Analysis
-
max time kernel
0s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
1fb7d97a44daaba69c94af9210ca79ac.msi
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fb7d97a44daaba69c94af9210ca79ac.msi
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
1fb7d97a44daaba69c94af9210ca79ac.msi
-
Size
6.6MB
-
MD5
1fb7d97a44daaba69c94af9210ca79ac
-
SHA1
ac2f6515778ac8ba9e4b085be176fe9ac485ca3c
-
SHA256
14dc985fce12f3c0294e18ab72b207bb21635c1669277846d77a10d7eafbb201
-
SHA512
9969202395171752af5fe618baa8bf08586c9a896bb4755af657a57489b830c0cd6c7f62faff817245695dc5bf7a82a7baf49f1f4f9065db07ae2c7e3cb8bbc3
-
SSDEEP
196608:3U91gsRVEXIL2s9WB7E/sO9nihY1nhIs:k9VRVr/Wm/P9ihYw
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 376 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 3408 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe Token: SeIncreaseQuotaPrivilege 1924 msiexec.exe Token: SeMachineAccountPrivilege 1924 msiexec.exe Token: SeTcbPrivilege 1924 msiexec.exe Token: SeSecurityPrivilege 1924 msiexec.exe Token: SeTakeOwnershipPrivilege 1924 msiexec.exe Token: SeLoadDriverPrivilege 1924 msiexec.exe Token: SeSystemProfilePrivilege 1924 msiexec.exe Token: SeSystemtimePrivilege 1924 msiexec.exe Token: SeProfSingleProcessPrivilege 1924 msiexec.exe Token: SeIncBasePriorityPrivilege 1924 msiexec.exe Token: SeCreatePagefilePrivilege 1924 msiexec.exe Token: SeCreatePermanentPrivilege 1924 msiexec.exe Token: SeBackupPrivilege 1924 msiexec.exe Token: SeRestorePrivilege 1924 msiexec.exe Token: SeShutdownPrivilege 1924 msiexec.exe Token: SeDebugPrivilege 1924 msiexec.exe Token: SeAuditPrivilege 1924 msiexec.exe Token: SeSystemEnvironmentPrivilege 1924 msiexec.exe Token: SeChangeNotifyPrivilege 1924 msiexec.exe Token: SeRemoteShutdownPrivilege 1924 msiexec.exe Token: SeUndockPrivilege 1924 msiexec.exe Token: SeSyncAgentPrivilege 1924 msiexec.exe Token: SeEnableDelegationPrivilege 1924 msiexec.exe Token: SeManageVolumePrivilege 1924 msiexec.exe Token: SeImpersonatePrivilege 1924 msiexec.exe Token: SeCreateGlobalPrivilege 1924 msiexec.exe Token: SeCreateTokenPrivilege 1924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1924 msiexec.exe Token: SeLockMemoryPrivilege 1924 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 376 3408 msiexec.exe 23 PID 3408 wrote to memory of 376 3408 msiexec.exe 23 PID 3408 wrote to memory of 376 3408 msiexec.exe 23
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1fb7d97a44daaba69c94af9210ca79ac.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A5F2CE21CA65FBF10DABE3B15286172E C2⤵
- Loads dropped DLL
PID:376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5ecb64c2fcc8b00932d0660f7bd610b9f
SHA170a692794bb569d1c593ed23123c7a658b3f0884
SHA25667d0172e2fbd9976ae5597e06694f9f6cb87a8292b353689f40f1c0641799467
SHA512080986893fb0e1cdcb2d8eb10aad50b47534012f7f2eee0ae2d4dc2e47b9e95fd4f74a4c42025dfb55b2a923bb58dd4a29faf2ed657aa49d2581f29e8c4499bc