Analysis
-
max time kernel
77s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2023, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
MBSASetup-x64-EN.msi
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
MBSASetup-x64-EN.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
MBSASetup-x64-EN.msi
-
Size
1.7MB
-
MD5
4d1ca365cfa721dec991a79f6bb8f308
-
SHA1
de4a9df45ac40dd901c956edfe2f766d2bfddc92
-
SHA256
ccbfccdec5d33a479c15ba2bea31f0967d7eb1e9435855111e016105b1b59138
-
SHA512
dd8e2fe6007648b2a71e2b423d8ea6dcfeee37df9b5bb400a6b49ccf95e50ea2cb2de7bd048704b14c7b71c647d62be9d6df7389192d96edfd969b36d01d52fc
-
SSDEEP
24576:vCR/g/J/AgxxmdJJfLjCjz/7ITXLtfBKm/SF2EdPRl96vGdp90/ACJxDN9dVr:vCGidJ9K/7ITX5RSFXR3bjrm
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 5 4728 msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 4452 MsiExec.exe 4452 MsiExec.exe 4452 MsiExec.exe 4452 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4728 msiexec.exe Token: SeIncreaseQuotaPrivilege 4728 msiexec.exe Token: SeSecurityPrivilege 3420 msiexec.exe Token: SeCreateTokenPrivilege 4728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4728 msiexec.exe Token: SeLockMemoryPrivilege 4728 msiexec.exe Token: SeIncreaseQuotaPrivilege 4728 msiexec.exe Token: SeMachineAccountPrivilege 4728 msiexec.exe Token: SeTcbPrivilege 4728 msiexec.exe Token: SeSecurityPrivilege 4728 msiexec.exe Token: SeTakeOwnershipPrivilege 4728 msiexec.exe Token: SeLoadDriverPrivilege 4728 msiexec.exe Token: SeSystemProfilePrivilege 4728 msiexec.exe Token: SeSystemtimePrivilege 4728 msiexec.exe Token: SeProfSingleProcessPrivilege 4728 msiexec.exe Token: SeIncBasePriorityPrivilege 4728 msiexec.exe Token: SeCreatePagefilePrivilege 4728 msiexec.exe Token: SeCreatePermanentPrivilege 4728 msiexec.exe Token: SeBackupPrivilege 4728 msiexec.exe Token: SeRestorePrivilege 4728 msiexec.exe Token: SeShutdownPrivilege 4728 msiexec.exe Token: SeDebugPrivilege 4728 msiexec.exe Token: SeAuditPrivilege 4728 msiexec.exe Token: SeSystemEnvironmentPrivilege 4728 msiexec.exe Token: SeChangeNotifyPrivilege 4728 msiexec.exe Token: SeRemoteShutdownPrivilege 4728 msiexec.exe Token: SeUndockPrivilege 4728 msiexec.exe Token: SeSyncAgentPrivilege 4728 msiexec.exe Token: SeEnableDelegationPrivilege 4728 msiexec.exe Token: SeManageVolumePrivilege 4728 msiexec.exe Token: SeImpersonatePrivilege 4728 msiexec.exe Token: SeCreateGlobalPrivilege 4728 msiexec.exe Token: SeCreateTokenPrivilege 4728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4728 msiexec.exe Token: SeLockMemoryPrivilege 4728 msiexec.exe Token: SeIncreaseQuotaPrivilege 4728 msiexec.exe Token: SeMachineAccountPrivilege 4728 msiexec.exe Token: SeTcbPrivilege 4728 msiexec.exe Token: SeSecurityPrivilege 4728 msiexec.exe Token: SeTakeOwnershipPrivilege 4728 msiexec.exe Token: SeLoadDriverPrivilege 4728 msiexec.exe Token: SeSystemProfilePrivilege 4728 msiexec.exe Token: SeSystemtimePrivilege 4728 msiexec.exe Token: SeProfSingleProcessPrivilege 4728 msiexec.exe Token: SeIncBasePriorityPrivilege 4728 msiexec.exe Token: SeCreatePagefilePrivilege 4728 msiexec.exe Token: SeCreatePermanentPrivilege 4728 msiexec.exe Token: SeBackupPrivilege 4728 msiexec.exe Token: SeRestorePrivilege 4728 msiexec.exe Token: SeShutdownPrivilege 4728 msiexec.exe Token: SeDebugPrivilege 4728 msiexec.exe Token: SeAuditPrivilege 4728 msiexec.exe Token: SeSystemEnvironmentPrivilege 4728 msiexec.exe Token: SeChangeNotifyPrivilege 4728 msiexec.exe Token: SeRemoteShutdownPrivilege 4728 msiexec.exe Token: SeUndockPrivilege 4728 msiexec.exe Token: SeSyncAgentPrivilege 4728 msiexec.exe Token: SeEnableDelegationPrivilege 4728 msiexec.exe Token: SeManageVolumePrivilege 4728 msiexec.exe Token: SeImpersonatePrivilege 4728 msiexec.exe Token: SeCreateGlobalPrivilege 4728 msiexec.exe Token: SeCreateTokenPrivilege 4728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4728 msiexec.exe Token: SeLockMemoryPrivilege 4728 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4728 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3420 wrote to memory of 4364 3420 msiexec.exe 88 PID 3420 wrote to memory of 4364 3420 msiexec.exe 88 PID 3420 wrote to memory of 4364 3420 msiexec.exe 88 PID 3420 wrote to memory of 4452 3420 msiexec.exe 89 PID 3420 wrote to memory of 4452 3420 msiexec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MBSASetup-x64-EN.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4728
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B382229B5507D13AA21C9D31C5529EEA C2⤵PID:4364
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 54F49160FB48CEF3772648A71E85818B C2⤵
- Loads dropped DLL
PID:4452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97
-
Filesize
93KB
MD507603ffada795011e04289447bd47e75
SHA18fbabd836ec028e89144c55028c1ba2c60b4ae93
SHA256fa5f544b5550a8dc66f67d631c2ae31166c03a0521c15eb5949e2c53664c0e83
SHA512768408527fd3a8b0f65481ced21a09d67b924710d7e571b8be842caefa7c3369636812be3958e75b1b7b9a93fe19632cdebef40590dd1e4a99b341a87c7ece97