Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
19/07/2023, 07:55
Static task
static1
Behavioral task
behavioral1
Sample
cfdiManager_CanalEnvio_Soriana.msi
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
cfdiManager_CanalEnvio_Soriana.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
cfdiManager_CanalEnvio_Soriana.msi
-
Size
397KB
-
MD5
a8911548cb0c5effae1b587fdd3e11b4
-
SHA1
019d6b3f6403f1b059895199de151b6f35ca84a9
-
SHA256
ca5f9bebce0699ae8a6519df0546df51d5076418f95cbcbf7c9cb897d5c2057b
-
SHA512
1e1d67239c52f27b828cf915e3d09a210c6177e1259a7f5c8fb597f5f2fef33474269d51f712569c57496cd4553044bb27a1c5d80cef387edaa7a3fa02bb0c89
-
SSDEEP
6144:ted0IAVrvrgw72ws9wcUh9pFtyXuo0UfvgkBtPb+e:s2HrDgw7s9wBhnyXuobvgkBBbr
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1280 MsiExec.exe 1280 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2224 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2224 msiexec.exe Token: SeIncreaseQuotaPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2456 msiexec.exe Token: SeTakeOwnershipPrivilege 2456 msiexec.exe Token: SeSecurityPrivilege 2456 msiexec.exe Token: SeCreateTokenPrivilege 2224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2224 msiexec.exe Token: SeLockMemoryPrivilege 2224 msiexec.exe Token: SeIncreaseQuotaPrivilege 2224 msiexec.exe Token: SeMachineAccountPrivilege 2224 msiexec.exe Token: SeTcbPrivilege 2224 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeLoadDriverPrivilege 2224 msiexec.exe Token: SeSystemProfilePrivilege 2224 msiexec.exe Token: SeSystemtimePrivilege 2224 msiexec.exe Token: SeProfSingleProcessPrivilege 2224 msiexec.exe Token: SeIncBasePriorityPrivilege 2224 msiexec.exe Token: SeCreatePagefilePrivilege 2224 msiexec.exe Token: SeCreatePermanentPrivilege 2224 msiexec.exe Token: SeBackupPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeShutdownPrivilege 2224 msiexec.exe Token: SeDebugPrivilege 2224 msiexec.exe Token: SeAuditPrivilege 2224 msiexec.exe Token: SeSystemEnvironmentPrivilege 2224 msiexec.exe Token: SeChangeNotifyPrivilege 2224 msiexec.exe Token: SeRemoteShutdownPrivilege 2224 msiexec.exe Token: SeUndockPrivilege 2224 msiexec.exe Token: SeSyncAgentPrivilege 2224 msiexec.exe Token: SeEnableDelegationPrivilege 2224 msiexec.exe Token: SeManageVolumePrivilege 2224 msiexec.exe Token: SeImpersonatePrivilege 2224 msiexec.exe Token: SeCreateGlobalPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 2224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2224 msiexec.exe Token: SeLockMemoryPrivilege 2224 msiexec.exe Token: SeIncreaseQuotaPrivilege 2224 msiexec.exe Token: SeMachineAccountPrivilege 2224 msiexec.exe Token: SeTcbPrivilege 2224 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeLoadDriverPrivilege 2224 msiexec.exe Token: SeSystemProfilePrivilege 2224 msiexec.exe Token: SeSystemtimePrivilege 2224 msiexec.exe Token: SeProfSingleProcessPrivilege 2224 msiexec.exe Token: SeIncBasePriorityPrivilege 2224 msiexec.exe Token: SeCreatePagefilePrivilege 2224 msiexec.exe Token: SeCreatePermanentPrivilege 2224 msiexec.exe Token: SeBackupPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeShutdownPrivilege 2224 msiexec.exe Token: SeDebugPrivilege 2224 msiexec.exe Token: SeAuditPrivilege 2224 msiexec.exe Token: SeSystemEnvironmentPrivilege 2224 msiexec.exe Token: SeChangeNotifyPrivilege 2224 msiexec.exe Token: SeRemoteShutdownPrivilege 2224 msiexec.exe Token: SeUndockPrivilege 2224 msiexec.exe Token: SeSyncAgentPrivilege 2224 msiexec.exe Token: SeEnableDelegationPrivilege 2224 msiexec.exe Token: SeManageVolumePrivilege 2224 msiexec.exe Token: SeImpersonatePrivilege 2224 msiexec.exe Token: SeCreateGlobalPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 2224 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2456 wrote to memory of 1280 2456 msiexec.exe 29 PID 2456 wrote to memory of 1280 2456 msiexec.exe 29 PID 2456 wrote to memory of 1280 2456 msiexec.exe 29 PID 2456 wrote to memory of 1280 2456 msiexec.exe 29 PID 2456 wrote to memory of 1280 2456 msiexec.exe 29 PID 2456 wrote to memory of 1280 2456 msiexec.exe 29 PID 2456 wrote to memory of 1280 2456 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cfdiManager_CanalEnvio_Soriana.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2224
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C1247D563CECA8135E81A1C2FCE1D051 C2⤵
- Loads dropped DLL
PID:1280
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222KB
MD5d5cbd20b1b0d410590d9ebfbc86a7362
SHA1c4415fb53a9a06c20226001fc66eb8e434269078
SHA256a94605bae2723f437d7d8adb5c6f1ef36c95a9c1e959d0cff4412bff44ea7c12
SHA5125fdbe7bdc6e7b2aa48d2cfd3cba47644e1ce7867f1877a4417b624066cb136ab89f1ad71b7a8500f5e993a653067cbd7a8cb54087cf277356fd3741212b1caa4
-
Filesize
222KB
MD5d5cbd20b1b0d410590d9ebfbc86a7362
SHA1c4415fb53a9a06c20226001fc66eb8e434269078
SHA256a94605bae2723f437d7d8adb5c6f1ef36c95a9c1e959d0cff4412bff44ea7c12
SHA5125fdbe7bdc6e7b2aa48d2cfd3cba47644e1ce7867f1877a4417b624066cb136ab89f1ad71b7a8500f5e993a653067cbd7a8cb54087cf277356fd3741212b1caa4
-
Filesize
222KB
MD5d5cbd20b1b0d410590d9ebfbc86a7362
SHA1c4415fb53a9a06c20226001fc66eb8e434269078
SHA256a94605bae2723f437d7d8adb5c6f1ef36c95a9c1e959d0cff4412bff44ea7c12
SHA5125fdbe7bdc6e7b2aa48d2cfd3cba47644e1ce7867f1877a4417b624066cb136ab89f1ad71b7a8500f5e993a653067cbd7a8cb54087cf277356fd3741212b1caa4
-
Filesize
222KB
MD5d5cbd20b1b0d410590d9ebfbc86a7362
SHA1c4415fb53a9a06c20226001fc66eb8e434269078
SHA256a94605bae2723f437d7d8adb5c6f1ef36c95a9c1e959d0cff4412bff44ea7c12
SHA5125fdbe7bdc6e7b2aa48d2cfd3cba47644e1ce7867f1877a4417b624066cb136ab89f1ad71b7a8500f5e993a653067cbd7a8cb54087cf277356fd3741212b1caa4