Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-09-2023 19:25
Static task
static1
Behavioral task
behavioral1
Sample
Android ADB Fastboot 1.7.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Android ADB Fastboot 1.7.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
Android ADB Fastboot 1.7.msi
-
Size
3.7MB
-
MD5
0a1e784597bc17f9b420796a7b931eeb
-
SHA1
f2f9d0e17278a3eb9a6428b4cd6a1ca4094f7009
-
SHA256
367521fd6b5f361df98a7c5b3809f030b64c431609d7ae4ba2690850ccf11b76
-
SHA512
31bde1cd229f178b045429fcfc3b0d0f6f0d9c99e5cc7ec257e638ed3c713852e55f58bbf5bb2bdad2018038f0a69ea3aae066c6c24ea288f83c4ea5023670bb
-
SSDEEP
98304:5YwADYeHcczaFB8i99RDGgYQB1mdMgWqO:jASIi9f97B1m6gA
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exeMsiExec.exepid Process 3060 MsiExec.exe 3060 MsiExec.exe 3060 MsiExec.exe 3060 MsiExec.exe 2528 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Windows directory 10 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Windows\Installer\f76650a.msi msiexec.exe File created C:\Windows\Installer\f76650b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{29FB844C-8CE6-450A-9510-A07FD091CD57}\Android.exe msiexec.exe File opened for modification C:\Windows\Installer\f76650a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI65A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI68D2.tmp msiexec.exe File opened for modification C:\Windows\Installer\{29FB844C-8CE6-450A-9510-A07FD091CD57}\Android.exe msiexec.exe File created C:\Windows\Installer\f76650d.msi msiexec.exe File opened for modification C:\Windows\Installer\f76650b.ipi msiexec.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe -
Modifies registry class 24 IoCs
Processes:
msiexec.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\ProductIcon = "C:\\Windows\\Installer\\{29FB844C-8CE6-450A-9510-A07FD091CD57}\\Android.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C448BF926EC8A05459010AF70D19DC75 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\Version = "17235968" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1D54F4542764ED54D82DA39284C70B46\C448BF926EC8A05459010AF70D19DC75 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C448BF926EC8A05459010AF70D19DC75\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\ProductName = "Android ADB Fastboot" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\PackageCode = "CE684704D628D0E42A19395EC7A2D8DA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1D54F4542764ED54D82DA39284C70B46 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\PackageName = "Android ADB Fastboot 1.7.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C448BF926EC8A05459010AF70D19DC75\SourceList\Media msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 2280 msiexec.exe 2280 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 1952 msiexec.exe Token: SeIncreaseQuotaPrivilege 1952 msiexec.exe Token: SeRestorePrivilege 2280 msiexec.exe Token: SeTakeOwnershipPrivilege 2280 msiexec.exe Token: SeSecurityPrivilege 2280 msiexec.exe Token: SeCreateTokenPrivilege 1952 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1952 msiexec.exe Token: SeLockMemoryPrivilege 1952 msiexec.exe Token: SeIncreaseQuotaPrivilege 1952 msiexec.exe Token: SeMachineAccountPrivilege 1952 msiexec.exe Token: SeTcbPrivilege 1952 msiexec.exe Token: SeSecurityPrivilege 1952 msiexec.exe Token: SeTakeOwnershipPrivilege 1952 msiexec.exe Token: SeLoadDriverPrivilege 1952 msiexec.exe Token: SeSystemProfilePrivilege 1952 msiexec.exe Token: SeSystemtimePrivilege 1952 msiexec.exe Token: SeProfSingleProcessPrivilege 1952 msiexec.exe Token: SeIncBasePriorityPrivilege 1952 msiexec.exe Token: SeCreatePagefilePrivilege 1952 msiexec.exe Token: SeCreatePermanentPrivilege 1952 