1cf42260b929a471ee2f15c2a949c9192a76324f832dd71308114bd8f23a43d5

Analysis

max time kernel
135s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2023 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File_ Tower_of_Guns_v1_3c_zip ___.msi
Size

145.7MB
MD5

d8d9d5a218acb598f92ab9685d1c5344
SHA1

c94de4f5f9f35d26a19534e766255e947bce2f0d
SHA256

1cf42260b929a471ee2f15c2a949c9192a76324f832dd71308114bd8f23a43d5
SHA512

21948b3915440ef3eeee548baf2b19557826580bb92fe56413e1726fb10b3dbc23e77e35440a01d3159e5c290b8e004ebb0d4c411446bb975ec798e7b3e89d38
SSDEEP

3145728:FkFpQJ/dwFcJTTuWQvCH5lX/zqb4ubILxAHUCMS/pKkWNT:FMpQJwcFKylvzsYxopKkW

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	4656	msiexec.exe
4	4656	msiexec.exe
6	4656	msiexec.exe

Loads dropped DLL 9 IoCs

pid	Process
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4656	msiexec.exe
Token: SeSecurityPrivilege	4132	msiexec.exe
Token: SeCreateTokenPrivilege	4656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4656	msiexec.exe
Token: SeLockMemoryPrivilege	4656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4656	msiexec.exe
Token: SeMachineAccountPrivilege	4656	msiexec.exe
Token: SeTcbPrivilege	4656	msiexec.exe
Token: SeSecurityPrivilege	4656	msiexec.exe
Token: SeTakeOwnershipPrivilege	4656	msiexec.exe
Token: SeLoadDriverPrivilege	4656	msiexec.exe
Token: SeSystemProfilePrivilege	4656	msiexec.exe
Token: SeSystemtimePrivilege	4656	msiexec.exe
Token: SeProfSingleProcessPrivilege	4656	msiexec.exe
Token: SeIncBasePriorityPrivilege	4656	msiexec.exe
Token: SeCreatePagefilePrivilege	4656	msiexec.exe
Token: SeCreatePermanentPrivilege	4656	msiexec.exe
Token: SeBackupPrivilege	4656	msiexec.exe
Token: SeRestorePrivilege	4656	msiexec.exe
Token: SeShutdownPrivilege	4656	msiexec.exe
Token: SeDebugPrivilege	4656	msiexec.exe
Token: SeAuditPrivilege	4656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4656	msiexec.exe
Token: SeChangeNotifyPrivilege	4656	msiexec.exe
Token: SeRemoteShutdownPrivilege	4656	msiexec.exe
Token: SeUndockPrivilege	4656	msiexec.exe
Token: SeSyncAgentPrivilege	4656	msiexec.exe
Token: SeEnableDelegationPrivilege	4656	msiexec.exe
Token: SeManageVolumePrivilege	4656	msiexec.exe
Token: SeImpersonatePrivilege	4656	msiexec.exe
Token: SeCreateGlobalPrivilege	4656	msiexec.exe
Token: SeCreateTokenPrivilege	4656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4656	msiexec.exe
Token: SeLockMemoryPrivilege	4656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4656	msiexec.exe
Token: SeMachineAccountPrivilege	4656	msiexec.exe
Token: SeTcbPrivilege	4656	msiexec.exe
Token: SeSecurityPrivilege	4656	msiexec.exe
Token: SeTakeOwnershipPrivilege	4656	msiexec.exe
Token: SeLoadDriverPrivilege	4656	msiexec.exe
Token: SeSystemProfilePrivilege	4656	msiexec.exe
Token: SeSystemtimePrivilege	4656	msiexec.exe
Token: SeProfSingleProcessPrivilege	4656	msiexec.exe
Token: SeIncBasePriorityPrivilege	4656	msiexec.exe
Token: SeCreatePagefilePrivilege	4656	msiexec.exe
Token: SeCreatePermanentPrivilege	4656	msiexec.exe
Token: SeBackupPrivilege	4656	msiexec.exe
Token: SeRestorePrivilege	4656	msiexec.exe
Token: SeShutdownPrivilege	4656	msiexec.exe
Token: SeDebugPrivilege	4656	msiexec.exe
Token: SeAuditPrivilege	4656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4656	msiexec.exe
Token: SeChangeNotifyPrivilege	4656	msiexec.exe
Token: SeRemoteShutdownPrivilege	4656	msiexec.exe
Token: SeUndockPrivilege	4656	msiexec.exe
Token: SeSyncAgentPrivilege	4656	msiexec.exe
Token: SeEnableDelegationPrivilege	4656	msiexec.exe
Token: SeManageVolumePrivilege	4656	msiexec.exe
Token: SeImpersonatePrivilege	4656	msiexec.exe
Token: SeCreateGlobalPrivilege	4656	msiexec.exe
Token: SeCreateTokenPrivilege	4656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4656	msiexec.exe
Token: SeLockMemoryPrivilege	4656	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4656	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2200	4132	msiexec.exe	87
PID 4132 wrote to memory of 2200	4132	msiexec.exe	87
PID 4132 wrote to memory of 2200	4132	msiexec.exe	87

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\File_ Tower_of_Guns_v1_3c_zip ___.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9803963913598F4DD7F7ACB606A954D1 C
  2⤵
  - Loads dropped DLL
  PID:2200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSIEF66.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEF66.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF6D9.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF6D9.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF94B.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF94B.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF94B.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9C9.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9C9.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9F9.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9F9.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC0D.tmp

Filesize
1.1MB

MD5
f944125ef94dbf5d539b22c8d7d6f233

SHA1
a1cd91e26e860205cf7bcaf4babdedb0d357948f

SHA256
a80f16a0b25361e40d60582c41812608df79b8f0ea6d739dc5055c153b67bc87

SHA512
9bf281d1be823c83458db6d6de36cf733863b4630a825a9f05ac2adbf917bb220752101e232fe876c7f663a9741d8e36f583955202827d345b5e0d610a8381dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC0D.tmp

Filesize
1.1MB

MD5
f944125ef94dbf5d539b22c8d7d6f233

SHA1
a1cd91e26e860205cf7bcaf4babdedb0d357948f

SHA256
a80f16a0b25361e40d60582c41812608df79b8f0ea6d739dc5055c153b67bc87

SHA512
9bf281d1be823c83458db6d6de36cf733863b4630a825a9f05ac2adbf917bb220752101e232fe876c7f663a9741d8e36f583955202827d345b5e0d610a8381dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC7C.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFC7C.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFCDA.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFCDA.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFD58.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFD58.tmp

Filesize
587KB

MD5
cadbcf6f5a0199ecc0220ce23a860d89

SHA1
073c149d68916520aea882e588ab9a5ae083d75a

SHA256
42ef18c42fe06709f3c86157e2270358f3c93d14be2e173b8fae8edcefddfca0

SHA512
cebb128bdc04e6b29df74bedcc375a340ac037563d828af3455de41f31d2e464f82f85c97ca9910a4a7c819efa906aa4a4560174f184cee316f53e3d2b5cdccc

Download Submit