Analysis
- max time kernel
135s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2023, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
ReportCreator_3.3.0-8.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ReportCreator_3.3.0-8.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target ReportCreator_3.3.0-8.exe
- Size 22.5MB
- Sample230614-rez5yaaa7v
- SHA256 f2777b0bc561504e56811f97822bbda9da1a0d4602f1f1e2cf8a68bdaf52420f
- MD5 995c47d1e141c0cfd3f539907a524594
- SHA1 b2930fea89c9dedc305852984ce5069062c10c50
- SHA512 f8a022fd2c85deecd596281bbb7f707d1bd262c557e473f09a69de17ea4462afbafdbd7ee1fbbc5de3781477aa3ec613442a85076e83a8c76240febc0f135fbc
- SSDEEP 393216:AjbPS+QSNYpr/GzlvzbtWlxRmEV57eOIz2wuyF2VLTZl13U++L4t:AfGT/GzlftWlxRpOSryA/r13U+Zt
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 5 3392 MSIEXEC.EXE 7 3392 MSIEXEC.EXE 10 3392 MSIEXEC.EXE - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\F: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfc110enu.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110fra.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110jpn.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110kor.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfcm110u.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\vccorlib110.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110chs.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110deu.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110ita.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\msvcr110.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\msvcp110.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110cht.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110esn.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfcm110.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110rus.dll MSIEXEC.EXE File opened for modification C:\Windows\SysWOW64\mfc110u.dll MSIEXEC.EXE - Loads dropped DLL 1 IoCs
pid Process 1636 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3392 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 3392 MSIEXEC.EXE Token: SeSecurityPrivilege 228 msiexec.exe Token: SeCreateTokenPrivilege 3392 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 3392 MSIEXEC.EXE Token: SeLockMemoryPrivilege 3392 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 3392 MSIEXEC.EXE Token: SeMachineAccountPrivilege 3392 MSIEXEC.EXE Token: SeTcbPrivilege 3392 MSIEXEC.EXE Token: SeSecurityPrivilege 3392 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 3392 MSIEXEC.EXE Token: SeLoadDriverPrivilege 3392 MSIEXEC.EXE Token: SeSystemProfilePrivilege 3392 MSIEXEC.EXE Token: SeSystemtimePrivilege 3392 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 3392 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 3392 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 3392 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 3392 MSIEXEC.EXE Token: SeBackupPrivilege 3392 MSIEXEC.EXE Token: SeRestorePrivilege 3392 MSIEXEC.EXE Token: SeShutdownPrivilege 3392 MSIEXEC.EXE Token: SeDebugPrivilege 3392 MSIEXEC.EXE Token: SeAuditPrivilege 3392 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 3392 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 3392 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 3392 MSIEXEC.EXE Token: SeUndockPrivilege 3392 MSIEXEC.EXE Token: SeSyncAgentPrivilege 3392 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 3392 MSIEXEC.EXE Token: SeManageVolumePrivilege 3392 MSIEXEC.EXE Token: SeImpersonatePrivilege 3392 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 3392 MSIEXEC.EXE Token: SeCreateTokenPrivilege 3392 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 3392 MSIEXEC.EXE Token: SeLockMemoryPrivilege 3392 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 3392 MSIEXEC.EXE Token: SeMachineAccountPrivilege 3392 MSIEXEC.EXE Token: SeTcbPrivilege 3392 MSIEXEC.EXE Token: SeSecurityPrivilege 3392 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 3392 MSIEXEC.EXE Token: SeLoadDriverPrivilege 3392 MSIEXEC.EXE Token: SeSystemProfilePrivilege 3392 MSIEXEC.EXE Token: SeSystemtimePrivilege 3392 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 3392 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 3392 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 3392 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 