Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup1.msi
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup1.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
setup.exe
-
Size
542KB
-
MD5
005956f016f3f0a1ffc2043d752bad82
-
SHA1
45cb3d708ea40c8d58673436b4f9c997ebdb3367
-
SHA256
227fa090bb3a12a9244eaced86c2436b2382c6cfb0cc14f2f1f553c02f0ea30c
-
SHA512
c44f2808ca766bf66190aeb33560c0e4bec61f473065af1fb66af98332fa2e3cffd2af3d7d4ea9cff84ca9637db86cb6fb070f0a3624e74cd71aff58a88ec45d
-
SSDEEP
12288:YxrY9A/mSkf0FrgcdVm79QHpVdeMb01JQntLOC+ga:YpWA/mjf0s9QJVdem+
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2888 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 2888 msiexec.exe Token: SeIncreaseQuotaPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2276 msiexec.exe Token: SeTakeOwnershipPrivilege 2276 msiexec.exe Token: SeSecurityPrivilege 2276 msiexec.exe Token: SeCreateTokenPrivilege 2888 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2888 msiexec.exe Token: SeLockMemoryPrivilege 2888 msiexec.exe Token: SeIncreaseQuotaPrivilege 2888 msiexec.exe Token: SeMachineAccountPrivilege 2888 msiexec.exe Token: SeTcbPrivilege 2888 msiexec.exe Token: SeSecurityPrivilege 2888 msiexec.exe Token: SeTakeOwnershipPrivilege 2888 msiexec.exe Token: SeLoadDriverPrivilege 2888 msiexec.exe Token: SeSystemProfilePrivilege 2888 msiexec.exe Token: SeSystemtimePrivilege 2888 msiexec.exe Token: SeProfSingleProcessPrivilege 2888 msiexec.exe Token: SeIncBasePriorityPrivilege 2888 msiexec.exe Token: SeCreatePagefilePrivilege 2888 msiexec.exe Token: SeCreatePermanentPrivilege 2888 msiexec.exe Token: SeBackupPrivilege 2888 msiexec.exe Token: SeRestorePrivilege 2888 msiexec.exe Token: SeShutdownPrivilege 2888 msiexec.exe Token: SeDebugPrivilege 2888 msiexec.exe Token: SeAuditPrivilege 2888 msiexec.exe Token: SeSystemEnvironmentPrivilege 2888 msiexec.exe Token: SeChangeNotifyPrivilege 2888 msiexec.exe Token: SeRemoteShutdownPrivilege 2888 msiexec.exe Token: SeUndockPrivilege 2888 msiexec.exe Token: SeSyncAgentPrivilege 2888 msiexec.exe Token: SeEnableDelegationPrivilege 2888 msiexec.exe Token: SeManageVolumePrivilege 2888 msiexec.exe Token: SeImpersonatePrivilege 2888 msiexec.exe Token: SeCreateGlobalPrivilege 2888 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2888 1936 setup.exe 28 PID 1936 wrote to memory of 2888 1936 setup.exe 28 PID 1936 wrote to memory of 2888 1936 setup.exe 28 PID 1936 wrote to memory of 2888 1936 setup.exe 28 PID 1936 wrote to memory of 2888 1936 setup.exe 28 PID 1936 wrote to memory of 2888 1936 setup.exe 28 PID 1936 wrote to memory of 2888 1936 setup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\Setup1.msi"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2888
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276