Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BakerBoostApp.msi
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
BakerBoostApp.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Пак/Специальн. твики/1_Activator.bat
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Пак/Специальн. твики/1_Activator.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
Пак/Специальн. твики/Network_Tweaks.bat
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Пак/Специальн. твики/Network_Tweaks.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
setup.exe
-
Size
539KB
-
MD5
41dd876f3e3fdb7a9bdafffddff56e7b
-
SHA1
049752dfe1e0021935ab30342dc770cbe9aaca10
-
SHA256
001f5cd5b1bf24a3a3140001e2b96dc32eab16003f22157f932a4e0736c9bec7
-
SHA512
dc2697a6b819948e1b8c0f3fab62bf71e474b57fd3806aa610d68e5e0365845d77aab61610d5e76db4d2080805e96c478d994898de260d64d86019659ccd7cef
-
SSDEEP
12288:IuGj5je69oqAmj5oMqKyKAuqOAP0wuNeMb01JQntLOCHoo0H:IXhe29AmjkKuuNemHox
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2864 MsiExec.exe 2864 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2136 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2136 msiexec.exe Token: SeIncreaseQuotaPrivilege 2136 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeSecurityPrivilege 2120 msiexec.exe Token: SeCreateTokenPrivilege 2136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2136 msiexec.exe Token: SeLockMemoryPrivilege 2136 msiexec.exe Token: SeIncreaseQuotaPrivilege 2136 msiexec.exe Token: SeMachineAccountPrivilege 2136 msiexec.exe Token: SeTcbPrivilege 2136 msiexec.exe Token: SeSecurityPrivilege 2136 msiexec.exe Token: SeTakeOwnershipPrivilege 2136 msiexec.exe Token: SeLoadDriverPrivilege 2136 msiexec.exe Token: SeSystemProfilePrivilege 2136 msiexec.exe Token: SeSystemtimePrivilege 2136 msiexec.exe Token: SeProfSingleProcessPrivilege 2136 msiexec.exe Token: SeIncBasePriorityPrivilege 2136 msiexec.exe Token: SeCreatePagefilePrivilege 2136 msiexec.exe Token: SeCreatePermanentPrivilege 2136 msiexec.exe Token: SeBackupPrivilege 2136 msiexec.exe Token: SeRestorePrivilege 2136 msiexec.exe Token: SeShutdownPrivilege 2136 msiexec.exe Token: SeDebugPrivilege 2136 msiexec.exe Token: SeAuditPrivilege 2136 msiexec.exe Token: SeSystemEnvironmentPrivilege 2136 msiexec.exe Token: SeChangeNotifyPrivilege 2136 msiexec.exe Token: SeRemoteShutdownPrivilege 2136 msiexec.exe Token: SeUndockPrivilege 2136 msiexec.exe Token: SeSyncAgentPrivilege 2136 msiexec.exe Token: SeEnableDelegationPrivilege 2136 msiexec.exe Token: SeManageVolumePrivilege 2136 msiexec.exe Token: SeImpersonatePrivilege 2136 msiexec.exe Token: SeCreateGlobalPrivilege 2136 msiexec.exe Token: SeCreateTokenPrivilege 2136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2136 msiexec.exe Token: SeLockMemoryPrivilege 2136 msiexec.exe Token: SeIncreaseQuotaPrivilege 2136 msiexec.exe Token: SeMachineAccountPrivilege 2136 msiexec.exe Token: SeTcbPrivilege 2136 msiexec.exe Token: SeSecurityPrivilege 2136 msiexec.exe Token: SeTakeOwnershipPrivilege 2136 msiexec.exe Token: SeLoadDriverPrivilege 2136 msiexec.exe Token: SeSystemProfilePrivilege 2136 msiexec.exe Token: SeSystemtimePrivilege 2136 msiexec.exe Token: SeProfSingleProcessPrivilege 2136 msiexec.exe Token: SeIncBasePriorityPrivilege 2136 msiexec.exe Token: SeCreatePagefilePrivilege 2136 msiexec.exe Token: SeCreatePermanentPrivilege 2136 msiexec.exe Token: SeBackupPrivilege 2136 msiexec.exe Token: SeRestorePrivilege 2136 msiexec.exe Token: SeShutdownPrivilege 2136 msiexec.exe Token: SeDebugPrivilege 2136 msiexec.exe Token: SeAuditPrivilege 2136 msiexec.exe Token: SeSystemEnvironmentPrivilege 2136 msiexec.exe Token: SeChangeNotifyPrivilege 2136 msiexec.exe Token: SeRemoteShutdownPrivilege 2136 msiexec.exe Token: SeUndockPrivilege 2136 msiexec.exe Token: SeSyncAgentPrivilege 2136 msiexec.exe Token: SeEnableDelegationPrivilege 2136 msiexec.exe Token: SeManageVolumePrivilege 2136 msiexec.exe Token: SeImpersonatePrivilege 2136 msiexec.exe Token: SeCreateGlobalPrivilege 2136 msiexec.exe Token: SeCreateTokenPrivilege 2136 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2136 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2112 wrote to memory of 2136 2112 setup.exe 28 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30 PID 2120 wrote to memory of 2864 2120 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\BakerBoostApp.msi"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2136
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DF1470E2EC718A4B2DC4EF3C4C1B786 C2⤵
- Loads dropped DLL
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5684f2d21637cb5835172edad55b6a8d9
SHA15eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA256da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
SHA5127b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c