48ee92307d0bfadae16494bf164cf5044ae07471adea909357f775b624013721

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1CEnterprise 8.msi
Size

5.7MB
MD5

b09dd1c47e552111f33a2b79cc88f0a9
SHA1

5b71f76310ad26873148a7ee93b9544d9f944619
SHA256

48ee92307d0bfadae16494bf164cf5044ae07471adea909357f775b624013721
SHA512

d750dcc914500d9dc04da5a9ee627b60baf9d5e258ce96d1cdaf1bbbe7953afc4a47d6b71659dcc1ccd65b1eb6ee5e51bb09739a386270e137fe29779963ce8a
SSDEEP

98304:lykuLT7uYy171MfAOtIOpjh7InctCaFecemed4hc:lykuPSOHh72OFePd

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
6	3996	msiexec.exe
8	3996	msiexec.exe
15	3996	msiexec.exe
17	3996	msiexec.exe

Loads dropped DLL 8 IoCs

pid	Process
4032	MsiExec.exe
4032	MsiExec.exe
4032	MsiExec.exe
4032	MsiExec.exe
4032	MsiExec.exe
4032	MsiExec.exe
4032	MsiExec.exe
4032	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	1788	msiexec.exe
Token: SeCreateTokenPrivilege	3996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3996	msiexec.exe
Token: SeLockMemoryPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeMachineAccountPrivilege	3996	msiexec.exe
Token: SeTcbPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeLoadDriverPrivilege	3996	msiexec.exe
Token: SeSystemProfilePrivilege	3996	msiexec.exe
Token: SeSystemtimePrivilege	3996	msiexec.exe
Token: SeProfSingleProcessPrivilege	3996	msiexec.exe
Token: SeIncBasePriorityPrivilege	3996	msiexec.exe
Token: SeCreatePagefilePrivilege	3996	msiexec.exe
Token: SeCreatePermanentPrivilege	3996	msiexec.exe
Token: SeBackupPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeDebugPrivilege	3996	msiexec.exe
Token: SeAuditPrivilege	3996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3996	msiexec.exe
Token: SeChangeNotifyPrivilege	3996	msiexec.exe
Token: SeRemoteShutdownPrivilege	3996	msiexec.exe
Token: SeUndockPrivilege	3996	msiexec.exe
Token: SeSyncAgentPrivilege	3996	msiexec.exe
Token: SeEnableDelegationPrivilege	3996	msiexec.exe
Token: SeManageVolumePrivilege	3996	msiexec.exe
Token: SeImpersonatePrivilege	3996	msiexec.exe
Token: SeCreateGlobalPrivilege	3996	msiexec.exe
Token: SeCreateTokenPrivilege	3996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3996	msiexec.exe
Token: SeLockMemoryPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeMachineAccountPrivilege	3996	msiexec.exe
Token: SeTcbPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeLoadDriverPrivilege	3996	msiexec.exe
Token: SeSystemProfilePrivilege	3996	msiexec.exe
Token: SeSystemtimePrivilege	3996	msiexec.exe
Token: SeProfSingleProcessPrivilege	3996	msiexec.exe
Token: SeIncBasePriorityPrivilege	3996	msiexec.exe
Token: SeCreatePagefilePrivilege	3996	msiexec.exe
Token: SeCreatePermanentPrivilege	3996	msiexec.exe
Token: SeBackupPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeDebugPrivilege	3996	msiexec.exe
Token: SeAuditPrivilege	3996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3996	msiexec.exe
Token: SeChangeNotifyPrivilege	3996	msiexec.exe
Token: SeRemoteShutdownPrivilege	3996	msiexec.exe
Token: SeUndockPrivilege	3996	msiexec.exe
Token: SeSyncAgentPrivilege	3996	msiexec.exe
Token: SeEnableDelegationPrivilege	3996	msiexec.exe
Token: SeManageVolumePrivilege	3996	msiexec.exe
Token: SeImpersonatePrivilege	3996	msiexec.exe
Token: SeCreateGlobalPrivilege	3996	msiexec.exe
Token: SeCreateTokenPrivilege	3996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3996	msiexec.exe
Token: SeLockMemoryPrivilege	3996	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3996	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4032	1788	msiexec.exe	86
PID 1788 wrote to memory of 4032	1788	msiexec.exe	86
PID 1788 wrote to memory of 4032	1788	msiexec.exe	86

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\1CEnterprise 8.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C772BF573D9F352524C3917A16ADE253 C
  2⤵
  - Loads dropped DLL
  PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSIBDB7.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBDB7.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC039.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC039.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC097.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC097.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC097.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC0A8.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC0A8.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC0F7.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC0F7.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC108.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC108.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC118.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC118.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC204.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC204.tmp

Filesize
294KB

MD5
0e906a7e73667f0b5a8df0130c464c31

SHA1
1c30204ee8ad55c6140be4acd3deb0ae2c5334de

SHA256
b1a385082eb1675c28089e5ee8c200faf6ad1c57ced6e10c1f15a987553e900f

SHA512
7a32899184d612093610f982eaa05a7e558ba041f2bfe4f69f627581eea4be95f9afe892bd25450c33a418af38a451a1a893aec5775310d275b80be93b312a9c

Download Submit