msiexec.exe Token: SeBackupPrivilege 1952 msiexec.exe Token: SeRestorePrivilege 1952 msiexec.exe Token: SeShutdownPrivilege 1952 msiexec.exe Token: SeDebugPrivilege 1952 msiexec.exe Token: SeAuditPrivilege 1952 msiexec.exe Token: SeSystemEnvironmentPrivilege 1952 msiexec.exe Token: SeChangeNotifyPrivilege 1952 msiexec.exe Token: SeRemoteShutdownPrivilege 1952 msiexec.exe Token: SeUndockPrivilege 1952 msiexec.exe Token: SeSyncAgentPrivilege 1952 msiexec.exe Token: SeEnableDelegationPrivilege 1952 msiexec.exe Token: SeManageVolumePrivilege 1952 msiexec.exe Token: SeImpersonatePrivilege 1952 msiexec.exe Token: SeCreateGlobalPrivilege 1952 msiexec.exe Token: SeCreateTokenPrivilege 1952 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1952 msiexec.exe Token: SeLockMemoryPrivilege 1952 msiexec.exe Token: SeIncreaseQuotaPrivilege 1952 msiexec.exe Token: SeMachineAccountPrivilege 1952 msiexec.exe Token: SeTcbPrivilege 1952 msiexec.exe Token: SeSecurityPrivilege 1952 msiexec.exe Token: SeTakeOwnershipPrivilege 1952 msiexec.exe Token: SeLoadDriverPrivilege 1952 msiexec.exe Token: SeSystemProfilePrivilege 1952 msiexec.exe Token: SeSystemtimePrivilege 1952 msiexec.exe Token: SeProfSingleProcessPrivilege 1952 msiexec.exe Token: SeIncBasePriorityPrivilege 1952 msiexec.exe Token: SeCreatePagefilePrivilege 1952 msiexec.exe Token: SeCreatePermanentPrivilege 1952 msiexec.exe Token: SeBackupPrivilege 1952 msiexec.exe Token: SeRestorePrivilege 1952 msiexec.exe Token: SeShutdownPrivilege 1952 msiexec.exe Token: SeDebugPrivilege 1952 msiexec.exe Token: SeAuditPrivilege 1952 msiexec.exe Token: SeSystemEnvironmentPrivilege 1952 msiexec.exe Token: SeChangeNotifyPrivilege 1952 msiexec.exe Token: SeRemoteShutdownPrivilege 1952 msiexec.exe Token: SeUndockPrivilege 1952 msiexec.exe Token: SeSyncAgentPrivilege 1952 msiexec.exe Token: SeEnableDelegationPrivilege 1952 msiexec.exe Token: SeManageVolumePrivilege 1952 msiexec.exe Token: SeImpersonatePrivilege 1952 msiexec.exe Token: SeCreateGlobalPrivilege 1952 msiexec.exe Token: SeCreateTokenPrivilege 1952 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 1952 msiexec.exe 1952 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 3060 2280 msiexec.exe 29 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30 PID 2280 wrote to memory of 2528 2280 msiexec.exe 30
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Android ADB Fastboot 1.7.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1952
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7E1A1D0760EA7045E9FD981C92920F1 C2⤵
- Loads dropped DLL
PID:3060
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B603A45352D0C1F642336ED9DCDEE9282⤵
- Loads dropped DLL
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5f8c592379caa7841e6cd59369c73381a
SHA13b55f3eade55bbf02323fdf3d3a2c31fbfecb03e
SHA25633e3d65705c2471ab33aadbcbca9f578e970315279961a32ad1a4bb639495120
SHA512ee5d416670ab7cbe8ee416e631247c31fdf74c0f01e9552481a5d5067a45f52fef52eb62317ce21cf5dcd4a45e0da28d2c355cb29c7c774a322226e26398f5c0
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
3.7MB
MD50a1e784597bc17f9b420796a7b931eeb
SHA1f2f9d0e17278a3eb9a6428b4cd6a1ca4094f7009
SHA256367521fd6b5f361df98a7c5b3809f030b64c431609d7ae4ba2690850ccf11b76
SHA51231bde1cd229f178b045429fcfc3b0d0f6f0d9c99e5cc7ec257e638ed3c713852e55f58bbf5bb2bdad2018038f0a69ea3aae066c6c24ea288f83c4ea5023670bb
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f
-
Filesize
209KB
MD526bb078a67c7eedd5e55756e49e08150
SHA117475069b69ea63f637694ecfaad694499e2a09e
SHA2564f4ad63074a619bf5505aab6e81db5be0c2368e2c3aa48f5874607a00c89f81e
SHA512b929ba0960fa103fd9cbbb824fe41f1f49b3072c7ea715b46fd583e002638c81909c6194bfea7f480ff79ce3a1e411591a9b3d9b3213dbda2eea3df3b08b019f