Resubmissions

25/03/2025, 05:15 UTC

250325-fxt6vs1ycx 6

12/04/2023, 01:53 UTC

230412-ca8tysae3v 7

12/04/2023, 01:41 UTC

230412-b39raagg39 7

Analysis

  • max time kernel
    132s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    12/04/2023, 01:41 UTC

General

  • Target

    a0133fc64c0bb7215aaa57c142357070d2d2f782039c3b4191786ad3fbd224cf.msi

  • Size

    2.4MB

  • MD5

    48ac303566e6f8c8f56c9472fb14d9d1

  • SHA1

    e3d9786e86f26261beb2f98fc8f3e289f2f5286b

  • SHA256

    a0133fc64c0bb7215aaa57c142357070d2d2f782039c3b4191786ad3fbd224cf

  • SHA512

    88265ee72da76523617c23c232f4fc9d3a9a9425280193216487157b378837d5cc780157e30675d2b2ef5a442050b6288bc2a9db244e9557781b33d61d7385e3

  • SSDEEP

    49152:T0uYUMV3eVougTDAFPsJ6ma8zotlmfwrgxMy+y29IAan6DrH4vLNgmUESIEjPMNs:TYUMV39hAlAfwrty04veHjPMNaG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a0133fc64c0bb7215aaa57c142357070d2d2f782039c3b4191786ad3fbd224cf.msi
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:932
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 29B6D9F5B2425349C9491831A471C033 C
      2⤵
      • Loads dropped DLL
      PID:568

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI55A0.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • C:\Users\Admin\AppData\Local\Temp\MSI57E2.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • C:\Users\Admin\AppData\Local\Temp\MSI5AC0.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • C:\Users\Admin\AppData\Local\Temp\MSI5AC0.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • C:\Users\Admin\AppData\Local\Temp\MSI5B5D.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • C:\Users\Admin\AppData\Local\Temp\MSI5CB5.tmp

    Filesize

    837KB

    MD5

    e76f80f8c9a51813813c351e35bf0755

    SHA1

    ec69253f3fd681d2829d60f3a14a48c779fabbb4

    SHA256

    87388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161

    SHA512

    134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5

  • \Users\Admin\AppData\Local\Temp\MSI55A0.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • \Users\Admin\AppData\Local\Temp\MSI57E2.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • \Users\Admin\AppData\Local\Temp\MSI5AC0.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • \Users\Admin\AppData\Local\Temp\MSI5B5D.tmp

    Filesize

    377KB

    MD5

    af61221c6f4e9ab3ac2440b25d751868

    SHA1

    094f68ff354ac4c8dbdfe4689cb821f8d25880b8

    SHA256

    1e587d8593152b2538da7bdcb13880c45d256e84baa7e94c00ec4de08ab018d8

    SHA512

    c695d101c761812c1805d8ee54b8fed73869d3680372368ec3de90dc25ab1c27aa08f771dc274854ba051e0afeb17827c01b17e2bed33cb87ff0bdc884f6b791

  • \Users\Admin\AppData\Local\Temp\MSI5CB5.tmp

    Filesize

    837KB

    MD5

    e76f80f8c9a51813813c351e35bf0755

    SHA1

    ec69253f3fd681d2829d60f3a14a48c779fabbb4

    SHA256

    87388281ef2eb907b4ad843c8bc0e3ec13dae903edfe53b29f78557588eb5161

    SHA512

    134a7be4012dc52763e5ac28eed7ce8e423a913f17449a672ce9f1192e69e5e00c62bce1f0374f76443832345eded1668f28fb9fbe7d287fc51dfdc199911dc5

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.