ed0f0e60de86f1cd6adfdf435c65ad0253187e645de7255abb0a926f722470f7

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2023 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tdesk_桌面端App Store.msi
Size

160.6MB
MD5

0da7a13aca8c114dde4c45474e638a84
SHA1

285f1400bf8337a50297835a4771bbe994dd0c02
SHA256

ed0f0e60de86f1cd6adfdf435c65ad0253187e645de7255abb0a926f722470f7
SHA512

39b22caf9a7c72deaf69eaf9d536461df22362296862fb4f4b80b51e39a9579936e9850865de87788c9d8c42dbe9811b5ce93a5b3aff96caf02bf0e7a975efb8
SSDEEP

3145728:DDbD8Na5QkjrDpgCbheTWyGYsl2cH5+3StNEkt8KFMOBFilcg5hYiHa8+8Vo6:jDuaWsPp/tIGYsl2S+3StNAKlsLhZz+K

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe
5048	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5112	msiexec.exe
Token: SeSecurityPrivilege	4888	msiexec.exe
Token: SeCreateTokenPrivilege	5112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5112	msiexec.exe
Token: SeLockMemoryPrivilege	5112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5112	msiexec.exe
Token: SeMachineAccountPrivilege	5112	msiexec.exe
Token: SeTcbPrivilege	5112	msiexec.exe
Token: SeSecurityPrivilege	5112	msiexec.exe
Token: SeTakeOwnershipPrivilege	5112	msiexec.exe
Token: SeLoadDriverPrivilege	5112	msiexec.exe
Token: SeSystemProfilePrivilege	5112	msiexec.exe
Token: SeSystemtimePrivilege	5112	msiexec.exe
Token: SeProfSingleProcessPrivilege	5112	msiexec.exe
Token: SeIncBasePriorityPrivilege	5112	msiexec.exe
Token: SeCreatePagefilePrivilege	5112	msiexec.exe
Token: SeCreatePermanentPrivilege	5112	msiexec.exe
Token: SeBackupPrivilege	5112	msiexec.exe
Token: SeRestorePrivilege	5112	msiexec.exe
Token: SeShutdownPrivilege	5112	msiexec.exe
Token: SeDebugPrivilege	5112	msiexec.exe
Token: SeAuditPrivilege	5112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5112	msiexec.exe
Token: SeChangeNotifyPrivilege	5112	msiexec.exe
Token: SeRemoteShutdownPrivilege	5112	msiexec.exe
Token: SeUndockPrivilege	5112	msiexec.exe
Token: SeSyncAgentPrivilege	5112	msiexec.exe
Token: SeEnableDelegationPrivilege	5112	msiexec.exe
Token: SeManageVolumePrivilege	5112	msiexec.exe
Token: SeImpersonatePrivilege	5112	msiexec.exe
Token: SeCreateGlobalPrivilege	5112	msiexec.exe
Token: SeCreateTokenPrivilege	5112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5112	msiexec.exe
Token: SeLockMemoryPrivilege	5112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5112	msiexec.exe
Token: SeMachineAccountPrivilege	5112	msiexec.exe
Token: SeTcbPrivilege	5112	msiexec.exe
Token: SeSecurityPrivilege	5112	msiexec.exe
Token: SeTakeOwnershipPrivilege	5112	msiexec.exe
Token: SeLoadDriverPrivilege	5112	msiexec.exe
Token: SeSystemProfilePrivilege	5112	msiexec.exe
Token: SeSystemtimePrivilege	5112	msiexec.exe
Token: SeProfSingleProcessPrivilege	5112	msiexec.exe
Token: SeIncBasePriorityPrivilege	5112	msiexec.exe
Token: SeCreatePagefilePrivilege	5112	msiexec.exe
Token: SeCreatePermanentPrivilege	5112	msiexec.exe
Token: SeBackupPrivilege	5112	msiexec.exe
Token: SeRestorePrivilege	5112	msiexec.exe
Token: SeShutdownPrivilege	5112	msiexec.exe
Token: SeDebugPrivilege	5112	msiexec.exe
Token: SeAuditPrivilege	5112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5112	msiexec.exe
Token: SeChangeNotifyPrivilege	5112	msiexec.exe
Token: SeRemoteShutdownPrivilege	5112	msiexec.exe
Token: SeUndockPrivilege	5112	msiexec.exe
Token: SeSyncAgentPrivilege	5112	msiexec.exe
Token: SeEnableDelegationPrivilege	5112	msiexec.exe
Token: SeManageVolumePrivilege	5112	msiexec.exe
Token: SeImpersonatePrivilege	5112	msiexec.exe
Token: SeCreateGlobalPrivilege	5112	msiexec.exe
Token: SeCreateTokenPrivilege	5112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5112	msiexec.exe
Token: SeLockMemoryPrivilege	5112	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5112	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 5048	4888	msiexec.exe	88
PID 4888 wrote to memory of 5048	4888	msiexec.exe	88
PID 4888 wrote to memory of 5048	4888	msiexec.exe	88

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\tdesk_桌面端App Store.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5838D93852A84C01BF77514B54CE4B81 C
  2⤵
  - Loads dropped DLL
  PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI2016.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2016.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI32D4.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI32D4.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI33EE.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI33EE.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI33EE.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI34AA.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI34AA.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3548.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3548.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI37C9.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI37C9.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3838.tmp

Filesize
1.1MB

MD5
48c25fba873a341b914652763cbc4f7b

SHA1
98b51420e26829bb96a963e4fb897db733c76fc0

SHA256
4595c98e419d911b31eedfc342384e78024f5e23ccfdcfde4d2d304241e7c6cd

SHA512
c8931846db2b75860104d0dbf1cac5220fc2f3464cc83536b189c9bb8ccd4b1ddc490a7e7cf2f711bea086c29bf3948bd96ba81def63b752688277f0e96dbf68

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3838.tmp

Filesize
1.1MB

MD5
48c25fba873a341b914652763cbc4f7b

SHA1
98b51420e26829bb96a963e4fb897db733c76fc0

SHA256
4595c98e419d911b31eedfc342384e78024f5e23ccfdcfde4d2d304241e7c6cd

SHA512
c8931846db2b75860104d0dbf1cac5220fc2f3464cc83536b189c9bb8ccd4b1ddc490a7e7cf2f711bea086c29bf3948bd96ba81def63b752688277f0e96dbf68

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3962.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3962.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI39B1.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI39B1.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit