5b69fc1168558573d4b91d91aebeb20a24e2f855e95c5a30da82df23d4ce0699

Analysis

max time kernel
152s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/dp/install.msi
Size

1.4MB
MD5

bd4197fcc24ef42031fdd26c749192c5
SHA1

f644b383509892e23641c2336e698205e3b1d692
SHA256

8726518f5783e2d2e02a7d06f2aa49e7e6a3771316d46f95ec0fa7e24f5c2a60
SHA512

06457838ff6055a56d28757884e2929b9ce9f8d88af6a84af3d41a1222f9e2e7f32c427b5944968573e7ff44527453e2853eb6176aacbbc23fc97a8ace86f600
SSDEEP

24576:MvJbwGLXIMzGfo2wCM3fqGge5Po/XKs+WdNESjHzVIaHErPjsgQYXrqGgeR+z:MvyYKo24etBpTHErdhX7+z

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4276	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4276	msiexec.exe
Token: SeSecurityPrivilege	3888	msiexec.exe
Token: SeCreateTokenPrivilege	4276	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4276	msiexec.exe
Token: SeLockMemoryPrivilege	4276	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4276	msiexec.exe
Token: SeMachineAccountPrivilege	4276	msiexec.exe
Token: SeTcbPrivilege	4276	msiexec.exe
Token: SeSecurityPrivilege	4276	msiexec.exe
Token: SeTakeOwnershipPrivilege	4276	msiexec.exe
Token: SeLoadDriverPrivilege	4276	msiexec.exe
Token: SeSystemProfilePrivilege	4276	msiexec.exe
Token: SeSystemtimePrivilege	4276	msiexec.exe
Token: SeProfSingleProcessPrivilege	4276	msiexec.exe
Token: SeIncBasePriorityPrivilege	4276	msiexec.exe
Token: SeCreatePagefilePrivilege	4276	msiexec.exe
Token: SeCreatePermanentPrivilege	4276	msiexec.exe
Token: SeBackupPrivilege	4276	msiexec.exe
Token: SeRestorePrivilege	4276	msiexec.exe
Token: SeShutdownPrivilege	4276	msiexec.exe
Token: SeDebugPrivilege	4276	msiexec.exe
Token: SeAuditPrivilege	4276	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4276	msiexec.exe
Token: SeChangeNotifyPrivilege	4276	msiexec.exe
Token: SeRemoteShutdownPrivilege	4276	msiexec.exe
Token: SeUndockPrivilege	4276	msiexec.exe
Token: SeSyncAgentPrivilege	4276	msiexec.exe
Token: SeEnableDelegationPrivilege	4276	msiexec.exe
Token: SeManageVolumePrivilege	4276	msiexec.exe
Token: SeImpersonatePrivilege	4276	msiexec.exe
Token: SeCreateGlobalPrivilege	4276	msiexec.exe
Token: SeCreateTokenPrivilege	4276	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4276	msiexec.exe
Token: SeLockMemoryPrivilege	4276	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4276	msiexec.exe
Token: SeMachineAccountPrivilege	4276	msiexec.exe
Token: SeTcbPrivilege	4276	msiexec.exe
Token: SeSecurityPrivilege	4276	msiexec.exe
Token: SeTakeOwnershipPrivilege	4276	msiexec.exe
Token: SeLoadDriverPrivilege	4276	msiexec.exe
Token: SeSystemProfilePrivilege	4276	msiexec.exe
Token: SeSystemtimePrivilege	4276	msiexec.exe
Token: SeProfSingleProcessPrivilege	4276	msiexec.exe
Token: SeIncBasePriorityPrivilege	4276	msiexec.exe
Token: SeCreatePagefilePrivilege	4276	msiexec.exe
Token: SeCreatePermanentPrivilege	4276	msiexec.exe
Token: SeBackupPrivilege	4276	msiexec.exe
Token: SeRestorePrivilege	4276	msiexec.exe
Token: SeShutdownPrivilege	4276	msiexec.exe
Token: SeDebugPrivilege	4276	msiexec.exe
Token: SeAuditPrivilege	4276	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4276	msiexec.exe
Token: SeChangeNotifyPrivilege	4276	msiexec.exe
Token: SeRemoteShutdownPrivilege	4276	msiexec.exe
Token: SeUndockPrivilege	4276	msiexec.exe
Token: SeSyncAgentPrivilege	4276	msiexec.exe
Token: SeEnableDelegationPrivilege	4276	msiexec.exe
Token: SeManageVolumePrivilege	4276	msiexec.exe
Token: SeImpersonatePrivilege	4276	msiexec.exe
Token: SeCreateGlobalPrivilege	4276	msiexec.exe
Token: SeCreateTokenPrivilege	4276	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4276	msiexec.exe
Token: SeLockMemoryPrivilege	4276	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 1324	3888	msiexec.exe	93
PID 3888 wrote to memory of 1324	3888	msiexec.exe	93
PID 3888 wrote to memory of 1324	3888	msiexec.exe	93

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bin\dp\install.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68D416ED3BA15601CBD38FA813ADD276 C
  2⤵
  - Loads dropped DLL
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI4A23.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4A23.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4F16.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4F16.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4FC3.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4FC3.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4FC3.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5012.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5012.tmp

Filesize
590KB

MD5
71fc455bb665aeb834f282dff9301b16

SHA1
7296ec0e4a7e96d43e3dfeae0558b2ddd68948f1

SHA256
b147f71b1e91d0cbe090e838557b393a6c1f83d1d6e5cb6d4f4665f2a46e3415

SHA512
ef8b67d3b0e09b8c246035c1dded6c9acfb35ce9cd25a6561d6752f53b93d6e6b2a859ca509dd923b07d76b9d200a3e588962e61884f119c8897ed05e02da0c0

Download Submit