8ac04875976ff5f2b443dde670ba53f812e7ffff42e72336482081bacb337f38

Resubmissions

29/12/2023, 08:01

231229-jw3ndsgah2 7

29/12/2023, 07:56

231229-jsp8wscgfm 7

Analysis

max time kernel
474s
max time network
503s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

instmsiw.exe
Size

1.7MB
MD5

61a5fb191ae2ae876db31dcce75e4183
SHA1

751669c38b666c7435b2a65a5c6fe40435d59aaa
SHA256

b93fdcd1136faa9a8cb73a329b2f1f5f430a150ddcec35de916e3a1539f09351
SHA512

76ed473ff370255e7b09a931c10e1aea7d9d84b4655d85e9ad28faa5f143bb9063c363829a28614fb89cd00c4755e825268123e5f6f4849a0db9328297811ffc
SSDEEP

49152:OFxErb1F2gqQF6d8RrycC51DtuoIwgpXIfWzbnoP2qDAV:2Gb1FLqQF6dWry//DthQiooP2qDAV

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1948	msiinst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	instmsiw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1948	1700	instmsiw.exe	90
PID 1700 wrote to memory of 1948	1700	instmsiw.exe	90
PID 1700 wrote to memory of 1948	1700	instmsiw.exe	90

C:\Users\Admin\AppData\Local\Temp\instmsiw.exe
"C:\Users\Admin\AppData\Local\Temp\instmsiw.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe /i instmsi.msi MSIEXECREG=1 /m /qb+!
  2⤵
  - Executes dropped EXE
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe

Filesize
51KB

MD5
a6312824f6abf5dd300b2f321d251f5a

SHA1
d33f361232373c0092721bff9093f5cde6eebfc2

SHA256
f714271380241db1825d0762e4895d8640205e55e50bafc7b141def5bc1afd6b

SHA512
78ad9fbfb0b6d5ecd4b2c56e54b7c46fd80bab685a28a4c2aff11f21417d379728ea3b3be97222c44e09037e19be50110bba1dd7b350659fd22f0913cbc56af1

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads