Analysis
-
max time kernel
123s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 01:03
Behavioral task
behavioral1
Sample
Android Fastboot & mini ADB Drivers/Android ADB Fastboot 1.7.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Android Fastboot & mini ADB Drivers/Android ADB Fastboot 1.7.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral4
Sample
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Android Fastboot & mini ADB Drivers/adb-setup-1.4.3.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral6
Sample
Android Fastboot & mini ADB Drivers/adb-setup-1.4.3.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
-
Size
16.3MB
-
MD5
a0b1cc7c5c26044738798ba2e5e8c217
-
SHA1
745bb99063748a2f309888467aac70c3c7ef6a2e
-
SHA256
4e77e303bba6cf84588bdb6da91f7a875d406f7930cbe9f4d2aae0b643c0c928
-
SHA512
2030a9e6cc935b40ac173bdcad434e200c36854b321da4324411e3ac58852445270a7aca379fd7c46ac95bf72a34fa924667cba5c7050af97d42880892e983f4
-
SSDEEP
393216:Hc2Ryzq2+0lkPEezmlMUH9n0sEf0/c++oLw525IgfLJ5pz3:azHPKmVB0MUzMw525ljpz
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 2564 MsiExec.exe 2564 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid Process 2552 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 2552 msiexec.exe Token: SeIncreaseQuotaPrivilege 2552 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeSecurityPrivilege 2676 msiexec.exe Token: SeCreateTokenPrivilege 2552 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2552 msiexec.exe Token: SeLockMemoryPrivilege 2552 msiexec.exe Token: SeIncreaseQuotaPrivilege 2552 msiexec.exe Token: SeMachineAccountPrivilege 2552 msiexec.exe Token: SeTcbPrivilege 2552 msiexec.exe Token: SeSecurityPrivilege 2552 msiexec.exe Token: SeTakeOwnershipPrivilege 2552 msiexec.exe Token: SeLoadDriverPrivilege 2552 msiexec.exe Token: SeSystemProfilePrivilege 2552 msiexec.exe Token: SeSystemtimePrivilege 2552 msiexec.exe Token: SeProfSingleProcessPrivilege 2552 msiexec.exe Token: SeIncBasePriorityPrivilege 2552 msiexec.exe Token: SeCreatePagefilePrivilege 2552 msiexec.exe Token: SeCreatePermanentPrivilege 2552 msiexec.exe Token: SeBackupPrivilege 2552 msiexec.exe Token: SeRestorePrivilege 2552 msiexec.exe Token: SeShutdownPrivilege 2552 msiexec.exe Token: SeDebugPrivilege 2552 msiexec.exe Token: SeAuditPrivilege 2552 msiexec.exe Token: SeSystemEnvironmentPrivilege 2552 msiexec.exe Token: SeChangeNotifyPrivilege 2552 msiexec.exe Token: SeRemoteShutdownPrivilege 2552 msiexec.exe Token: SeUndockPrivilege 2552 msiexec.exe Token: SeSyncAgentPrivilege 2552 msiexec.exe Token: SeEnableDelegationPrivilege 2552 msiexec.exe Token: SeManageVolumePrivilege 2552 msiexec.exe Token: SeImpersonatePrivilege 2552 msiexec.exe Token: SeCreateGlobalPrivilege 2552 msiexec.exe Token: SeCreateTokenPrivilege 2552 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2552 msiexec.exe Token: SeLockMemoryPrivilege 2552 msiexec.exe Token: SeIncreaseQuotaPrivilege 2552 msiexec.exe Token: SeMachineAccountPrivilege 2552 msiexec.exe Token: SeTcbPrivilege 2552 msiexec.exe Token: SeSecurityPrivilege 2552 msiexec.exe Token: SeTakeOwnershipPrivilege 2552 msiexec.exe Token: SeLoadDriverPrivilege 2552 msiexec.exe Token: SeSystemProfilePrivilege 2552 msiexec.exe Token: SeSystemtimePrivilege 2552 msiexec.exe Token: SeProfSingleProcessPrivilege 2552 msiexec.exe Token: SeIncBasePriorityPrivilege 2552 msiexec.exe Token: SeCreatePagefilePrivilege 2552 msiexec.exe Token: SeCreatePermanentPrivilege 2552 msiexec.exe Token: SeBackupPrivilege 2552 msiexec.exe Token: SeRestorePrivilege 2552 msiexec.exe Token: SeShutdownPrivilege 2552 msiexec.exe Token: SeDebugPrivilege 2552 msiexec.exe Token: SeAuditPrivilege 2552 msiexec.exe Token: SeSystemEnvironmentPrivilege 2552 msiexec.exe Token: SeChangeNotifyPrivilege 2552 msiexec.exe Token: SeRemoteShutdownPrivilege 2552 msiexec.exe Token: SeUndockPrivilege 2552 msiexec.exe Token: SeSyncAgentPrivilege 2552 msiexec.exe Token: SeEnableDelegationPrivilege 2552 msiexec.exe Token: SeManageVolumePrivilege 2552 msiexec.exe Token: SeImpersonatePrivilege 2552 msiexec.exe Token: SeCreateGlobalPrivilege 2552 msiexec.exe Token: SeCreateTokenPrivilege 2552 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid Process 2552 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 2676 wrote to memory of 2564 2676 msiexec.exe 29 PID 2676 wrote to memory of 2564 2676 msiexec.exe 29 PID 2676 wrote to memory of 2564 2676 msiexec.exe 29 PID 2676 wrote to memory of 2564 2676 msiexec.exe 29 PID 2676 wrote to memory of 2564 2676 msiexec.exe 29 PID 2676 wrote to memory of 2564 2676 msiexec.exe 29 PID 2676 wrote to memory of 2564 2676 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Android Fastboot & mini ADB Drivers\UniversalAdbDriverSetup.msi"1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2552
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C78EDB1B6E71F8DC59B1A8432E9956E2 C2⤵
- Loads dropped DLL
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613