Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
28-09-2023 14:22
Static task
static1
Behavioral task
behavioral1
Sample
Skype_8.100.210.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Skype_8.100.210.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
Skype_8.100.210.exe
-
Size
128.9MB
-
MD5
d3c3efb0780a89f422ec534b2b074c46
-
SHA1
d1ff15bd023db94036f9be3c4a2f940637fe01ba
-
SHA256
0060f4b284311a1d9ada6de85715edfe17ff4cf9eb017f5dd8062a6f78c9e1af
-
SHA512
d1199375f7247b8d3e2b2030e42178feb02c454f562ce74e36f70c9d755e82c6acaf0f239a73dffd47c935feb5961ff006d5e882690b08a5273adfb939954c15
-
SSDEEP
3145728:OIw/6LnbjoLzQf7gMbmaBZQvS+IoqBCqJo2Wy9T4If:1hLnIQfkKCPqWEp
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 3000 MsiExec.exe 2676 MsiExec.exe 2676 MsiExec.exe 2676 MsiExec.exe 2676 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: Skype_8.100.210.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: Skype_8.100.210.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: Skype_8.100.210.exe File opened (read-only) \??\M: Skype_8.100.210.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: Skype_8.100.210.exe File opened (read-only) \??\O: Skype_8.100.210.exe File opened (read-only) \??\R: Skype_8.100.210.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: Skype_8.100.210.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: Skype_8.100.210.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: Skype_8.100.210.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: Skype_8.100.210.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: Skype_8.100.210.exe File opened (read-only) \??\V: Skype_8.100.210.exe File opened (read-only) \??\X: Skype_8.100.210.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: Skype_8.100.210.exe File opened (read-only) \??\Q: Skype_8.100.210.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: Skype_8.100.210.exe File opened (read-only) \??\N: Skype_8.100.210.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: Skype_8.100.210.exe File opened (read-only) \??\U: Skype_8.100.210.exe File opened (read-only) \??\Y: Skype_8.100.210.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: Skype_8.100.210.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2208 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeSecurityPrivilege 1988 msiexec.exe Token: SeCreateTokenPrivilege 1364 Skype_8.100.210.exe Token: SeAssignPrimaryTokenPrivilege 1364 Skype_8.100.210.exe Token: SeLockMemoryPrivilege 1364 Skype_8.100.210.exe Token: SeIncreaseQuotaPrivilege 1364 Skype_8.100.210.exe Token: SeMachineAccountPrivilege 1364 Skype_8.100.210.exe Token: SeTcbPrivilege 1364 Skype_8.100.210.exe Token: SeSecurityPrivilege 1364 Skype_8.100.210.exe Token: SeTakeOwnershipPrivilege 1364 Skype_8.100.210.exe Token: SeLoadDriverPrivilege 1364 Skype_8.100.210.exe Token: SeSystemProfilePrivilege 1364 Skype_8.100.210.exe Token: SeSystemtimePrivilege 1364 Skype_8.100.210.exe Token: SeProfSingleProcessPrivilege 1364 Skype_8.100.210.exe Token: SeIncBasePriorityPrivilege 1364 Skype_8.100.210.exe Token: SeCreatePagefilePrivilege 1364 Skype_8.100.210.exe Token: SeCreatePermanentPrivilege 1364 Skype_8.100.210.exe Token: SeBackupPrivilege 1364 Skype_8.100.210.exe Token: SeRestorePrivilege 1364 Skype_8.100.210.exe Token: SeShutdownPrivilege 1364 Skype_8.100.210.exe Token: SeDebugPrivilege 1364 Skype_8.100.210.exe Token: SeAuditPrivilege 1364 Skype_8.100.210.exe Token: SeSystemEnvironmentPrivilege 1364 Skype_8.100.210.exe Token: SeChangeNotifyPrivilege 1364 Skype_8.100.210.exe Token: SeRemoteShutdownPrivilege 1364 Skype_8.100.210.exe Token: SeUndockPrivilege 1364 Skype_8.100.210.exe Token: SeSyncAgentPrivilege 1364 Skype_8.100.210.exe Token: SeEnableDelegationPrivilege 1364 Skype_8.100.210.exe Token: SeManageVolumePrivilege 1364 Skype_8.100.210.exe Token: