Analysis
-
max time kernel
163s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/10/2023, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe
Resource
win7-20230831-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe
-
Size
2.6MB
-
MD5
ba623f4564d86cdb7210f8de5303c12b
-
SHA1
3badcd6e356c9511ad2e71010fa4684954091e09
-
SHA256
e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b
-
SHA512
83bd63f865496858c46ae821fc5707411c8eb082a2cf3b8d1614602f2246b278199ab97c02e531e84d3c3ad3f716ce2fc20d4533da16fc1608cc0ae34ce0922f
-
SSDEEP
49152:w7lteySYxCTKDTcVFwpleQK7R0KbbV+OOFMob6Ndu/OnEbGJRbTWa+PN9ZvzR:w7ltey3CO0V+iRT1nOdb6y/e/jHz+PNt
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2792 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2464 msiexec.exe Token: SeTakeOwnershipPrivilege 2464 msiexec.exe Token: SeSecurityPrivilege 2464 msiexec.exe Token: SeCreateTokenPrivilege 2792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2792 msiexec.exe Token: SeLockMemoryPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeMachineAccountPrivilege 2792 msiexec.exe Token: SeTcbPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 2792 msiexec.exe Token: SeTakeOwnershipPrivilege 2792 msiexec.exe Token: SeLoadDriverPrivilege 2792 msiexec.exe Token: SeSystemProfilePrivilege 2792 msiexec.exe Token: SeSystemtimePrivilege 2792 msiexec.exe Token: SeProfSingleProcessPrivilege 2792 msiexec.exe Token: SeIncBasePriorityPrivilege 2792 msiexec.exe Token: SeCreatePagefilePrivilege 2792 msiexec.exe Token: SeCreatePermanentPrivilege 2792 msiexec.exe Token: SeBackupPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2792 msiexec.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeDebugPrivilege 2792 msiexec.exe Token: SeAuditPrivilege 2792 msiexec.exe Token: SeSystemEnvironmentPrivilege 2792 msiexec.exe Token: SeChangeNotifyPrivilege 2792 msiexec.exe Token: SeRemoteShutdownPrivilege 2792 msiexec.exe Token: SeUndockPrivilege 2792 msiexec.exe Token: SeSyncAgentPrivilege 2792 msiexec.exe Token: SeEnableDelegationPrivilege 2792 msiexec.exe Token: SeManageVolumePrivilege 2792 msiexec.exe Token: SeImpersonatePrivilege 2792 msiexec.exe Token: SeCreateGlobalPrivilege 2792 msiexec.exe Token: SeBackupPrivilege 2504 vssvc.exe Token: SeRestorePrivilege 2504 vssvc.exe Token: SeAuditPrivilege 2504 vssvc.exe Token: SeBackupPrivilege 2464 msiexec.exe Token: SeRestorePrivilege 2464 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2792 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 PID 3056 wrote to memory of 2792 3056 e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe 29 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe"C:\Users\Admin\AppData\Local\Temp\e345e8e462ee504d5d3df689a0793ba69a3109afe33d80bcdf8c622fbc1aae8b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD58f4f14c48bd5a9731a532bbef574963e
SHA11e5c4191d90bc580274d33c30bb779184597bd1b
SHA25636a34ec1dab2b33d4505b2f9957eaaa0e96ca61edf8cec53e7088cb74a06c3d5
SHA512e39ff25828556c74ebb9be3c5cf2d621b09d34fd19215fee6feb7cc7f24ab22f891e3525ddc508347c3f1b545f14ec952b6859af7c331919da3b13fe62da44cb