Analysis

  • max time kernel
    292s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-es
  • resource tags

    arch:x64arch:x86image:win7-20230831-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    02-10-2023 14:55

General

  • Target

  • Size

    10.3MB

  • MD5

    992c82588ded6e98b3cb3722215e93f7

  • SHA1

    ed8c79e631efd261b86a63bc33eb8d7b9d620f56

  • SHA256

    eaf48d4a801299a857b6217d650dbedd7711482971a20cf9273813a8b2052949

  • SHA512

    18cd9989a821dc299eb51b8ea255666e308479f62417b8ea53593e9a3e9c3c4ee7d1898849872d384ca60b3b2c12fdf95d20c8326db0583e923b7c9e6e6cbeae

  • SSDEEP

    49152:OVfU/PIAMJQChq91XrQxsHcFTSalJ+GbBV67lj6dJ538yAVVU6a9UcZM17Iw/L8M:bIRTqbpcJ5wVVXH4rsyzA0

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\[email protected]
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1900
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A7034D81D9518CCF24765CC04751D056
      2⤵
      • Loads dropped DLL
      PID:2276
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 89A8DCF8BAF51BC742AECCD01BFC6B45
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\xvlsgkzs\Raspberry.exe
        "C:\xvlsgkzs\Raspberry.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        PID:2512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f768a3a.rbs

    Filesize

    571B

    MD5

    2bc17eff31b5df49671f52d389ecebcb

    SHA1

    b5a656dc45ac0f8fb9dc2ceeb69df12c4cc24fa7

    SHA256

    8b59eb68d4284ff060f7d5964b7881bf684793f70ca2f25eff6935e356a743c0

    SHA512

    c1b2df9bcb104c0e435f56e851d7387d103138857fb7539f50d3b8fdc18af916a4c57c20f206b5b183171b630b0b1823ca1478abe0941e549834fbebc269369c

  • C:\Windows\Installer\MSI8B7D.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI8F55.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI8FD3.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI8FD3.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • C:\Windows\Installer\MSI963C.tmp

    Filesize

    9.2MB

    MD5

    b97d11c60b8671f3fa4f0f223c380284

    SHA1

    1eec15a8d7254f64e6ef37246d5a80b8a1306c78

    SHA256

    3faa2be8a3f2ef31038e5457bef9cbe4df43dc8d8814eb7e82fa9800e2044632

    SHA512

    21e9c40c5b1d10bbbee3e1f897e665ba6606fb47607187db2913daefd67ce65321197db30b405b6ca5ab1c848924c7e28b99e5722796ce06f970bba845bd573b

  • C:\xvlsgkzs\Raspberry.exe

    Filesize

    5.0MB

    MD5

    18a2da2200f4003283e21ccf4934e2f0

    SHA1

    a89d69020672b3f19a61612001c4b36d5c8c0b8a

    SHA256

    042e5050d9ec13604600373da1a5b513cfb1c4ec8ca13c30d1df3c81e619ad88

    SHA512

    17e51f32a42dc5e368aba69ea70b35abb863f730586266f28b8f3d69586366203e05203e1be0fa04e78b578149e822d6f4290410876bc0caf98d8a6525cac09b

  • C:\xvlsgkzs\Raspberry.exe

    Filesize

    5.0MB

    MD5

    18a2da2200f4003283e21ccf4934e2f0

    SHA1

    a89d69020672b3f19a61612001c4b36d5c8c0b8a

    SHA256

    042e5050d9ec13604600373da1a5b513cfb1c4ec8ca13c30d1df3c81e619ad88

    SHA512

    17e51f32a42dc5e368aba69ea70b35abb863f730586266f28b8f3d69586366203e05203e1be0fa04e78b578149e822d6f4290410876bc0caf98d8a6525cac09b