SeImpersonatePrivilege 1364 Skype_8.100.210.exe Token: SeCreateGlobalPrivilege 1364 Skype_8.100.210.exe Token: SeCreateTokenPrivilege 1364 Skype_8.100.210.exe Token: SeAssignPrimaryTokenPrivilege 1364 Skype_8.100.210.exe Token: SeLockMemoryPrivilege 1364 Skype_8.100.210.exe Token: SeIncreaseQuotaPrivilege 1364 Skype_8.100.210.exe Token: SeMachineAccountPrivilege 1364 Skype_8.100.210.exe Token: SeTcbPrivilege 1364 Skype_8.100.210.exe Token: SeSecurityPrivilege 1364 Skype_8.100.210.exe Token: SeTakeOwnershipPrivilege 1364 Skype_8.100.210.exe Token: SeLoadDriverPrivilege 1364 Skype_8.100.210.exe Token: SeSystemProfilePrivilege 1364 Skype_8.100.210.exe Token: SeSystemtimePrivilege 1364 Skype_8.100.210.exe Token: SeProfSingleProcessPrivilege 1364 Skype_8.100.210.exe Token: SeIncBasePriorityPrivilege 1364 Skype_8.100.210.exe Token: SeCreatePagefilePrivilege 1364 Skype_8.100.210.exe Token: SeCreatePermanentPrivilege 1364 Skype_8.100.210.exe Token: SeBackupPrivilege 1364 Skype_8.100.210.exe Token: SeRestorePrivilege 1364 Skype_8.100.210.exe Token: SeShutdownPrivilege 1364 Skype_8.100.210.exe Token: SeDebugPrivilege 1364 Skype_8.100.210.exe Token: SeAuditPrivilege 1364 Skype_8.100.210.exe Token: SeSystemEnvironmentPrivilege 1364 Skype_8.100.210.exe Token: SeChangeNotifyPrivilege 1364 Skype_8.100.210.exe Token: SeRemoteShutdownPrivilege 1364 Skype_8.100.210.exe Token: SeUndockPrivilege 1364 Skype_8.100.210.exe Token: SeSyncAgentPrivilege 1364 Skype_8.100.210.exe Token: SeEnableDelegationPrivilege 1364 Skype_8.100.210.exe Token: SeManageVolumePrivilege 1364 Skype_8.100.210.exe Token: SeImpersonatePrivilege 1364 Skype_8.100.210.exe Token: SeCreateGlobalPrivilege 1364 Skype_8.100.210.exe Token: SeCreateTokenPrivilege 1364 Skype_8.100.210.exe Token: SeAssignPrimaryTokenPrivilege 1364 Skype_8.100.210.exe Token: SeLockMemoryPrivilege 1364 Skype_8.100.210.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1364 Skype_8.100.210.exe 2208 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1988 wrote to memory of 3000 1988 msiexec.exe 31 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1364 wrote to memory of 2208 1364 Skype_8.100.210.exe 32 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33 PID 1988 wrote to memory of 2676 1988 msiexec.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Skype_8.100.210.exe"C:\Users\Admin\AppData\Local\Temp\Skype_8.100.210.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Skype\Skype 07\install\Skype.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Skype_8.100.210.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1695651655 "2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2208
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7C0D9F8D0A547DF29565EADB1B11724 C2⤵
- Loads dropped DLL
PID:3000
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C121902DFAC038420E5C74F649862485 C2⤵
- Loads dropped DLL
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
1.7MB
MD518194177dadf1e551a3c597f0c25f08c
SHA18523271b94c2d974535c0365e7856f625d79970a
SHA256e93352a2cb8c988beb482ae4d6adeffb7ee2e9e3d4bb7261ef39d9db845bdcd2
SHA5121ad4507207b36c9c1737e8e63d71cefaac13ed7c6f666ea6600a5df730520520abb3eda467cc16dfca92e860e0a74464909e503ce5b4900419bd2b8ab608f3c6
-
Filesize
1.7MB
MD518194177dadf1e551a3c597f0c25f08c
SHA18523271b94c2d974535c0365e7856f625d79970a
SHA256e93352a2cb8c988beb482ae4d6adeffb7ee2e9e3d4bb7261ef39d9db845bdcd2
SHA5121ad4507207b36c9c1737e8e63d71cefaac13ed7c6f666ea6600a5df730520520abb3eda467cc16dfca92e860e0a74464909e503ce5b4900419bd2b8ab608f3c6
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1
-
Filesize
374KB
MD55e33a5224c4d523a2517ba8a96aaff42
SHA112e41a9380cc890053b5c7e19769c76bfa1608d4
SHA256d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c
SHA512bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1