Overview
overview
10Static
static
338e2e62159...f0.exe
windows7-x64
138e2e62159...f0.exe
windows10-2004-x64
1404967d9e5...97.ps1
windows7-x64
1404967d9e5...97.ps1
windows10-2004-x64
104c09176981...b0.exe
windows7-x64
14c09176981...b0.exe
windows10-2004-x64
35677616933...f8.exe
windows7-x64
35677616933...f8.exe
windows10-2004-x64
35c72bdbde9...05.exe
windows7-x64
35c72bdbde9...05.exe
windows10-2004-x64
3843c440786...d5.pdf
windows7-x64
1843c440786...d5.pdf
windows10-2004-x64
19859a4209a...e7.bat
windows7-x64
79859a4209a...e7.bat
windows10-2004-x64
7Global B s...or.exe
windows7-x64
4Global B s...or.exe
windows10-2004-x64
4a713b4f480...f4.exe
windows7-x64
3a713b4f480...f4.exe
windows10-2004-x64
3aeb663f8d0...c6.exe
windows7-x64
3aeb663f8d0...c6.exe
windows10-2004-x64
3b029b40bad...7f.msi
windows7-x64
7b029b40bad...7f.msi
windows10-2004-x64
7c98083c89b...350.js
windows7-x64
10c98083c89b...350.js
windows10-2004-x64
10ce7a72d234...c4.exe
windows7-x64
1ce7a72d234...c4.exe
windows10-2004-x64
1dc1bab58ae...58.vbs
windows7-x64
1dc1bab58ae...58.vbs
windows10-2004-x64
1Analysis
-
max time kernel
241s -
max time network
232s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 11:29
Static task
static1
Behavioral task
behavioral1
Sample
38e2e621598702cd37731440444d631ab9d799c6876765dbd418403033b94bf0.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
38e2e621598702cd37731440444d631ab9d799c6876765dbd418403033b94bf0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
404967d9e5bf0c8c4158e88c8df50c913c334e62d54c9de0f1dbd1bf5da57497.ps1
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral4
Sample
404967d9e5bf0c8c4158e88c8df50c913c334e62d54c9de0f1dbd1bf5da57497.ps1
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
4c09176981ccb4d6f7c48c6c88d4aad6ec13d5ad9b8afe41cdb40c749933f6b0.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral6
Sample
4c09176981ccb4d6f7c48c6c88d4aad6ec13d5ad9b8afe41cdb40c749933f6b0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral8
Sample
56776169335b8d2db22dba1ae47629f3e3e73a9a1d4f2c9cc6c7bcdd99b5fff8.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
5c72bdbde9604fe063ee6f9ff6dcb0ff0e67a85dea42ea9b6e1eca544fe95005.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral10
Sample
5c72bdbde9604fe063ee6f9ff6dcb0ff0e67a85dea42ea9b6e1eca544fe95005.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
843c4407865ab4d809f0e3b8a581bab50a330ad98c926d0f10540f451b6611d5.pdf
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral12
Sample
843c4407865ab4d809f0e3b8a581bab50a330ad98c926d0f10540f451b6611d5.pdf
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
9859a4209ac3b00448b7552b993ff8120f0e7e7568b1c7ae55bf1f104889b3e7.bat
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral14
Sample
9859a4209ac3b00448b7552b993ff8120f0e7e7568b1c7ae55bf1f104889b3e7.bat
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Global B seed calculator.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral16
Sample
Global B seed calculator.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
a713b4f480f15ef37e9f69efbe6ce77c9a24db0176d4225091d6910ab4daf0f4.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral18
Sample
a713b4f480f15ef37e9f69efbe6ce77c9a24db0176d4225091d6910ab4daf0f4.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
aeb663f8d0523fa21c265cc50ddb6eca80a8eb593d34520acd79c7da0cec02c6.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral20
Sample
aeb663f8d0523fa21c265cc50ddb6eca80a8eb593d34520acd79c7da0cec02c6.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
b029b40badab029cbd916ab2e5147e9f01abd147e1bf9e5ed1564ee44a0d087f.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral22
Sample
b029b40badab029cbd916ab2e5147e9f01abd147e1bf9e5ed1564ee44a0d087f.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
c98083c89ba696fdc10a9528722e8673f70b0b1872b52fbda472a38d4cfbf350.js
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral24
Sample
c98083c89ba696fdc10a9528722e8673f70b0b1872b52fbda472a38d4cfbf350.js
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ce7a72d2347fe2011815098caa7b5cb881a97780634ff1354194ab4865a6e0c4.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral26
Sample
ce7a72d2347fe2011815098caa7b5cb881a97780634ff1354194ab4865a6e0c4.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
