Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    02-11-2023 22:57

General

  • Target

    e895b051e04fda2453d83548e017a31efb1b264bf28a5880f67c8d9506652aa9.msi

  • Size

    53.6MB

  • MD5

    9b2b859b796c24e42d0cca13cbfc2a4f

  • SHA1

    e1905a33adb1bf70620e5f43f72508f136069fff

  • SHA256

    e895b051e04fda2453d83548e017a31efb1b264bf28a5880f67c8d9506652aa9

  • SHA512

    f1e74ef5edb5722dc6c31442730b07469913ecf6c61ac3b2b364d627c2544a11c536d9585e9ae6a44ae81c190b389bff90f45e98a6728e6f689f964e145fec0c

  • SSDEEP

    1572864:rw9cpvCjEyReqCXgKBGdWXCJW+XPFR8AX8+Y:0cpvOEyk6K0MYXd58z

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e895b051e04fda2453d83548e017a31efb1b264bf28a5880f67c8d9506652aa9.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1164
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2720
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2468
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000003E0"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab7792.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\MSI67224.LOG

    Filesize

    22KB

    MD5

    b6a9ce25cbd363bedc6068fa2f14c9cf

    SHA1

    d1931ad80f91eee9913b5135e806978ae5d4c41b

    SHA256

    85f0f2b1ef8bc0bd6972877e67e7045be539ffa1d01270164c40e48f8d401ace

    SHA512

    c64cd3cfc467d1b630e59c9f84617e57df567b01a99271e5608f6dca3fbf6dcf020b5b5202084f8a91715db642e323dedf05567059e682e67a6a880669e1697e

  • C:\Users\Admin\AppData\Local\Temp\Tar788F.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf