Analysis
- max time kernel
142s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
31/08/2023, 02:23
Behavioral task
behavioral1
Sample
D23593D7.msi
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
D23593D7.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target D23593D7.msi
- Size 1.4MB
- Sample230831-cvdvbacd33
- SHA256 72601209c92391bd76101e3fb8c96414db8850ca4979379527a979b8ad097589
- MD5 e7c7a8a1ba187b67be9bdb024813a0df
- SHA1 521ed1044d36304ae2257260ef6169cced71d5a9
- SHA512 bec24b7ed0648f228e10c9f52ed22138649659bdf9e1c96833f49808056200e416130a894e49889b2e0a73268a864b5938745a7c1e7307e46b38b99332048257
- SSDEEP 24576:csuDXXva104BMeRocDP1NhhQEJBDYkaT64Mcctdrbf6zncNynD6BRMhUT:cVX//i5oojQc0HdmdruzcNynD6q4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3080 MsiExec.exe 3080 MsiExec.exe 3080 MsiExec.exe 3080 MsiExec.exe 3080 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA2AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\dbcode21mk.log msiexec.exe File opened for modification C:\Windows\Installer\e579e43.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9F0F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA1AF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA26C.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{80395032-1630-4C4B-A997-0A7CCB72C75B} msiexec.exe File opened for modification C:\Windows\Installer\MSIA647.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA378.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\setupact64.log msiexec.exe File created C:\Windows\Installer\e579e43.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2224 msiexec.exe 2224 msiexec.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 892 msiexec.exe Token: SeIncreaseQuotaPrivilege 892 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 892 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 892 msiexec.exe Token: SeLockMemoryPrivilege 892 msiexec.exe Token: SeIncreaseQuotaPrivilege 892 msiexec.exe Token: SeMachineAccountPrivilege 892 msiexec.exe Token: SeTcbPrivilege 892 msiexec.exe Token: SeSecurityPrivilege 892 msiexec.exe Token: SeTakeOwnershipPrivilege 892 msiexec.exe Token: SeLoadDriverPrivilege 892 msiexec.exe Token: SeSystemProfilePrivilege 892 msiexec.exe Token: SeSystemtimePrivilege 892 msiexec.exe Token: SeProfSingleProcessPrivilege 892 msiexec.exe Token: SeIncBasePriorityPrivilege 892 msiexec.exe Token: SeCreatePagefilePrivilege 892 msiexec.exe Token: SeCreatePermanentPrivilege 892 msiexec.exe Token: SeBackupPrivilege 892 msiexec.exe Token: SeRestorePrivilege 892 msiexec.exe Token: SeShutdownPrivilege 892 msiexec.exe Token: SeDebugPrivilege 892 msiexec.exe Token: SeAuditPrivilege 892 msiexec.exe Token: SeSystemEnvironmentPrivilege 892 msiexec.exe Token: SeChangeNotifyPrivilege 892 msiexec.exe Token: SeRemoteShutdownPrivilege 892 msiexec.exe Token: SeUndockPrivilege 892 msiexec.exe Token: SeSyncAgentPrivilege 892 msiexec.exe Token: SeEnableDelegationPrivilege 892 msiexec.exe Token: SeManageVolumePrivilege 892 msiexec.exe Token: SeImpersonatePrivilege 892 msiexec.exe Token: SeCreateGlobalPrivilege 892 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 892 msiexec.exe 892 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2224 wrote to memory of 3080 2224 msiexec.exe 85 PID 2224 wrote to memory of 3080 2224 msiexec.exe 85 PID 2224 wrote to memory of 3080 2224 msiexec.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\D23593D7.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:892
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6EE2B0E6FCB215D45EB2F233A90923512⤵
- Loads dropped DLL
PID:3080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI9F0F.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI9F0F.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA1AF.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA1AF.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA26C.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA26C.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA26C.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA2AB.tmp
- Size 118KB
- SHA256 68c66657b569cad9cc6e1f5adf0795b5df444ec9945c0d86c62c5abc8aaddc08
- MD5 4b49c57cbefa1d2773da1f95338e294d
- SHA1 108ea90d8a42cf31f7d8d7710b5fd713ca048ef9
- SHA512 42c61f24196c2682343309cbcdcea185a4100603c649e053c11e2efadef8983c411ef4c61ca71025460baf3d4155157242b2f4ce02a88b6ca2d1922651036165
- SSDEEP 3072:XXPhQYPkc6qNwVp7HbwetKhMWBzsOyXfVW:n5dt6qNmBAnyXf8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA2AB.tmp
- Size 118KB
- SHA256 68c66657b569cad9cc6e1f5adf0795b5df444ec9945c0d86c62c5abc8aaddc08
- MD5 4b49c57cbefa1d2773da1f95338e294d
- SHA1 108ea90d8a42cf31f7d8d7710b5fd713ca048ef9
- SHA512 42c61f24196c2682343309cbcdcea185a4100603c649e053c11e2efadef8983c411ef4c61ca71025460baf3d4155157242b2f4ce02a88b6ca2d1922651036165
- SSDEEP 3072:XXPhQYPkc6qNwVp7HbwetKhMWBzsOyXfVW:n5dt6qNmBAnyXf8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA378.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA378.tmp
- Size 141KB
- SHA256 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55
- MD5 4ba8ef50ce73395ad623c770c10e35a7
- SHA1 63600584c296c0cbe1775a759c34ab384e1bbf76
- SHA512 0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206
- SSDEEP 3072:AxkmaLeKeY6M/ez4FVGpSeAC3fKw+qw8nBK:Ax4SM/ezyMYeTfKLqw8B
- MD5 SHA1 SHA512 SSDEEP