Analysis
-
max time kernel
147s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe
-
Size
7.2MB
-
MD5
2c55680d1de56f2acb01d9f07baf1a01
-
SHA1
0a6fa77b942bda0d988803e7efe70f66fcfcf8fc
-
SHA256
b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b
-
SHA512
e135cc2a1389d8a8c419486b9c46868aeeeb44d95fa099d7cad11df41c0c6f7cb71944298d923ab9fd96d6741b46519d0c106003ca5ce39658ff157f2bd3b428
-
SSDEEP
196608:LmVf72alA1oMuWr45hrr2H1JpSe8oqQQG7OAEuu7y7O7:i7xueJWGhrr2Hp5qQJR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS29042B1C07134575B7CA5C8E7B0899D4_3_51_10.MSI b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe File opened for modification C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS29042B1C07134575B7CA5C8E7B0899D4_3_51_10.MSI b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeSecurityPrivilege 3036 msiexec.exe Token: SeCreateTokenPrivilege 2200 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2200 msiexec.exe Token: SeLockMemoryPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeMachineAccountPrivilege 2200 msiexec.exe Token: SeTcbPrivilege 2200 msiexec.exe Token: SeSecurityPrivilege 2200 msiexec.exe Token: SeTakeOwnershipPrivilege 2200 msiexec.exe Token: SeLoadDriverPrivilege 2200 msiexec.exe Token: SeSystemProfilePrivilege 2200 msiexec.exe Token: SeSystemtimePrivilege 2200 msiexec.exe Token: SeProfSingleProcessPrivilege 2200 msiexec.exe Token: SeIncBasePriorityPrivilege 2200 msiexec.exe Token: SeCreatePagefilePrivilege 2200 msiexec.exe Token: SeCreatePermanentPrivilege 2200 msiexec.exe Token: SeBackupPrivilege 2200 msiexec.exe Token: SeRestorePrivilege 2200 msiexec.exe Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeDebugPrivilege 2200 msiexec.exe Token: SeAuditPrivilege 2200 msiexec.exe Token: SeSystemEnvironmentPrivilege 2200 msiexec.exe Token: SeChangeNotifyPrivilege 2200 msiexec.exe Token: SeRemoteShutdownPrivilege 2200 msiexec.exe Token: SeUndockPrivilege 2200 msiexec.exe Token: SeSyncAgentPrivilege 2200 msiexec.exe Token: SeEnableDelegationPrivilege 2200 msiexec.exe Token: SeManageVolumePrivilege 2200 msiexec.exe Token: SeImpersonatePrivilege 2200 msiexec.exe Token: SeCreateGlobalPrivilege 2200 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2200 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2200 1992 b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe 88 PID 1992 wrote to memory of 2200 1992 b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe 88 PID 1992 wrote to memory of 2200 1992 b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe"C:\Users\Admin\AppData\Local\Temp\b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS29042B1C07134575B7CA5C8E7B0899D4_3_51_10.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\b21bdc47f4f1a068e5b189dcf3be4003cfb1c36c2a819f4c72cc109ae420109b.exe"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2200
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS29042B1C07134575B7CA5C8E7B0899D4_3_51_10.MSI
Filesize3.8MB
MD5b19702016d3a430e9a2385d05fddf74a
SHA19c02cecb0d8f5b5209cbfde9623d18e67e585d86
SHA256a8daaec8bbd99b8d7c6cad87c925db2b35fd531c19af90b3304c604f431050c9
SHA512b695c0c9f4993a07f0405353306efdb8446ebcb5a68e2a04d0049be215cb7c775bbb514664aa835ca97ebf4302a64641dbb53be87820dfa3ab842ec78d724551