Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2023 19:17
Behavioral task
behavioral1
Sample
Android Fastboot & mini ADB Drivers/Android ADB Fastboot 1.7.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Android Fastboot & mini ADB Drivers/Android ADB Fastboot 1.7.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral4
Sample
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Android Fastboot & mini ADB Drivers/adb-setup-1.4.3.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral6
Sample
Android Fastboot & mini ADB Drivers/adb-setup-1.4.3.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
-
Size
16.3MB
-
MD5
a0b1cc7c5c26044738798ba2e5e8c217
-
SHA1
745bb99063748a2f309888467aac70c3c7ef6a2e
-
SHA256
4e77e303bba6cf84588bdb6da91f7a875d406f7930cbe9f4d2aae0b643c0c928
-
SHA512
2030a9e6cc935b40ac173bdcad434e200c36854b321da4324411e3ac58852445270a7aca379fd7c46ac95bf72a34fa924667cba5c7050af97d42880892e983f4
-
SSDEEP
393216:Hc2Ryzq2+0lkPEezmlMUH9n0sEf0/c++oLw525IgfLJ5pz3:azHPKmVB0MUzMw525ljpz
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 3304 MsiExec.exe 3304 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 880 msiexec.exe Token: SeIncreaseQuotaPrivilege 880 msiexec.exe Token: SeSecurityPrivilege 2532 msiexec.exe Token: SeCreateTokenPrivilege 880 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 880 msiexec.exe Token: SeLockMemoryPrivilege 880 msiexec.exe Token: SeIncreaseQuotaPrivilege 880 msiexec.exe Token: SeMachineAccountPrivilege 880 msiexec.exe Token: SeTcbPrivilege 880 msiexec.exe Token: SeSecurityPrivilege 880 msiexec.exe Token: SeTakeOwnershipPrivilege 880 msiexec.exe Token: SeLoadDriverPrivilege 880 msiexec.exe Token: SeSystemProfilePrivilege 880 msiexec.exe Token: SeSystemtimePrivilege 880 msiexec.exe Token: SeProfSingleProcessPrivilege 880 msiexec.exe Token: SeIncBasePriorityPrivilege 880 msiexec.exe Token: SeCreatePagefilePrivilege 880 msiexec.exe Token: SeCreatePermanentPrivilege 880 msiexec.exe Token: SeBackupPrivilege 880 msiexec.exe Token: SeRestorePrivilege 880 msiexec.exe Token: SeShutdownPrivilege 880 msiexec.exe Token: SeDebugPrivilege 880 msiexec.exe Token: SeAuditPrivilege 880 msiexec.exe Token: SeSystemEnvironmentPrivilege 880 msiexec.exe Token: SeChangeNotifyPrivilege 880 msiexec.exe Token: SeRemoteShutdownPrivilege 880 msiexec.exe Token: SeUndockPrivilege 880 msiexec.exe Token: SeSyncAgentPrivilege 880 msiexec.exe Token: SeEnableDelegationPrivilege 880 msiexec.exe Token: SeManageVolumePrivilege 880 msiexec.exe Token: SeImpersonatePrivilege 880 msiexec.exe Token: SeCreateGlobalPrivilege 880 msiexec.exe Token: SeCreateTokenPrivilege 880 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 880 msiexec.exe Token: SeLockMemoryPrivilege 880 msiexec.exe Token: SeIncreaseQuotaPrivilege 880 msiexec.exe Token: SeMachineAccountPrivilege 880 msiexec.exe Token: SeTcbPrivilege 880 msiexec.exe Token: SeSecurityPrivilege 880 msiexec.exe Token: SeTakeOwnershipPrivilege 880 msiexec.exe Token: SeLoadDriverPrivilege 880 msiexec.exe Token: SeSystemProfilePrivilege 880 msiexec.exe Token: SeSystemtimePrivilege 880 msiexec.exe Token: SeProfSingleProcessPrivilege 880 msiexec.exe Token: SeIncBasePriorityPrivilege 880 msiexec.exe Token: SeCreatePagefilePrivilege 880 msiexec.exe Token: SeCreatePermanentPrivilege 880 msiexec.exe Token: SeBackupPrivilege 880 msiexec.exe Token: SeRestorePrivilege 880 msiexec.exe Token: SeShutdownPrivilege 880 msiexec.exe Token: SeDebugPrivilege 880 msiexec.exe Token: SeAuditPrivilege 880 msiexec.exe Token: SeSystemEnvironmentPrivilege 880 msiexec.exe Token: SeChangeNotifyPrivilege 880 msiexec.exe Token: SeRemoteShutdownPrivilege 880 msiexec.exe Token: SeUndockPrivilege 880 msiexec.exe Token: SeSyncAgentPrivilege 880 msiexec.exe Token: SeEnableDelegationPrivilege 880 msiexec.exe Token: SeManageVolumePrivilege 880 msiexec.exe Token: SeImpersonatePrivilege 880 msiexec.exe Token: SeCreateGlobalPrivilege 880 msiexec.exe Token: SeCreateTokenPrivilege 880 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 880 msiexec.exe Token: SeLockMemoryPrivilege 880 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid Process 880 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 2532 wrote to memory of 3304 2532 msiexec.exe 86 PID 2532 wrote to memory of 3304 2532 msiexec.exe 86 PID 2532 wrote to memory of 3304 2532 msiexec.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Android Fastboot & mini ADB Drivers\UniversalAdbDriverSetup.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:880
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B7554BC6760E2C8B262B6E6D8AC713E4 C2⤵
- Loads dropped DLL
PID:3304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613