Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
Setup_SmartRFProgr_1.12.7.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Setup_SmartRFProgr_1.12.7.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
Setup_SmartRFProgr_1.12.7.exe
-
Size
24.3MB
-
MD5
56d2e3c7b1bf5d8bccea74258d220789
-
SHA1
f84dcebf15eadee49116192a76a71bf2986147e8
-
SHA256
666cd195137e722b8cf2d1ffdf6bbf7d78181d2e535a08e27a8e874219e7a1f3
-
SHA512
e9e2f076f6772670dd962a3bd7fae95488a1b58fa80d1f05e9b16786f2822f8a250164d18888576f4eacaaf7534895b947fedacbd150f678d8e5255c5afc345e
-
SSDEEP
393216:E4A9AL9NTfkKMxnSJhnXB5e8p+Hivv3HQpFdKwOYYn69OCcu9o1XGcm507aO:wm9NjkKM8Jhnbe8pP3OOiAt5Gcm5i
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2416 MsiExec.exe 2416 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2172 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2172 MSIEXEC.EXE Token: SeRestorePrivilege 2124 msiexec.exe Token: SeTakeOwnershipPrivilege 2124 msiexec.exe Token: SeSecurityPrivilege 2124 msiexec.exe Token: SeCreateTokenPrivilege 2172 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2172 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2172 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2172 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2172 MSIEXEC.EXE Token: SeTcbPrivilege 2172 MSIEXEC.EXE Token: SeSecurityPrivilege 2172 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2172 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2172 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2172 MSIEXEC.EXE Token: SeSystemtimePrivilege 2172 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2172 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2172 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2172 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2172 MSIEXEC.EXE Token: SeBackupPrivilege 2172 MSIEXEC.EXE Token: SeRestorePrivilege 2172 MSIEXEC.EXE Token: SeShutdownPrivilege 2172 MSIEXEC.EXE Token: SeDebugPrivilege 2172 MSIEXEC.EXE Token: SeAuditPrivilege 2172 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2172 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2172 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2172 MSIEXEC.EXE Token: SeUndockPrivilege 2172 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2172 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2172 MSIEXEC.EXE Token: SeManageVolumePrivilege 2172 MSIEXEC.EXE Token: SeImpersonatePrivilege 2172 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2172 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2172 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2172 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2172 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2172 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2172 MSIEXEC.EXE Token: SeTcbPrivilege 2172 MSIEXEC.EXE Token: SeSecurityPrivilege 2172 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2172 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2172 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2172 MSIEXEC.EXE Token: SeSystemtimePrivilege 2172 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2172 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2172 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2172 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2172 MSIEXEC.EXE Token: SeBackupPrivilege 2172 MSIEXEC.EXE Token: SeRestorePrivilege 2172 MSIEXEC.EXE Token: SeShutdownPrivilege 2172 MSIEXEC.EXE Token: SeDebugPrivilege 2172 MSIEXEC.EXE Token: SeAuditPrivilege 2172 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2172 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2172 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2172 MSIEXEC.EXE Token: SeUndockPrivilege 2172 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2172 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2172 MSIEXEC.EXE Token: SeManageVolumePrivilege 2172 MSIEXEC.EXE Token: SeImpersonatePrivilege 2172 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2172 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2172 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1400 Setup_SmartRFProgr_1.12.7.exe 2172 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 1400 wrote to memory of 2172 1400 Setup_SmartRFProgr_1.12.7.exe 28 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30 PID 2124 wrote to memory of 2416 2124 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_SmartRFProgr_1.12.7.exe"C:\Users\Admin\AppData\Local\Temp\Setup_SmartRFProgr_1.12.7.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{02E5D6A9-22AD-49BF-B74B-1D85577B8D8E}\Setup_SmartRFProgr.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="Setup_SmartRFProgr_1.12.7.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2172
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9D729AD8E00DC2E24DB5299B6969F59 C2⤵
- Loads dropped DLL
PID:2416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD590ed4938fd712e3ac49dfdff0ff63cc0
SHA1f3ae0ec59bd8fcb578310942bbf17c047d4895c9
SHA2569d3eee64d97e0b082a2ab26f997b29fd6f16bb49a70b711fdc241fca079c788b
SHA512c35ae7a402a01155a9aca294ee88a4029eeb2c560c25a33acb3e35d7060f8fa02d6bc0289b6cf44ed4e516cbd21a7c7b0843172d2686dc3a7270f40be08e0f70
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
-
Filesize
1.3MB
MD57164079be63794315ed16d0c175da36f
SHA1f94e0ae5676ec7f088dc4e14910d4820bc143066
SHA25665f1d4e50720bc6583015f9656a30ce97b429565d27c5ce1616709623912504c
SHA5121abab91a345a3113cce570aea222eaa94e2b8081290b7f3ce9a875c972ad2bb4323de28e3c851f4d062dfc005815b2459a0017509ed40d5b5014d41fff74a066
-
Filesize
20KB
MD536affbd6ff77d1515cfc1c5e998fbaf9
SHA1950d00ecc2e7fd2c48897814029e8eedf6397838
SHA256fccc7f79d29318d8ae78850c262bac762c28858709a6e6cf3b62bcd2729a61e3
SHA5122f29de86d486db783872581a43a834e5064d1488bc3f085ddc5a3287eb9ee8a4ce93d66f7b4965cafb3c4f06b38d4b0fcfdc0fcb1f99d61331a808e5d6011808
-
Filesize
22.8MB
MD549d2373b91b4e8cc77f4849414aca92c
SHA186ddfc1d4bd86b751674a2f98567e538deef35ce
SHA2563ca1a7f8207faea7cc11c353612b00c10e8683c2acc7ad6ae758d67af010b0da
SHA512ea4fa8b828fb0c3bc9c772779f2956a75c9ad94dee5f6a7386f7d26d6f053731dbda671e645b03cf659316e761476d1284d1ccbfdf1bc150f6469eb0ef644a62
-
Filesize
2KB
MD5e873e338d0544d2d01c321add7667c45
SHA17379b97a20355f1a0f25b3a9e74b77d7b49038cf
SHA2563e0c8a89f6db6380d98e286554fcd63ea81a381e3ca2d7204c0f3a18ead35a28
SHA512d570dc897616def7a70d4245045af8c82a357658614cad18ea10afb1248e33bf08b78bd014586fe668aa44e55740c569abf601f247b6099ab5dde9f3815208af
-
Filesize
57KB
MD590ed4938fd712e3ac49dfdff0ff63cc0
SHA1f3ae0ec59bd8fcb578310942bbf17c047d4895c9
SHA2569d3eee64d97e0b082a2ab26f997b29fd6f16bb49a70b711fdc241fca079c788b
SHA512c35ae7a402a01155a9aca294ee88a4029eeb2c560c25a33acb3e35d7060f8fa02d6bc0289b6cf44ed4e516cbd21a7c7b0843172d2686dc3a7270f40be08e0f70
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7