Analysis

  • max time kernel
    8s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-04-2023 17:52

General

  • Target

    krisp-v1.21.1-x64.msi

  • Size

    70MB

  • MD5

    e2d02c2d0d744411a0a6e2935dea4f84

  • SHA1

    fba0fcd0cff2c4ceda85c87ef2458558c8754401

  • SHA256

    10cba83ef3cbfdc6636647c9fe1c273ffd7e833cd88b93f9c9666e8449764a36

  • SHA512

    99681131e3cebee6416c4e08cbf766f36d8560a2c47eb160d4bdb6394bd038da9f58a2546f866d4a61c42423e08922e6ef1b432981f0f1d3f2d6931b9b926ae9

  • SSDEEP

    1572864:5bT5TAvyIckmyh4kzaYBqYeTPpCQiyjTtSEOWfd9rdnYjNxYfw8A:5bTtCaEaYBaPiCrOAFYjrYfw

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\krisp-v1.21.1-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1444
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 53FC033C71DBA4A0C2AAB6524E5E310E C
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4C28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7097671 1 InstallerHelper!InstallerHelper.CustomActions.GetOSVersion
        3⤵
        • Loads dropped DLL
        PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    61KB

    MD5

    e71c8443ae0bc2e282c73faead0a6dd3

    SHA1

    0c110c1b01e68edfacaeae64781a37b1995fa94b

    SHA256

    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

    SHA512

    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

  • C:\Users\Admin\AppData\Local\Temp\MSI4C28.tmp
    Filesize

    617KB

    MD5

    6985489e7d7d224e6d2cabc8c9cf71c0

    SHA1

    bcfc8b2eba0402f0d0913c362d192096aae71483

    SHA256

    a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

    SHA512

    ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

  • C:\Users\Admin\AppData\Local\Temp\Tar49C5.tmp
    Filesize

    161KB

    MD5

    be2bec6e8c5653136d3e72fe53c98aa3

    SHA1

    a8182d6db17c14671c3d5766c72e58d87c0810de

    SHA256

    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

    SHA512

    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

  • \Users\Admin\AppData\Local\Temp\MSI4C28.tmp
    Filesize

    617KB

    MD5

    6985489e7d7d224e6d2cabc8c9cf71c0

    SHA1

    bcfc8b2eba0402f0d0913c362d192096aae71483

    SHA256

    a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

    SHA512

    ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

  • \Users\Admin\AppData\Local\Temp\MSI4C28.tmp
    Filesize

    617KB

    MD5

    6985489e7d7d224e6d2cabc8c9cf71c0

    SHA1

    bcfc8b2eba0402f0d0913c362d192096aae71483

    SHA256

    a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

    SHA512

    ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

  • \Users\Admin\AppData\Local\Temp\MSI4C28.tmp-\InstallerHelper.dll
    Filesize

    177KB

    MD5

    bab22511f48c61e6221044455297d7a6

    SHA1

    d57fe2e104c4b269b85880449e9217bde8a47b23

    SHA256

    7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

    SHA512

    4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

  • \Users\Admin\AppData\Local\Temp\MSI4C28.tmp-\InstallerHelper.dll
    Filesize

    177KB

    MD5

    bab22511f48c61e6221044455297d7a6

    SHA1

    d57fe2e104c4b269b85880449e9217bde8a47b23

    SHA256

    7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

    SHA512

    4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

  • memory/1684-125-0x0000000001BE0000-0x0000000001C0E000-memory.dmp
    Filesize

    184KB

  • memory/1684-129-0x0000000001C10000-0x0000000001C40000-memory.dmp
    Filesize

    192KB

  • memory/1684-138-0x000000001AA80000-0x000000001AB00000-memory.dmp
    Filesize

    512KB