Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
COMPROBANTE-DXP824387-52-23-25-234-23-52-45252-45-235-235235.msi
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
COMPROBANTE-DXP824387-52-23-25-234-23-52-45252-45-235-235235.msi
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
COMPROBANTE-DXP824387-52-23-25-234-23-52-45252-45-235-235235.msi
-
Size
1.1MB
-
MD5
5e2f3837aff5f7490f19656c1f60d177
-
SHA1
ae46b08278c72c505d28f680650ee88725856e72
-
SHA256
f58adebd3bc565e8b1c9a1711f142d43600ca19de16454b79da89b2d62dd0455
-
SHA512
e015661881ec8ab6b083740e594b242b28fa979bc608b38d06a1d5046348b72ad41df4d178685007931022aefbdc903cc5ab2ea02aa84de3531c465cf6e0c71b
-
SSDEEP
24576:r0Ute5Nk8RsenMoyr8x87B2SoxD4zHQLTtuaGY5Aq:r0UAlvyrRQSZHQLDGY5A
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2600 lc162F.tmp -
Loads dropped DLL 6 IoCs
pid Process 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2792 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f76149a.msi msiexec.exe File opened for modification C:\Windows\Installer\f76149a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1622.tmp msiexec.exe File created C:\Windows\Installer\f76149d.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI17F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI14E8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1585.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI16BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1809.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76149d.ipi msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2660 msiexec.exe 2660 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeSecurityPrivilege 2660 msiexec.exe Token: SeCreateTokenPrivilege 2268 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2268 msiexec.exe Token: SeLockMemoryPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeMachineAccountPrivilege 2268 msiexec.exe Token: SeTcbPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeLoadDriverPrivilege 2268 msiexec.exe Token: SeSystemProfilePrivilege 2268 msiexec.exe Token: SeSystemtimePrivilege 2268 msiexec.exe Token: SeProfSingleProcessPrivilege 2268 msiexec.exe Token: SeIncBasePriorityPrivilege 2268 msiexec.exe Token: SeCreatePagefilePrivilege 2268 msiexec.exe Token: SeCreatePermanentPrivilege 2268 msiexec.exe Token: SeBackupPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeDebugPrivilege 2268 msiexec.exe Token: SeAuditPrivilege 2268 msiexec.exe Token: SeSystemEnvironmentPrivilege 2268 msiexec.exe Token: SeChangeNotifyPrivilege 2268 msiexec.exe Token: SeRemoteShutdownPrivilege 2268 msiexec.exe Token: SeUndockPrivilege 2268 msiexec.exe Token: SeSyncAgentPrivilege 2268 msiexec.exe Token: SeEnableDelegationPrivilege 2268 msiexec.exe Token: SeManageVolumePrivilege 2268 msiexec.exe Token: SeImpersonatePrivilege 2268 msiexec.exe Token: SeCreateGlobalPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe Token: SeRestorePrivilege 2660 msiexec.exe Token: SeTakeOwnershipPrivilege 2660 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2268 msiexec.exe 2268 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2660 wrote to memory of 2792 2660 msiexec.exe 29 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30 PID 2792 wrote to memory of 2600 2792 MsiExec.exe 30
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\COMPROBANTE-DXP824387-52-23-25-234-23-52-45252-45-235-235235.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2268
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B19F438181855E498629F3D9B6FC27272⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\lc162F.tmp"C:\Users\Admin\AppData\Local\Temp\lc162F.tmp"3⤵
- Executes dropped EXE
PID:2600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD518bf7260993c39fe2166281b8f948890
SHA19dd19591f59dac0d707ed20086eb8d410cdd01fb
SHA25635892c90693f3c06c9a25af331a01f266d1ca060c2142a08bcf0d056c4b3cb56
SHA51255b623fefa9728d63aa29d9bc24c4c501f4777d43f46392dd476d86f12de06977cdfa21e1d8fd9398f7a8507f297a32539d10908840685fd0213abc091d556c5
-
Filesize
227KB
MD5082dce3a1ccde3921731988438d45eec
SHA10928726fb1bd345f2187ac5dd30556b50e84c6ec
SHA2564d1782ba84a744d9aeb8a8b7b9b49e994be2c169e74a48bd1ed28ce585a191e0
SHA51239eb588159c07fce1263c71d6efa0fad75f56a2c1c153c0b125cac62d015bcddda857ef28297c0255999e3f0200bdbd0fa49ddd2e90da4b2f7be75997e3c5f6d
-
Filesize
12KB
MD555ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
823KB
MD5b40467c4e5221801eeae2bd7e9a37e01
SHA1fb1d74573b863f62c60684c36991b58b2d75cbbc
SHA256bddd998615dd0527feb37499ed93f38bef6c8f715616704ac910c6197456a1f3
SHA512a78d60cd476de775bb567a70055b00684aad3638b16508db4d52f568589738c7db3fb05f70f40238033c1be8d774246d08548567c49b50950ffe62fc0e871e02