1700 msiexec.exe

flow	pid	process
3	1700	msiexec.exe
5	1700	msiexec.exe
7	1700	msiexec.exe
9	1700	msiexec.exe
11	1700	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

1700 msiexec.exe

pid	process
1700	msiexec.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1700	msiexec.exe
Token: SeRestorePrivilege	1012	msiexec.exe
Token: SeTakeOwnershipPrivilege	1012	msiexec.exe
Token: SeSecurityPrivilege	1012	msiexec.exe
Token: SeCreateTokenPrivilege	1700	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1700	msiexec.exe
Token: SeLockMemoryPrivilege	1700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1700	msiexec.exe
Token: SeMachineAccountPrivilege	1700	msiexec.exe
Token: SeTcbPrivilege	1700	msiexec.exe
Token: SeSecurityPrivilege	1700	msiexec.exe
Token: SeTakeOwnershipPrivilege	1700	msiexec.exe
Token: SeLoadDriverPrivilege	1700	msiexec.exe
Token: SeSystemProfilePrivilege	1700	msiexec.exe
Token: SeSystemtimePrivilege	1700	msiexec.exe
Token: SeProfSingleProcessPrivilege	1700	msiexec.exe
Token: SeIncBasePriorityPrivilege	1700	msiexec.exe
Token: SeCreatePagefilePrivilege	1700	msiexec.exe
Token: SeCreatePermanentPrivilege	1700	msiexec.exe
Token: SeBackupPrivilege	1700	msiexec.exe
Token: SeRestorePrivilege	1700	msiexec.exe
Token: SeShutdownPrivilege	1700	msiexec.exe
Token: SeDebugPrivilege	1700	msiexec.exe
Token: SeAuditPrivilege	1700	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1700	msiexec.exe
Token: SeChangeNotifyPrivilege	1700	msiexec.exe
Token: SeRemoteShutdownPrivilege	1700	msiexec.exe
Token: SeUndockPrivilege	1700	msiexec.exe
Token: SeSyncAgentPrivilege	1700	msiexec.exe
Token: SeEnableDelegationPrivilege	1700	msiexec.exe
Token: SeManageVolumePrivilege	1700	msiexec.exe
Token: SeImpersonatePrivilege	1700	msiexec.exe
Token: SeCreateGlobalPrivilege	1700	msiexec.exe
Token: SeBackupPrivilege	1096	vssvc.exe
Token: SeRestorePrivilege	1096	vssvc.exe
Token: SeAuditPrivilege	1096	vssvc.exe
Token: SeBackupPrivilege	1012	msiexec.exe
Token: SeRestorePrivilege	1012	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1700 msiexec.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
1700	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3CXDesktopApp-18.12.416.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1096

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5831.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6426.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69C9.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit

Analysis

Sharing