6737269ad63771c15b6e249209bee0ec2ad1231503efd9e1f1a7213ee7e70886

General

Target

sqlncli.msi
Size

4.8MB
MD5

129fc6413083694818cbc0a297d706fd
SHA1

a391bf631cca15e5ceb4bd6b5d17eae4b1ea25c3
SHA256

6737269ad63771c15b6e249209bee0ec2ad1231503efd9e1f1a7213ee7e70886
SHA512

bf5c80cf62a4dc71f8d0c0e6e9a1dfa29fd021dc02982df1d55df068e4b950b19e44e06affbde2d7ec5572d3ae5a8c41832d6e8d76d1dfa51eb10d4a8de813f7
SSDEEP

98304:n2EFqz1zS25sCnwT4h85R/x7ijbq/0WePORfD3yxa:nLFqZS2B1WR/4fq/0WA5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid process

3972 MsiExec.exe
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

8 540 msiexec.exe

pid	process
3972	MsiExec.exe

flow	pid	process
8	540	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	540	msiexec.exe
Token: SeSecurityPrivilege	3416	msiexec.exe
Token: SeCreateTokenPrivilege	540	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	540	msiexec.exe
Token: SeLockMemoryPrivilege	540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	540	msiexec.exe
Token: SeMachineAccountPrivilege	540	msiexec.exe
Token: SeTcbPrivilege	540	msiexec.exe
Token: SeSecurityPrivilege	540	msiexec.exe
Token: SeTakeOwnershipPrivilege	540	msiexec.exe
Token: SeLoadDriverPrivilege	540	msiexec.exe
Token: SeSystemProfilePrivilege	540	msiexec.exe
Token: SeSystemtimePrivilege	540	msiexec.exe
Token: SeProfSingleProcessPrivilege	540	msiexec.exe
Token: SeIncBasePriorityPrivilege	540	msiexec.exe
Token: SeCreatePagefilePrivilege	540	msiexec.exe
Token: SeCreatePermanentPrivilege	540	msiexec.exe
Token: SeBackupPrivilege	540	msiexec.exe
Token: SeRestorePrivilege	540	msiexec.exe
Token: SeShutdownPrivilege	540	msiexec.exe
Token: SeDebugPrivilege	540	msiexec.exe
Token: SeAuditPrivilege	540	msiexec.exe
Token: SeSystemEnvironmentPrivilege	540	msiexec.exe
Token: SeChangeNotifyPrivilege	540	msiexec.exe
Token: SeRemoteShutdownPrivilege	540	msiexec.exe
Token: SeUndockPrivilege	540	msiexec.exe
Token: SeSyncAgentPrivilege	540	msiexec.exe
Token: SeEnableDelegationPrivilege	540	msiexec.exe
Token: SeManageVolumePrivilege	540	msiexec.exe
Token: SeImpersonatePrivilege	540	msiexec.exe
Token: SeCreateGlobalPrivilege	540	msiexec.exe
Token: SeCreateTokenPrivilege	540	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	540	msiexec.exe
Token: SeLockMemoryPrivilege	540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	540	msiexec.exe
Token: SeMachineAccountPrivilege	540	msiexec.exe
Token: SeTcbPrivilege	540	msiexec.exe
Token: SeSecurityPrivilege	540	msiexec.exe
Token: SeTakeOwnershipPrivilege	540	msiexec.exe
Token: SeLoadDriverPrivilege	540	msiexec.exe
Token: SeSystemProfilePrivilege	540	msiexec.exe
Token: SeSystemtimePrivilege	540	msiexec.exe
Token: SeProfSingleProcessPrivilege	540	msiexec.exe
Token: SeIncBasePriorityPrivilege	540	msiexec.exe
Token: SeCreatePagefilePrivilege	540	msiexec.exe
Token: SeCreatePermanentPrivilege	540	msiexec.exe
Token: SeBackupPrivilege	540	msiexec.exe
Token: SeRestorePrivilege	540	msiexec.exe
Token: SeShutdownPrivilege	540	msiexec.exe
Token: SeDebugPrivilege	540	msiexec.exe
Token: SeAuditPrivilege	540	msiexec.exe
Token: SeSystemEnvironmentPrivilege	540	msiexec.exe
Token: SeChangeNotifyPrivilege	540	msiexec.exe
Token: SeRemoteShutdownPrivilege	540	msiexec.exe
Token: SeUndockPrivilege	540	msiexec.exe
Token: SeSyncAgentPrivilege	540	msiexec.exe
Token: SeEnableDelegationPrivilege	540	msiexec.exe
Token: SeManageVolumePrivilege	540	msiexec.exe
Token: SeImpersonatePrivilege	540	msiexec.exe
Token: SeCreateGlobalPrivilege	540	msiexec.exe
Token: SeCreateTokenPrivilege	540	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	540	msiexec.exe
Token: SeLockMemoryPrivilege	540	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

540 msiexec.exe

pid	process
540	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3416 wrote to memory of 3972	3416	msiexec.exe	MsiExec.exe
PID 3416 wrote to memory of 3972	3416	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sqlncli.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 639EB35EA16A1D5D384A9C3EB27CCF6F C
2⤵
- Loads dropped DLL
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI7ADD.tmp

Filesize
99KB

MD5
5ff85536c392f340fc5f1bb164f59934

SHA1
33492bbfcadfce18da7283e2e8fd15cd07ffefde

SHA256
00c16418c2caa6dd12037e3e8e816c52e6378cf4cebde0a85800307f9c70f755

SHA512
76b0dfe029f815ec2697479b4617307e436d38bf90055f995e617ef77e370bdf6fef04e18778e73800669a92476efca4c945ce6c2889076e6b7e0083f32e5651

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7ADD.tmp

Filesize
99KB

MD5
5ff85536c392f340fc5f1bb164f59934

SHA1
33492bbfcadfce18da7283e2e8fd15cd07ffefde

SHA256
00c16418c2caa6dd12037e3e8e816c52e6378cf4cebde0a85800307f9c70f755

SHA512
76b0dfe029f815ec2697479b4617307e436d38bf90055f995e617ef77e370bdf6fef04e18778e73800669a92476efca4c945ce6c2889076e6b7e0083f32e5651

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads