Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2023, 05:52
Behavioral task
behavioral1
Sample
1684595269.msi
Resource
win7-20230220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
1684595269.msi
Resource
win10v2004-20230220-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
1684595269.msi
-
Size
156KB
-
MD5
105cc98da1b269d77db92e6998462cc8
-
SHA1
e7892f87d61ba1d366998035eb87133f6ae7b31c
-
SHA256
8be9351da65a0f148748811354cce67b7e47e6be9605979c05ec686e6a8a8462
-
SHA512
da3a4438addbb91a7379a632058d3d9df0a32cdcdef8a098847562397d1adeb45c6d76616be18dfe89a7bd32656e113847239e487e80060c3159605eabd47b9c
-
SSDEEP
384:iHpe4ZvJXK7gzFM7Wu8agcjEoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyuKDCUyWMDC
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
101.42.247.160:12311
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 1 IoCs
pid Process 1184 MSIBD59.tmp -
Loads dropped DLL 2 IoCs
pid Process 324 msiexec.exe 324 msiexec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\6cba8a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBD59.tmp msiexec.exe File opened for modification C:\Windows\Installer\6cba8b.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\6cba8a.msi msiexec.exe File created C:\Windows\Installer\6cba8b.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBD09.tmp msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 324 msiexec.exe 324 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 2036 msiexec.exe Token: SeIncreaseQuotaPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe Token: SeSecurityPrivilege 324 msiexec.exe Token: SeCreateTokenPrivilege 2036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2036 msiexec.exe Token: SeLockMemoryPrivilege 2036 msiexec.exe Token: SeIncreaseQuotaPrivilege 2036 msiexec.exe Token: SeMachineAccountPrivilege 2036 msiexec.exe Token: SeTcbPrivilege 2036 msiexec.exe Token: SeSecurityPrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeLoadDriverPrivilege 2036 msiexec.exe Token: SeSystemProfilePrivilege 2036 msiexec.exe Token: SeSystemtimePrivilege 2036 msiexec.exe Token: SeProfSingleProcessPrivilege 2036 msiexec.exe Token: SeIncBasePriorityPrivilege 2036 msiexec.exe Token: SeCreatePagefilePrivilege 2036 msiexec.exe Token: SeCreatePermanentPrivilege 2036 msiexec.exe Token: SeBackupPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeShutdownPrivilege 2036 msiexec.exe Token: SeDebugPrivilege 2036 msiexec.exe Token: SeAuditPrivilege 2036 msiexec.exe Token: SeSystemEnvironmentPrivilege 2036 msiexec.exe Token: SeChangeNotifyPrivilege 2036 msiexec.exe Token: SeRemoteShutdownPrivilege 2036 msiexec.exe Token: SeUndockPrivilege 2036 msiexec.exe Token: SeSyncAgentPrivilege 2036 msiexec.exe Token: SeEnableDelegationPrivilege 2036 msiexec.exe Token: SeManageVolumePrivilege 2036 msiexec.exe Token: SeImpersonatePrivilege 2036 msiexec.exe Token: SeCreateGlobalPrivilege 2036 msiexec.exe Token: SeBackupPrivilege 276 vssvc.exe Token: SeRestorePrivilege 276 vssvc.exe Token: SeAuditPrivilege 276 vssvc.exe Token: SeBackupPrivilege 324 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeRestorePrivilege 996 DrvInst.exe Token: SeLoadDriverPrivilege 996 DrvInst.exe Token: SeLoadDriverPrivilege 996 DrvInst.exe Token: SeLoadDriverPrivilege 996 DrvInst.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe Token: SeRestorePrivilege 324 msiexec.exe Token: SeTakeOwnershipPrivilege 324 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2036 msiexec.exe 2036 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 324 wrote to memory of 1184 324 msiexec.exe 31 PID 324 wrote to memory of 1184 324 msiexec.exe 31 PID 324 wrote to memory of 1184 324 msiexec.exe 31 PID 324 wrote to memory of 1052 324 msiexec.exe 32 PID 324 wrote to memory of 1052 324 msiexec.exe 32 PID 324 wrote to memory of 1052 324 msiexec.exe 32 PID 324 wrote to memory of 1052 324 msiexec.exe 32 PID 324 wrote to memory of 1052 324 msiexec.exe 32 PID 324 wrote to memory of 1052 324 msiexec.exe 32 PID 324 wrote to memory of 1052 324 msiexec.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1684595269.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\Installer\MSIBD59.tmp"C:\Windows\Installer\MSIBD59.tmp"2⤵
- Executes dropped EXE
PID:1184
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 05240EB7D4DC7DDD54DF53DBFCDE49C22⤵PID:1052
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:276
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000240" "0000000000000070"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:996
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5c0e50a22512e8e7e2e26e4eed8bfbd70
SHA149b34feb689d70cad2b355b97378d27a36469e92
SHA256489f07f66743893e0cd689205c08a1d4d18af0f0c830ae0746fc3ebfe769c944
SHA512bf33bc57a7d62124f66cc89a7dadbe2c71c9f9f89987ec0a946dfa6c59448ee73b14adca0cc75d7738d8df82db16e144e8e0ed02699f98e6091c714da4cc7609
-
Filesize
124KB
MD5c0e50a22512e8e7e2e26e4eed8bfbd70
SHA149b34feb689d70cad2b355b97378d27a36469e92
SHA256489f07f66743893e0cd689205c08a1d4d18af0f0c830ae0746fc3ebfe769c944
SHA512bf33bc57a7d62124f66cc89a7dadbe2c71c9f9f89987ec0a946dfa6c59448ee73b14adca0cc75d7738d8df82db16e144e8e0ed02699f98e6091c714da4cc7609
-
Filesize
124KB
MD5c0e50a22512e8e7e2e26e4eed8bfbd70
SHA149b34feb689d70cad2b355b97378d27a36469e92
SHA256489f07f66743893e0cd689205c08a1d4d18af0f0c830ae0746fc3ebfe769c944
SHA512bf33bc57a7d62124f66cc89a7dadbe2c71c9f9f89987ec0a946dfa6c59448ee73b14adca0cc75d7738d8df82db16e144e8e0ed02699f98e6091c714da4cc7609
-
Filesize
124KB
MD5c0e50a22512e8e7e2e26e4eed8bfbd70
SHA149b34feb689d70cad2b355b97378d27a36469e92
SHA256489f07f66743893e0cd689205c08a1d4d18af0f0c830ae0746fc3ebfe769c944
SHA512bf33bc57a7d62124f66cc89a7dadbe2c71c9f9f89987ec0a946dfa6c59448ee73b14adca0cc75d7738d8df82db16e144e8e0ed02699f98e6091c714da4cc7609