e078ae412412d6073a0426e617238b805ede3bb0684ddafa6e16ca9ab7e1560a

Analysis

max time kernel
51s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

m.msi
Size

5.7MB
MD5

23296eae22bcccc460bd2df322896692
SHA1

46c2661130427524c89c0ae94d4727f34f970389
SHA256

e078ae412412d6073a0426e617238b805ede3bb0684ddafa6e16ca9ab7e1560a
SHA512

20e56ced938d5b45f675b151c2d8d2a2de4e975537b96d4df8a8d04c0ccf0fb988f63ae6b2aaa33395e76c911acf00abb548c924ca5bc4418b62b417af2c1fc2
SSDEEP

98304:bYYtMbGawFCoAJPkUfickYc8E6W6U8wLJIPKxsyZKF6KNVWblNg4+gVdNeA:z2Gaj1eYcX8wLwKxsyZKoKNVWRhVd

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
4	2020	MsiExec.exe
6	2020	MsiExec.exe
8	2020	MsiExec.exe
10	2020	MsiExec.exe
12	2020	MsiExec.exe
13	2020	MsiExec.exe

Loads dropped DLL 4 IoCs

pid	Process
2020	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
4	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2020	MsiExec.exe
2020	MsiExec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\6c7955.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7ABC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DBA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI849F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8431.tmp	msiexec.exe
File created	C:\Windows\Installer\6c7955.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E95.tmp	msiexec.exe
File created	C:\Windows\Installer\6c7957.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1608	msiexec.exe
1608	msiexec.exe
2020	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1048	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeSecurityPrivilege	1608	msiexec.exe
Token: SeCreateTokenPrivilege	1048	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1048	msiexec.exe
Token: SeLockMemoryPrivilege	1048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1048	msiexec.exe
Token: SeMachineAccountPrivilege	1048	msiexec.exe
Token: SeTcbPrivilege	1048	msiexec.exe
Token: SeSecurityPrivilege	1048	msiexec.exe
Token: SeTakeOwnershipPrivilege	1048	msiexec.exe
Token: SeLoadDriverPrivilege	1048	msiexec.exe
Token: SeSystemProfilePrivilege	1048	msiexec.exe
Token: SeSystemtimePrivilege	1048	msiexec.exe
Token: SeProfSingleProcessPrivilege	1048	msiexec.exe
Token: SeIncBasePriorityPrivilege	1048	msiexec.exe
Token: SeCreatePagefilePrivilege	1048	msiexec.exe
Token: SeCreatePermanentPrivilege	1048	msiexec.exe
Token: SeBackupPrivilege	1048	msiexec.exe
Token: SeRestorePrivilege	1048	msiexec.exe
Token: SeShutdownPrivilege	1048	msiexec.exe
Token: SeDebugPrivilege	1048	msiexec.exe
Token: SeAuditPrivilege	1048	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1048	msiexec.exe
Token: SeChangeNotifyPrivilege	1048	msiexec.exe
Token: SeRemoteShutdownPrivilege	1048	msiexec.exe
Token: SeUndockPrivilege	1048	msiexec.exe
Token: SeSyncAgentPrivilege	1048	msiexec.exe
Token: SeEnableDelegationPrivilege	1048	msiexec.exe
Token: SeManageVolumePrivilege	1048	msiexec.exe
Token: SeImpersonatePrivilege	1048	msiexec.exe
Token: SeCreateGlobalPrivilege	1048	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1048	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27
PID 1608 wrote to memory of 2020	1608	msiexec.exe	27

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\m.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8685518927A1FC593C32DA18ADC0DDC4
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC22A.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Windows\Installer\MSI7ABC.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
C:\Windows\Installer\MSI7DBA.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
C:\Windows\Installer\MSI7E95.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
C:\Windows\Installer\MSI7E95.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
C:\Windows\Installer\MSI849F.tmp

Filesize
5.1MB

MD5
88f0fffaf1700a427d899ea23eb5d638

SHA1
97ba5c7fe70f9ab72bd4d3bfdb85d931ebf2174c

SHA256
6ea7c03dd6ad9018d6add91d2fd06e2177731bd0e50c32398ade434c76fd1ca9

SHA512
77e0d3501a2dfc2956ae6c3b48efa191895b145bd5a48c07bed3f57cd409de48b5dfa96b79d5569c441f0d50ef61477360ec14adddf1730ca54ab48d76af275a

Download Submit
\Windows\Installer\MSI7ABC.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
\Windows\Installer\MSI7DBA.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
\Windows\Installer\MSI7E95.tmp

Filesize
376KB

MD5
e12c5bcc254c953b1a46d1434804f4d2

SHA1
99f67acf34af1294f3c6e5eb521c862e1c772397

SHA256
5316cfae8b4d28ab7cbc5cab60e27b0c0f5a3210a921a4b0560769c5021c911b

SHA512
9a61aa00b651fc616cd09d28f4a6b872889a026c61d818595a82c58fdff187e3ad57916c2b8690d1e7016d73a05435e13a85758917cfb89029b34c4a1685aa0b

Download Submit
\Windows\Installer\MSI849F.tmp

Filesize
5.1MB

MD5
88f0fffaf1700a427d899ea23eb5d638

SHA1
97ba5c7fe70f9ab72bd4d3bfdb85d931ebf2174c

SHA256
6ea7c03dd6ad9018d6add91d2fd06e2177731bd0e50c32398ade434c76fd1ca9

SHA512
77e0d3501a2dfc2956ae6c3b48efa191895b145bd5a48c07bed3f57cd409de48b5dfa96b79d5569c441f0d50ef61477360ec14adddf1730ca54ab48d76af275a

Download Submit
memory/2020-76-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2020-84-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2020-75-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2020-73-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2020-77-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2020-78-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2020-79-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2020-81-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2020-82-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2020-74-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2020-85-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2020-87-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2020-88-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2020-90-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2020-91-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2020-92-0x0000000002630000-0x00000000032CC000-memory.dmp

Filesize
12.6MB

Download
memory/2020-94-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2020-71-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2020-72-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2020-149-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download