f1bc851839b4594f427c77340a1e388c651ff348ff1d08113cd45c4fcb4a6c38

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2023 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChatGPT4.msi
Size

11.9MB
MD5

92f954169c385e6e503a0ea9be64ddb6
SHA1

b4047a248aa27233c32bb06a7552072639055c15
SHA256

f1bc851839b4594f427c77340a1e388c651ff348ff1d08113cd45c4fcb4a6c38
SHA512

e2df7aa056137f60d1eea80efd29db9c126201f9fb256ac9871c6026b9e18dc85a3d5f5edc48a51eb970f0d967e7144df8a9a2250895dc779e5007d5db993d2c
SSDEEP

196608:MVlkttiDUZD0rBLaDoLirUoUG0zGEAP1LI5YC84ciHbqan8SooneY55f2Ad6T6OM:ykOYl0coGrUoUhCEAtuYSp8SoM5f2A8b

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4224	MsiExec.exe
4224	MsiExec.exe
4224	MsiExec.exe
4224	MsiExec.exe
4224	MsiExec.exe
4224	MsiExec.exe
4224	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2932	msiexec.exe
Token: SeSecurityPrivilege	908	msiexec.exe
Token: SeCreateTokenPrivilege	2932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2932	msiexec.exe
Token: SeLockMemoryPrivilege	2932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2932	msiexec.exe
Token: SeMachineAccountPrivilege	2932	msiexec.exe
Token: SeTcbPrivilege	2932	msiexec.exe
Token: SeSecurityPrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeLoadDriverPrivilege	2932	msiexec.exe
Token: SeSystemProfilePrivilege	2932	msiexec.exe
Token: SeSystemtimePrivilege	2932	msiexec.exe
Token: SeProfSingleProcessPrivilege	2932	msiexec.exe
Token: SeIncBasePriorityPrivilege	2932	msiexec.exe
Token: SeCreatePagefilePrivilege	2932	msiexec.exe
Token: SeCreatePermanentPrivilege	2932	msiexec.exe
Token: SeBackupPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeShutdownPrivilege	2932	msiexec.exe
Token: SeDebugPrivilege	2932	msiexec.exe
Token: SeAuditPrivilege	2932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2932	msiexec.exe
Token: SeChangeNotifyPrivilege	2932	msiexec.exe
Token: SeRemoteShutdownPrivilege	2932	msiexec.exe
Token: SeUndockPrivilege	2932	msiexec.exe
Token: SeSyncAgentPrivilege	2932	msiexec.exe
Token: SeEnableDelegationPrivilege	2932	msiexec.exe
Token: SeManageVolumePrivilege	2932	msiexec.exe
Token: SeImpersonatePrivilege	2932	msiexec.exe
Token: SeCreateGlobalPrivilege	2932	msiexec.exe
Token: SeCreateTokenPrivilege	2932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2932	msiexec.exe
Token: SeLockMemoryPrivilege	2932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2932	msiexec.exe
Token: SeMachineAccountPrivilege	2932	msiexec.exe
Token: SeTcbPrivilege	2932	msiexec.exe
Token: SeSecurityPrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeLoadDriverPrivilege	2932	msiexec.exe
Token: SeSystemProfilePrivilege	2932	msiexec.exe
Token: SeSystemtimePrivilege	2932	msiexec.exe
Token: SeProfSingleProcessPrivilege	2932	msiexec.exe
Token: SeIncBasePriorityPrivilege	2932	msiexec.exe
Token: SeCreatePagefilePrivilege	2932	msiexec.exe
Token: SeCreatePermanentPrivilege	2932	msiexec.exe
Token: SeBackupPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeShutdownPrivilege	2932	msiexec.exe
Token: SeDebugPrivilege	2932	msiexec.exe
Token: SeAuditPrivilege	2932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2932	msiexec.exe
Token: SeChangeNotifyPrivilege	2932	msiexec.exe
Token: SeRemoteShutdownPrivilege	2932	msiexec.exe
Token: SeUndockPrivilege	2932	msiexec.exe
Token: SeSyncAgentPrivilege	2932	msiexec.exe
Token: SeEnableDelegationPrivilege	2932	msiexec.exe
Token: SeManageVolumePrivilege	2932	msiexec.exe
Token: SeImpersonatePrivilege	2932	msiexec.exe
Token: SeCreateGlobalPrivilege	2932	msiexec.exe
Token: SeCreateTokenPrivilege	2932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2932	msiexec.exe
Token: SeLockMemoryPrivilege	2932	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4224	908	msiexec.exe	86
PID 908 wrote to memory of 4224	908	msiexec.exe	86
PID 908 wrote to memory of 4224	908	msiexec.exe	86

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ChatGPT4.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2E9CE10215272F96CFBBA95A7A42910 C
  2⤵
  - Loads dropped DLL
  PID:4224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI6BDE.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6BDE.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6DF2.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6DF2.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6EED.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6EED.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6EED.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6F8A.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6F8A.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6FDA.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6FDA.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI70F4.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI70F4.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7133.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7133.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit