Analysis
-
max time kernel
143s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral2
Sample
942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe
-
Size
6.9MB
-
MD5
230d1965a035bc4c894941caa3d19a32
-
SHA1
317604eba6e94e8777741d577b0ef160a0af3258
-
SHA256
942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2
-
SHA512
00ac51bdf37bde44668e5cf20854f67df1b222959f8876e2fc3d05814cdb7b11c728411e5ce04187c7fb9c7939cab56cffaa3a8f02bf0a17437dcf7af51755a4
-
SSDEEP
196608:1fCy8wAafvB9W95jcOqihiDXHzk2w5gzOAiZiU8sXo:Uy8wAafEjnqzkt//s
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 33 4184 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4184 msiexec.exe Token: SeIncreaseQuotaPrivilege 4184 msiexec.exe Token: SeSecurityPrivilege 2620 msiexec.exe Token: SeCreateTokenPrivilege 4184 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4184 msiexec.exe Token: SeLockMemoryPrivilege 4184 msiexec.exe Token: SeIncreaseQuotaPrivilege 4184 msiexec.exe Token: SeMachineAccountPrivilege 4184 msiexec.exe Token: SeTcbPrivilege 4184 msiexec.exe Token: SeSecurityPrivilege 4184 msiexec.exe Token: SeTakeOwnershipPrivilege 4184 msiexec.exe Token: SeLoadDriverPrivilege 4184 msiexec.exe Token: SeSystemProfilePrivilege 4184 msiexec.exe Token: SeSystemtimePrivilege 4184 msiexec.exe Token: SeProfSingleProcessPrivilege 4184 msiexec.exe Token: SeIncBasePriorityPrivilege 4184 msiexec.exe Token: SeCreatePagefilePrivilege 4184 msiexec.exe Token: SeCreatePermanentPrivilege 4184 msiexec.exe Token: SeBackupPrivilege 4184 msiexec.exe Token: SeRestorePrivilege 4184 msiexec.exe Token: SeShutdownPrivilege 4184 msiexec.exe Token: SeDebugPrivilege 4184 msiexec.exe Token: SeAuditPrivilege 4184 msiexec.exe Token: SeSystemEnvironmentPrivilege 4184 msiexec.exe Token: SeChangeNotifyPrivilege 4184 msiexec.exe Token: SeRemoteShutdownPrivilege 4184 msiexec.exe Token: SeUndockPrivilege 4184 msiexec.exe Token: SeSyncAgentPrivilege 4184 msiexec.exe Token: SeEnableDelegationPrivilege 4184 msiexec.exe Token: SeManageVolumePrivilege 4184 msiexec.exe Token: SeImpersonatePrivilege 4184 msiexec.exe Token: SeCreateGlobalPrivilege 4184 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4184 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2216 wrote to memory of 4184 2216 942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe 92 PID 2216 wrote to memory of 4184 2216 942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe 92 PID 2216 wrote to memory of 4184 2216 942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe"C:\Users\Admin\AppData\Local\Temp\942c7ee37303c962628555e196eb35f4465bb45d204600dd2518dd20ddebe5e2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\ProgramData\ClassicShellSetup64_4_3_1.msi"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4184
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD50606a9a7e1157a08c1098718575edd6b
SHA144737e63cf3565d34a6a36fd6365ec92429fb3c7
SHA256347d8e65f200ea8c4eb9752f56b62d14af4370ecf7f13657a806fa1433fbffcf
SHA512d46c9829ed2b67a37429723af09f46e11d0d7b61cf5b398ca1daa2ef061c5b4de68ec89a95bd8a612ccd87899ff07bd802cc12fc8d1e0e5746ddbbdd7b0ef4ca