3392 MSIEXEC.EXE Token: SeBackupPrivilege 3392 MSIEXEC.EXE Token: SeRestorePrivilege 3392 MSIEXEC.EXE Token: SeShutdownPrivilege 3392 MSIEXEC.EXE Token: SeDebugPrivilege 3392 MSIEXEC.EXE Token: SeAuditPrivilege 3392 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 3392 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 3392 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 3392 MSIEXEC.EXE Token: SeUndockPrivilege 3392 MSIEXEC.EXE Token: SeSyncAgentPrivilege 3392 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 3392 MSIEXEC.EXE Token: SeManageVolumePrivilege 3392 MSIEXEC.EXE Token: SeImpersonatePrivilege 3392 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 3392 MSIEXEC.EXE Token: SeCreateTokenPrivilege 3392 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 3392 MSIEXEC.EXE Token: SeLockMemoryPrivilege 3392 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3392 MSIEXEC.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3116 wrote to memory of 3392 3116 ReportCreator_3.3.0-8.exe 83 PID 3116 wrote to memory of 3392 3116 ReportCreator_3.3.0-8.exe 83 PID 3116 wrote to memory of 3392 3116 ReportCreator_3.3.0-8.exe 83 PID 228 wrote to memory of 1636 228 msiexec.exe 86 PID 228 wrote to memory of 1636 228 msiexec.exe 86 PID 228 wrote to memory of 1636 228 msiexec.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReportCreator_3.3.0-8.exe"C:\Users\Admin\AppData\Local\Temp\ReportCreator_3.3.0-8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{6284263D-1297-443E-859A-74949CCB7680}\Barracuda NG Report Creator.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="ReportCreator_3.3.0-8.exe"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3392
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 92E2900B20647705E4ADC8C855C5E7B7 C2⤵
- Loads dropped DLL
PID:1636
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIB3F3.tmp
- Size 153KB
- SHA256 7ee4d2137a9336aa6d137f3a7cc4f94ce0fbf2facac01901e57fc3fd94c36239
- MD5 ecbc19c2eb3da66c6fa30a915cb62e35
- SHA1 b9a415c2bbae73a42a885a5fdb58d17280e0a058
- SHA512 603715f6409211c6d1f7e73f6ff0893fb22185dce2a990c47e9d450626bc15ee1dd26b820dedbe6b7bc1b6bffb358cfb9c55e54882cfceae254edad3d43fbaa7
- SSDEEP 1536:I5evr0fQtkUlPeG+U+n4PtjrqzN/cWJQaqYAJmmD+e7cKsWjcdlsKcLP8q6W9Eic:wevrFt0KyqmDqFJr+egmKcLPhNtc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB3F3.tmp
- Size 153KB
- SHA256 7ee4d2137a9336aa6d137f3a7cc4f94ce0fbf2facac01901e57fc3fd94c36239
- MD5 ecbc19c2eb3da66c6fa30a915cb62e35
- SHA1 b9a415c2bbae73a42a885a5fdb58d17280e0a058
- SHA512 603715f6409211c6d1f7e73f6ff0893fb22185dce2a990c47e9d450626bc15ee1dd26b820dedbe6b7bc1b6bffb358cfb9c55e54882cfceae254edad3d43fbaa7
- SSDEEP 1536:I5evr0fQtkUlPeG+U+n4PtjrqzN/cWJQaqYAJmmD+e7cKsWjcdlsKcLP8q6W9Eic:wevrFt0KyqmDqFJr+egmKcLPhNtc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{6284263D-1297-443E-859A-74949CCB7680}\0x0409.ini
- Size 21KB
- SHA256 089d3068e42958dd2c0aec668e5b7e57b7584aca5c77132b1bcbe3a1da33ef54
- MD5 8586214463bd73e1c2716113e5bd3e13
- SHA1 f02e3a76fd177964a846d4aa0a23f738178db2be
- SHA512 309200f38d0e29c9aaa99bb6d95f4347f8a8c320eb65742e7c539246ad9b759608bd5151d1c5d1d05888979daa38f2b6c3bf492588b212b583b8adbe81fa161b
- SSDEEP 384:CTmyuV//BiTbh/Y4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/N/lWr0aa0Mhs+XVgv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{6284263D-1297-443E-859A-74949CCB7680}\Barracuda NG Report Creator.msi
- Size 22.8MB
- SHA256 21c291b4c933570d16234c150c399cb071ed2b6e05bfae53aa9a1d0c5bf2c1e2
- MD5 fee9498dffe2e726847de88c625ed269
- SHA1 7fbad0b632e152851d72998cd1a0d1cc6182a02e
- SHA512 beab2b920ae9fe0cdbe4816c84846fef1bb507fa030ef1fd45cdcbcb895726aae0c4614389ab952d6e49718803a921b1b8fb2e007040867e8d10ed90e746a04b
- SSDEEP 393216:jbm4lmgI6gR3VKNPfbKanevA24Rw4ccFi6FnsRJXxq3h4u2xHTMaHrZmISDBYEtR:Hm4cgInR3VQXdP2Z6tcXx0WF9mHDB7tE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~8FA2.tmp
- Size 5KB
- SHA256 ca99495025c6faed38bf5842924434a8dee22e9758843b0b5d1bb5f8a2c63876
- MD5 c38a843a8db045b866d3c50269ad3e09
- SHA1 88c1cc102b9326be248d5110b9f6339375d73ddf
- SHA512 b97c33bebb79a2cdc808b3f13ce824816790e23a175f053671354ae83397093f0c10e7dd2b4c39aa7e5ef372c92e104d47a48a84f4332cb2ab2fc6d04946d4ce
- SSDEEP 96:rEhkMaElVfGR98ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnAn:YhckKcuQaEZhdxoIWRGcQbPr/p0050tH
- MD5 SHA1 SHA512 SSDEEP