Analysis
-
max time kernel
82s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
e5ac15d.msi
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
e5ac15d.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
e5ac15d.msi
-
Size
77.5MB
-
MD5
f4423feafa6af8382acdbe99269d662a
-
SHA1
57fd7d8ce46c964428f21ea5169c85d85e51ac63
-
SHA256
5a05eaa9635b5247d5d7e5c846194ba5868532a7ec555df57b8a8f25861d2471
-
SHA512
57ccd1705456cd8894e8d1d8efeb52594d42639918fc09e058231221ea484dd0b3cca6498aa66275e0c2592547abed26e8a257529a79c6aabc2e033c55ba5df5
-
SSDEEP
1572864:NnndAhSnbfH7y7m1PUp0SD+cafNzcZiku0M4339kUUCw:NnqSDwm1PRbcafkiku0M4dkUp
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 7 716 msiexec.exe 9 716 msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 4696 MsiExec.exe 4696 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 716 msiexec.exe Token: SeIncreaseQuotaPrivilege 716 msiexec.exe Token: SeSecurityPrivilege 1492 msiexec.exe Token: SeCreateTokenPrivilege 716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 716 msiexec.exe Token: SeLockMemoryPrivilege 716 msiexec.exe Token: SeIncreaseQuotaPrivilege 716 msiexec.exe Token: SeMachineAccountPrivilege 716 msiexec.exe Token: SeTcbPrivilege 716 msiexec.exe Token: SeSecurityPrivilege 716 msiexec.exe Token: SeTakeOwnershipPrivilege 716 msiexec.exe Token: SeLoadDriverPrivilege 716 msiexec.exe Token: SeSystemProfilePrivilege 716 msiexec.exe Token: SeSystemtimePrivilege 716 msiexec.exe Token: SeProfSingleProcessPrivilege 716 msiexec.exe Token: SeIncBasePriorityPrivilege 716 msiexec.exe Token: SeCreatePagefilePrivilege 716 msiexec.exe Token: SeCreatePermanentPrivilege 716 msiexec.exe Token: SeBackupPrivilege 716 msiexec.exe Token: SeRestorePrivilege 716 msiexec.exe Token: SeShutdownPrivilege 716 msiexec.exe Token: SeDebugPrivilege 716 msiexec.exe Token: SeAuditPrivilege 716 msiexec.exe Token: SeSystemEnvironmentPrivilege 716 msiexec.exe Token: SeChangeNotifyPrivilege 716 msiexec.exe Token: SeRemoteShutdownPrivilege 716 msiexec.exe Token: SeUndockPrivilege 716 msiexec.exe Token: SeSyncAgentPrivilege 716 msiexec.exe Token: SeEnableDelegationPrivilege 716 msiexec.exe Token: SeManageVolumePrivilege 716 msiexec.exe Token: SeImpersonatePrivilege 716 msiexec.exe Token: SeCreateGlobalPrivilege 716 msiexec.exe Token: SeCreateTokenPrivilege 716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 716 msiexec.exe Token: SeLockMemoryPrivilege 716 msiexec.exe Token: SeIncreaseQuotaPrivilege 716 msiexec.exe Token: SeMachineAccountPrivilege 716 msiexec.exe Token: SeTcbPrivilege 716 msiexec.exe Token: SeSecurityPrivilege 716 msiexec.exe Token: SeTakeOwnershipPrivilege 716 msiexec.exe Token: SeLoadDriverPrivilege 716 msiexec.exe Token: SeSystemProfilePrivilege 716 msiexec.exe Token: SeSystemtimePrivilege 716 msiexec.exe Token: SeProfSingleProcessPrivilege 716 msiexec.exe Token: SeIncBasePriorityPrivilege 716 msiexec.exe Token: SeCreatePagefilePrivilege 716 msiexec.exe Token: SeCreatePermanentPrivilege 716 msiexec.exe Token: SeBackupPrivilege 716 msiexec.exe Token: SeRestorePrivilege 716 msiexec.exe Token: SeShutdownPrivilege 716 msiexec.exe Token: SeDebugPrivilege 716 msiexec.exe Token: SeAuditPrivilege 716 msiexec.exe Token: SeSystemEnvironmentPrivilege 716 msiexec.exe Token: SeChangeNotifyPrivilege 716 msiexec.exe Token: SeRemoteShutdownPrivilege 716 msiexec.exe Token: SeUndockPrivilege 716 msiexec.exe Token: SeSyncAgentPrivilege 716 msiexec.exe Token: SeEnableDelegationPrivilege 716 msiexec.exe Token: SeManageVolumePrivilege 716 msiexec.exe Token: SeImpersonatePrivilege 716 msiexec.exe Token: SeCreateGlobalPrivilege 716 msiexec.exe Token: SeCreateTokenPrivilege 716 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 716 msiexec.exe Token: SeLockMemoryPrivilege 716 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 716 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1492 wrote to memory of 4696 1492 msiexec.exe 83 PID 1492 wrote to memory of 4696 1492 msiexec.exe 83 PID 1492 wrote to memory of 4696 1492 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e5ac15d.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:716
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C05DB9D6CF230DA95E0594E4066E2B9E C2⤵
- Loads dropped DLL
PID:4696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD50a2626fc9e4e0ca18386c029e9efffd9
SHA1ac5576497afac2456f485cdb14bf52d895769651
SHA25697a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
SHA51240b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
-
Filesize
231KB
MD50a2626fc9e4e0ca18386c029e9efffd9
SHA1ac5576497afac2456f485cdb14bf52d895769651
SHA25697a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
SHA51240b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
-
Filesize
231KB
MD50a2626fc9e4e0ca18386c029e9efffd9
SHA1ac5576497afac2456f485cdb14bf52d895769651
SHA25697a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
SHA51240b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
-
Filesize
231KB
MD50a2626fc9e4e0ca18386c029e9efffd9
SHA1ac5576497afac2456f485cdb14bf52d895769651
SHA25697a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
SHA51240b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da