Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
03/08/2023, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
327a1ad6228adca42a92cf0c054df5ab68cebb0794c3e8a34d6cdeb7751cf5ffmsi_JC.msi
Resource
win7-20230712-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
327a1ad6228adca42a92cf0c054df5ab68cebb0794c3e8a34d6cdeb7751cf5ffmsi_JC.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
327a1ad6228adca42a92cf0c054df5ab68cebb0794c3e8a34d6cdeb7751cf5ffmsi_JC.msi
-
Size
4.0MB
-
MD5
de8169e2707963743591529483506b85
-
SHA1
dca874742694fb3c125c60cf9da0f9a06ad0952c
-
SHA256
327a1ad6228adca42a92cf0c054df5ab68cebb0794c3e8a34d6cdeb7751cf5ff
-
SHA512
e462d1ba5f98617e88030be2be47cdfa872f5385b41afdce6d1575b970fa0137a104a834fea493d52142030d58879f08f24256b85047cc9b3fe3bc3e64c63c90
-
SSDEEP
98304:YY5AJHnvXw3IdEDhquv4KUlbhwtPWTQ2cw/n255NXH:oHfwBFjwp6pf2cW65NX
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2268 cdburner.exe -
Loads dropped DLL 3 IoCs
pid Process 1104 MsiExec.exe 1104 MsiExec.exe 2268 cdburner.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76cadd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICE97.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f76cae0.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f76cadd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICB2B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICCE1.tmp msiexec.exe File created C:\Windows\Installer\f76cae0.ipi msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2500 msiexec.exe 2500 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 1392 msiexec.exe Token: SeIncreaseQuotaPrivilege 1392 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeSecurityPrivilege 2500 msiexec.exe Token: SeCreateTokenPrivilege 1392 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1392 msiexec.exe Token: SeLockMemoryPrivilege 1392 msiexec.exe Token: SeIncreaseQuotaPrivilege 1392 msiexec.exe Token: SeMachineAccountPrivilege 1392 msiexec.exe Token: SeTcbPrivilege 1392 msiexec.exe Token: SeSecurityPrivilege 1392 msiexec.exe Token: SeTakeOwnershipPrivilege 1392 msiexec.exe Token: SeLoadDriverPrivilege 1392 msiexec.exe Token: SeSystemProfilePrivilege 1392 msiexec.exe Token: SeSystemtimePrivilege 1392 msiexec.exe Token: SeProfSingleProcessPrivilege 1392 msiexec.exe Token: SeIncBasePriorityPrivilege 1392 msiexec.exe Token: SeCreatePagefilePrivilege 1392 msiexec.exe Token: SeCreatePermanentPrivilege 1392 msiexec.exe Token: SeBackupPrivilege 1392 msiexec.exe Token: SeRestorePrivilege 1392 msiexec.exe Token: SeShutdownPrivilege 1392 msiexec.exe Token: SeDebugPrivilege 1392 msiexec.exe Token: SeAuditPrivilege 1392 msiexec.exe Token: SeSystemEnvironmentPrivilege 1392 msiexec.exe Token: SeChangeNotifyPrivilege 1392 msiexec.exe Token: SeRemoteShutdownPrivilege 1392 msiexec.exe Token: SeUndockPrivilege 1392 msiexec.exe Token: SeSyncAgentPrivilege 1392 msiexec.exe Token: SeEnableDelegationPrivilege 1392 msiexec.exe Token: SeManageVolumePrivilege 1392 msiexec.exe Token: SeImpersonatePrivilege 1392 msiexec.exe Token: SeCreateGlobalPrivilege 1392 msiexec.exe Token: SeBackupPrivilege 2972 vssvc.exe Token: SeRestorePrivilege 2972 vssvc.exe Token: SeAuditPrivilege 2972 vssvc.exe Token: SeBackupPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeLoadDriverPrivilege 2744 DrvInst.exe Token: SeLoadDriverPrivilege 2744 DrvInst.exe Token: SeLoadDriverPrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe Token: SeRestorePrivilege 2500 msiexec.exe Token: SeTakeOwnershipPrivilege 2500 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1392 msiexec.exe 1392 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 1104 2500 msiexec.exe 32 PID 2500 wrote to memory of 2268 2500 msiexec.exe 33 PID 2500 wrote to memory of 2268 2500 msiexec.exe 33 PID 2500 wrote to memory of 2268 2500 msiexec.exe 33 PID 2500 wrote to memory of 2268 2500 msiexec.exe 33
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\327a1ad6228adca42a92cf0c054df5ab68cebb0794c3e8a34d6cdeb7751cf5ffmsi_JC.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1392
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DFC0E2057653C22A8CEB1C1DBB2C1C42⤵
- Loads dropped DLL
PID:1104
-
-
C:\Users\Admin\Documents\Downloads\BSPlayer\cdburner.exe"C:\Users\Admin\Documents\Downloads\BSPlayer\cdburner.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "0000000000000344"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD512e18daf585e7dfc047619c6b20cf2d3
SHA1ce6d1e91a6495620d2529c16e92bac0b4582996e
SHA25689608f91c72ace21e0994628bc9525ee2609419af2b3fa61b175ce0a9ebb8b29
SHA5128ed1027413127e8d6da923eb951782c13aad76c42d90b3664401fa4c00cc00d721164811f28c83d688cf21c121c473170cd03997599a17ae7e477c317f394808
-
Filesize
2.8MB
MD5e026627ee327135bb6802197bb14aaf6
SHA13ec983bad17bddb0e579ea04565e74a4bb2db980
SHA25649ab06760430c29e877858a1deb74189414f1722f78b224baeada395b773720a
SHA512bdf0f9b0ad92bd33722763bfadc3248680ec46e24dce8f8e1753207665f2cbf34f251bf93e54ee8c18090a32770186593c2f64ca6b5c469530f9039eaa0e90aa
-
Filesize
1.6MB
MD5bdc0cff1e6e3db489864041a623f0d1e
SHA1cf1beeec71abbfbe8a6f47abaaa6c1af2fee37dc
SHA256585741ca3c4041bb39d107f1f159d908650967fbccac3a491bca389cc4ba0769
SHA512aeaf1d2da43584ae91ea032c59a945ab91f721cc3b5bb98c2c7096dfd8c728b4ebf735491e06e934b4b1c9f1ccc719f950ad6f45e212f638b52c7af5efcc18db
-
Filesize
1.6MB
MD5bdc0cff1e6e3db489864041a623f0d1e
SHA1cf1beeec71abbfbe8a6f47abaaa6c1af2fee37dc
SHA256585741ca3c4041bb39d107f1f159d908650967fbccac3a491bca389cc4ba0769
SHA512aeaf1d2da43584ae91ea032c59a945ab91f721cc3b5bb98c2c7096dfd8c728b4ebf735491e06e934b4b1c9f1ccc719f950ad6f45e212f638b52c7af5efcc18db
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
2.8MB
MD5e026627ee327135bb6802197bb14aaf6
SHA13ec983bad17bddb0e579ea04565e74a4bb2db980
SHA25649ab06760430c29e877858a1deb74189414f1722f78b224baeada395b773720a
SHA512bdf0f9b0ad92bd33722763bfadc3248680ec46e24dce8f8e1753207665f2cbf34f251bf93e54ee8c18090a32770186593c2f64ca6b5c469530f9039eaa0e90aa
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b