  • C:\xvlsgkzs\Raspberry.exe

    Filesize

    5.0MB

    MD5

    18a2da2200f4003283e21ccf4934e2f0

    SHA1

    a89d69020672b3f19a61612001c4b36d5c8c0b8a

    SHA256

    042e5050d9ec13604600373da1a5b513cfb1c4ec8ca13c30d1df3c81e619ad88

    SHA512

    17e51f32a42dc5e368aba69ea70b35abb863f730586266f28b8f3d69586366203e05203e1be0fa04e78b578149e822d6f4290410876bc0caf98d8a6525cac09b

  • C:\xvlsgkzs\dragdropfilesdll.dll

    Filesize

    32.2MB

    MD5

    9557b0b5c7f9a3f50803eea529363b0b

    SHA1

    00beee4299ae561038b913defd2705f6f115c343

    SHA256

    15fc01c1bf14d19fe2e6d43ea999efd9c7d7bcc29aae38e2a71b70494621a563

    SHA512

    b5fe44de9804f3dcdec911ee29dcd8b584d9ecb82f8d92fee8fb49688174c56bc40f1e3c7513943ba3b2dd7effba8582a1133f3023ad07feae1d8d3e11c54438

  • \Windows\Installer\MSI8B7D.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • \Windows\Installer\MSI8F55.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • \Windows\Installer\MSI8FD3.tmp

    Filesize

    554KB

    MD5

    3b171ce087bb799aafcbbd93bab27f71

    SHA1

    7bd69efbc7797bdff5510830ca2cc817c8b86d08

    SHA256

    bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4

    SHA512

    7700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38

  • \Windows\Installer\MSI963C.tmp

    Filesize

    9.2MB

    MD5

    b97d11c60b8671f3fa4f0f223c380284

    SHA1

    1eec15a8d7254f64e6ef37246d5a80b8a1306c78

    SHA256

    3faa2be8a3f2ef31038e5457bef9cbe4df43dc8d8814eb7e82fa9800e2044632

    SHA512

    21e9c40c5b1d10bbbee3e1f897e665ba6606fb47607187db2913daefd67ce65321197db30b405b6ca5ab1c848924c7e28b99e5722796ce06f970bba845bd573b

  • \xvlsgkzs\dragdropfilesdll.dll

    Filesize

    32.2MB

    MD5

    9557b0b5c7f9a3f50803eea529363b0b

    SHA1

    00beee4299ae561038b913defd2705f6f115c343

    SHA256

    15fc01c1bf14d19fe2e6d43ea999efd9c7d7bcc29aae38e2a71b70494621a563

    SHA512

    b5fe44de9804f3dcdec911ee29dcd8b584d9ecb82f8d92fee8fb49688174c56bc40f1e3c7513943ba3b2dd7effba8582a1133f3023ad07feae1d8d3e11c54438

  • memory/2512-64-0x000000000E4B0000-0x000000000E4B1000-memory.dmp

    Filesize

    4KB

  • memory/2512-76-0x000000000E6C0000-0x000000000E6C1000-memory.dmp

    Filesize

    4KB

  • memory/2512-107-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-44-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2512-60-0x000000000E4E0000-0x000000000E58B000-memory.dmp

    Filesize

    684KB

  • memory/2512-61-0x000000000E4B0000-0x000000000E4B1000-memory.dmp

    Filesize

    4KB

  • memory/2512-40-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-67-0x000000000E690000-0x000000000E691000-memory.dmp

    Filesize

    4KB

  • memory/2512-69-0x0000000076FCF000-0x0000000076FD0000-memory.dmp

    Filesize

    4KB

  • memory/2512-72-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2512-74-0x000000000E4E0000-0x000000000E58B000-memory.dmp

    Filesize

    684KB

  • memory/2512-105-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-78-0x000000000E6D0000-0x000000000E6D1000-memory.dmp

    Filesize

    4KB

  • memory/2512-80-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-81-0x000000000E4E0000-0x000000000E58B000-memory.dmp

    Filesize

    684KB

  • memory/2512-82-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-89-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-95-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2512-101-0x0000000001920000-0x00000000039EC000-memory.dmp

    Filesize

    32.8MB

  • memory/2608-45-0x0000000072A70000-0x00000000733B8000-memory.dmp

    Filesize

    9.3MB

  • memory/2608-52-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB