64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992

General

Target

64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe
Size

2.2MB
MD5

6f0c3d6e3ce7d1c01f84081024bae0cd
SHA1

44b5650287ac6dcbb55caa2f6d9a95d768b4ef3c
SHA256

64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992
SHA512

3103628e8501bd55aa3140efa319596dc4c60525b97078ef5e6ec4ab34b82c797f06a8f718c194887e6e4d7142aed05ea9f953a78ca0eac98fbd634a68841c1c
SSDEEP

49152:3DQv3k0lhqNRt9fKJNCiB3koxaWkboakNZ4:zQ/k0DYRt9CJNCZWaoBo

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	2124	msiexec.exe
4	2124	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2124	msiexec.exe
Token: SeRestorePrivilege	1420	msiexec.exe
Token: SeTakeOwnershipPrivilege	1420	msiexec.exe
Token: SeSecurityPrivilege	1420	msiexec.exe
Token: SeCreateTokenPrivilege	2124	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2124	msiexec.exe
Token: SeLockMemoryPrivilege	2124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2124	msiexec.exe
Token: SeMachineAccountPrivilege	2124	msiexec.exe
Token: SeTcbPrivilege	2124	msiexec.exe
Token: SeSecurityPrivilege	2124	msiexec.exe
Token: SeTakeOwnershipPrivilege	2124	msiexec.exe
Token: SeLoadDriverPrivilege	2124	msiexec.exe
Token: SeSystemProfilePrivilege	2124	msiexec.exe
Token: SeSystemtimePrivilege	2124	msiexec.exe
Token: SeProfSingleProcessPrivilege	2124	msiexec.exe
Token: SeIncBasePriorityPrivilege	2124	msiexec.exe
Token: SeCreatePagefilePrivilege	2124	msiexec.exe
Token: SeCreatePermanentPrivilege	2124	msiexec.exe
Token: SeBackupPrivilege	2124	msiexec.exe
Token: SeRestorePrivilege	2124	msiexec.exe
Token: SeShutdownPrivilege	2124	msiexec.exe
Token: SeDebugPrivilege	2124	msiexec.exe
Token: SeAuditPrivilege	2124	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2124	msiexec.exe
Token: SeChangeNotifyPrivilege	2124	msiexec.exe
Token: SeRemoteShutdownPrivilege	2124	msiexec.exe
Token: SeUndockPrivilege	2124	msiexec.exe
Token: SeSyncAgentPrivilege	2124	msiexec.exe
Token: SeEnableDelegationPrivilege	2124	msiexec.exe
Token: SeManageVolumePrivilege	2124	msiexec.exe
Token: SeImpersonatePrivilege	2124	msiexec.exe
Token: SeCreateGlobalPrivilege	2124	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27
PID 2956 wrote to memory of 2124	2956	64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe	27

C:\Users\Admin\AppData\Local\Temp\64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe
"C:\Users\Admin\AppData\Local\Temp\64b5c664ca8ac53874742ea0d25df2579d5dc7458a40573ce32854f81b614992.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\YZ.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA2C8.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\YZ.msi

Filesize
2.0MB

MD5
2dab0035d02775314780a8c3b8f6c198

SHA1
7c430991257bc401678b7bffc58d751de8b75ed4

SHA256
9f0d8802ea2ae543d6e4bbe72d243fa380d3582ad333a362cb80d4f9270d6bac

SHA512
96fd22382008efcd6e5165c69545c43a05710482cc9f3a4162b7aa05309b0a65465853f621c6cab92493666fc6a651b1803a798bf13726d35bb85405816fcd64

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\YZ.msi

Filesize
2.0MB

MD5
2dab0035d02775314780a8c3b8f6c198

SHA1
7c430991257bc401678b7bffc58d751de8b75ed4

SHA256
9f0d8802ea2ae543d6e4bbe72d243fa380d3582ad333a362cb80d4f9270d6bac

SHA512
96fd22382008efcd6e5165c69545c43a05710482cc9f3a4162b7aa05309b0a65465853f621c6cab92493666fc6a651b1803a798bf13726d35bb85405816fcd64

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA386.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit

Analysis

Sharing