e64775374097f1b1c8fd4173f7d5be4305b88cec26a56d003113aff2837ae08e

General

Target

putty-64bit-0.78-installer.msi
Size

3.5MB
MD5

108b432c4dc0a66b657d985e180bec71
SHA1

262812d43303b7ddc7c04a1c243172ebe6579f00
SHA256

e64775374097f1b1c8fd4173f7d5be4305b88cec26a56d003113aff2837ae08e
SHA512

5ddb97078b417f22c54dce768564dec58fd92a9c190f7a6cac9c7979a0f136dd439da1d59dd3c088e709433f5c4f79c033abd4b6ca8989d38620c20f4623386e
SSDEEP

98304:Ujhyh9EoxGHgBRn8Tg4IDrwRW8FMDMb34+NHC6:UjhyJPR8Tg4IDrwdFMD048

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

3 1016 msiexec.exe
5 1016 msiexec.exe
7 1016 msiexec.exe
9 1016 msiexec.exe

flow	pid	process
3	1016	msiexec.exe
5	1016	msiexec.exe
7	1016	msiexec.exe
9	1016	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

1016 msiexec.exe

pid	process
1016	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeSecurityPrivilege	2524	msiexec.exe
Token: SeCreateTokenPrivilege	1016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1016	msiexec.exe
Token: SeLockMemoryPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeMachineAccountPrivilege	1016	msiexec.exe
Token: SeTcbPrivilege	1016	msiexec.exe
Token: SeSecurityPrivilege	1016	msiexec.exe
Token: SeTakeOwnershipPrivilege	1016	msiexec.exe
Token: SeLoadDriverPrivilege	1016	msiexec.exe
Token: SeSystemProfilePrivilege	1016	msiexec.exe
Token: SeSystemtimePrivilege	1016	msiexec.exe
Token: SeProfSingleProcessPrivilege	1016	msiexec.exe
Token: SeIncBasePriorityPrivilege	1016	msiexec.exe
Token: SeCreatePagefilePrivilege	1016	msiexec.exe
Token: SeCreatePermanentPrivilege	1016	msiexec.exe
Token: SeBackupPrivilege	1016	msiexec.exe
Token: SeRestorePrivilege	1016	msiexec.exe
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeDebugPrivilege	1016	msiexec.exe
Token: SeAuditPrivilege	1016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1016	msiexec.exe
Token: SeChangeNotifyPrivilege	1016	msiexec.exe
Token: SeRemoteShutdownPrivilege	1016	msiexec.exe
Token: SeUndockPrivilege	1016	msiexec.exe
Token: SeSyncAgentPrivilege	1016	msiexec.exe
Token: SeEnableDelegationPrivilege	1016	msiexec.exe
Token: SeManageVolumePrivilege	1016	msiexec.exe
Token: SeImpersonatePrivilege	1016	msiexec.exe
Token: SeCreateGlobalPrivilege	1016	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1016 msiexec.exe

pid	process
1016	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\putty-64bit-0.78-installer.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab8835.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A79.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit

Analysis

Sharing