Analysis
-
max time kernel
118s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 01:03
Behavioral task
behavioral1
Sample
Android Fastboot & mini ADB Drivers/Android ADB Fastboot 1.7.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Android Fastboot & mini ADB Drivers/Android ADB Fastboot 1.7.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral4
Sample
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
Resource
win10v2004-20230915-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Android Fastboot & mini ADB Drivers/adb-setup-1.4.3.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral6
Sample
Android Fastboot & mini ADB Drivers/adb-setup-1.4.3.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
Android Fastboot & mini ADB Drivers/UniversalAdbDriverSetup.msi
-
Size
16.3MB
-
MD5
a0b1cc7c5c26044738798ba2e5e8c217
-
SHA1
745bb99063748a2f309888467aac70c3c7ef6a2e
-
SHA256
4e77e303bba6cf84588bdb6da91f7a875d406f7930cbe9f4d2aae0b643c0c928
-
SHA512
2030a9e6cc935b40ac173bdcad434e200c36854b321da4324411e3ac58852445270a7aca379fd7c46ac95bf72a34fa924667cba5c7050af97d42880892e983f4
-
SSDEEP
393216:Hc2Ryzq2+0lkPEezmlMUH9n0sEf0/c++oLw525IgfLJ5pz3:azHPKmVB0MUzMw525ljpz
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 5092 MsiExec.exe 5092 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 1056 msiexec.exe Token: SeIncreaseQuotaPrivilege 1056 msiexec.exe Token: SeSecurityPrivilege 4992 msiexec.exe Token: SeCreateTokenPrivilege 1056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1056 msiexec.exe Token: SeLockMemoryPrivilege 1056 msiexec.exe Token: SeIncreaseQuotaPrivilege 1056 msiexec.exe Token: SeMachineAccountPrivilege 1056 msiexec.exe Token: SeTcbPrivilege 1056 msiexec.exe Token: SeSecurityPrivilege 1056 msiexec.exe Token: SeTakeOwnershipPrivilege 1056 msiexec.exe Token: SeLoadDriverPrivilege 1056 msiexec.exe Token: SeSystemProfilePrivilege 1056 msiexec.exe Token: SeSystemtimePrivilege 1056 msiexec.exe Token: SeProfSingleProcessPrivilege 1056 msiexec.exe Token: SeIncBasePriorityPrivilege 1056 msiexec.exe Token: SeCreatePagefilePrivilege 1056 msiexec.exe Token: SeCreatePermanentPrivilege 1056 msiexec.exe Token: SeBackupPrivilege 1056 msiexec.exe Token: SeRestorePrivilege 1056 msiexec.exe Token: SeShutdownPrivilege 1056 msiexec.exe Token: SeDebugPrivilege 1056 msiexec.exe Token: SeAuditPrivilege 1056 msiexec.exe Token: SeSystemEnvironmentPrivilege 1056 msiexec.exe Token: SeChangeNotifyPrivilege 1056 msiexec.exe Token: SeRemoteShutdownPrivilege 1056 msiexec.exe Token: SeUndockPrivilege 1056 msiexec.exe Token: SeSyncAgentPrivilege 1056 msiexec.exe Token: SeEnableDelegationPrivilege 1056 msiexec.exe Token: SeManageVolumePrivilege 1056 msiexec.exe Token: SeImpersonatePrivilege 1056 msiexec.exe Token: SeCreateGlobalPrivilege 1056 msiexec.exe Token: SeCreateTokenPrivilege 1056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1056 msiexec.exe Token: SeLockMemoryPrivilege 1056 msiexec.exe Token: SeIncreaseQuotaPrivilege 1056 msiexec.exe Token: SeMachineAccountPrivilege 1056 msiexec.exe Token: SeTcbPrivilege 1056 msiexec.exe Token: SeSecurityPrivilege 1056 msiexec.exe Token: SeTakeOwnershipPrivilege 1056 msiexec.exe Token: SeLoadDriverPrivilege 1056 msiexec.exe Token: SeSystemProfilePrivilege 1056 msiexec.exe Token: SeSystemtimePrivilege 1056 msiexec.exe Token: SeProfSingleProcessPrivilege 1056 msiexec.exe Token: SeIncBasePriorityPrivilege 1056 msiexec.exe Token: SeCreatePagefilePrivilege 1056 msiexec.exe Token: SeCreatePermanentPrivilege 1056 msiexec.exe Token: SeBackupPrivilege 1056 msiexec.exe Token: SeRestorePrivilege 1056 msiexec.exe Token: SeShutdownPrivilege 1056 msiexec.exe Token: SeDebugPrivilege 1056 msiexec.exe Token: SeAuditPrivilege 1056 msiexec.exe Token: SeSystemEnvironmentPrivilege 1056 msiexec.exe Token: SeChangeNotifyPrivilege 1056 msiexec.exe Token: SeRemoteShutdownPrivilege 1056 msiexec.exe Token: SeUndockPrivilege 1056 msiexec.exe Token: SeSyncAgentPrivilege 1056 msiexec.exe Token: SeEnableDelegationPrivilege 1056 msiexec.exe Token: SeManageVolumePrivilege 1056 msiexec.exe Token: SeImpersonatePrivilege 1056 msiexec.exe Token: SeCreateGlobalPrivilege 1056 msiexec.exe Token: SeCreateTokenPrivilege 1056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1056 msiexec.exe Token: SeLockMemoryPrivilege 1056 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid Process 1056 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 4992 wrote to memory of 5092 4992 msiexec.exe 85 PID 4992 wrote to memory of 5092 4992 msiexec.exe 85 PID 4992 wrote to memory of 5092 4992 msiexec.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Android Fastboot & mini ADB Drivers\UniversalAdbDriverSetup.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1056
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B05739703532FA9DB290DC3C9782BB9 C2⤵
- Loads dropped DLL
PID:5092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613