dc1bab58ae5af6a4b8051a148d96ae713f319327959225d1860ab910f27e2658.vbs
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral28
Sample
dc1bab58ae5af6a4b8051a148d96ae713f319327959225d1860ab910f27e2658.vbs
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
b029b40badab029cbd916ab2e5147e9f01abd147e1bf9e5ed1564ee44a0d087f.msi
-
Size
3.4MB
-
MD5
5d9e72d1e3a99bec71fad561fa95037c
-
SHA1
fbc94c649ba3d8bb6c7e1d98e7fdeea40cd395b2
-
SHA256
b029b40badab029cbd916ab2e5147e9f01abd147e1bf9e5ed1564ee44a0d087f
-
SHA512
8d0311d94a0de8646ec2733530a2db7d2c6e2b03f54e54ac0bc84538a636fe8211e6a582530d9ea8cd02ba08e259d778498d6f29e6744ba45f434d2a87874c97
-
SSDEEP
49152:E6rGohlj9szAlopTyWD57kEv53rw6cvOlM3w99xYF/gr/QaTdxKJWNYCILZ:qoSTyqk7vvO8Q9xU/w/QPOI9
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 4364 MsiExec.exe 4364 MsiExec.exe 4364 MsiExec.exe 4364 MsiExec.exe 4364 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{F345E384-B24F-4B23-A9A8-CF9B1BB5EFAE} msiexec.exe File opened for modification C:\Windows\Installer\e59ef77.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7300.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB5A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICF0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e59ef77.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI5C0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEE2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI39AF.tmp msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2448 msiexec.exe 2448 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2640 msiexec.exe Token: SeIncreaseQuotaPrivilege 2640 msiexec.exe Token: SeSecurityPrivilege 2448 msiexec.exe Token: SeCreateTokenPrivilege 2640 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2640 msiexec.exe Token: SeLockMemoryPrivilege 2640 msiexec.exe Token: SeIncreaseQuotaPrivilege 2640 msiexec.exe Token: SeMachineAccountPrivilege 2640 msiexec.exe Token: SeTcbPrivilege 2640 msiexec.exe Token: SeSecurityPrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeLoadDriverPrivilege 2640 msiexec.exe Token: SeSystemProfilePrivilege 2640 msiexec.exe Token: SeSystemtimePrivilege 2640 msiexec.exe Token: SeProfSingleProcessPrivilege 2640 msiexec.exe Token: SeIncBasePriorityPrivilege 2640 msiexec.exe Token: SeCreatePagefilePrivilege 2640 msiexec.exe Token: SeCreatePermanentPrivilege 2640 msiexec.exe Token: SeBackupPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeShutdownPrivilege 2640 msiexec.exe Token: SeDebugPrivilege 2640 msiexec.exe Token: SeAuditPrivilege 2640 msiexec.exe Token: SeSystemEnvironmentPrivilege 2640 msiexec.exe Token: SeChangeNotifyPrivilege 2640 msiexec.exe Token: SeRemoteShutdownPrivilege 2640 msiexec.exe Token: SeUndockPrivilege 2640 msiexec.exe Token: SeSyncAgentPrivilege 2640 msiexec.exe Token: SeEnableDelegationPrivilege 2640 msiexec.exe Token: SeManageVolumePrivilege 2640 msiexec.exe Token: SeImpersonatePrivilege 2640 msiexec.exe Token: SeCreateGlobalPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2640 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2448 wrote to memory of 4364 2448 msiexec.exe 90 PID 2448 wrote to memory of 4364 2448 msiexec.exe 90 PID 2448 wrote to memory of 4364 2448 msiexec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b029b40badab029cbd916ab2e5147e9f01abd147e1bf9e5ed1564ee44a0d087f.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2640
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B268BDEE2DF27DDF5DEFE3B137BF50C32⤵
- Loads dropped DLL
PID:4364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD575a409b14dc4ab5ca768e25a98777664
SHA18d0199c37d85aac5a641687b182162dc2dbc6ea6
SHA2568140fbe4fa0e3b075569a8c33a1eaab5e59ed529f716d9b98c435fdd4cbd4028
SHA51228dc08c64f40deebcec05a4524d1d744707e9975ca796096e5dcd199daa43d0ce7f7800947ebb3144f7d365f9190045237c39e4e6e78f8c775aa482b5f79fa2f
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a
-
Filesize
719KB
MD589f70b588a48793450dd603b6cd4096f
SHA19b6509c031856c715d62853c4e93efbdf48d5aeb
SHA256066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
SHA512fb04c530430eea6149fd7216f64751e641394a66c0cb222f70c29361baa621a78f906e0adff19bd4cbe5de69edcea7e40bff7c2e068fd4dbd057ca6494db861a