Resubmissions
09/01/2024, 08:27
240109-kcd2csbfcp 7Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
1.msi
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.msi
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1.msi
-
Size
2.0MB
-
MD5
8226bd1f1703049b0e55f5d8aa89d9ba
-
SHA1
8f5768635c9de9b4955aff22ccc738106d9293eb
-
SHA256
160ac866b22f6ffc7b5ee6067dd0ee514ca989c24d92d04778024875053c6d22
-
SHA512
abee7a2c44ad234010d2cab2b9d0249b67f39c463424ab993833d79eed73c7e783a212baef0e1d5656c6c948e43126943e17b2795e25869611258d87d901f386
-
SSDEEP
49152:jSMcyy91hUbeMGDquvhwhMEMjOETmDWJfJD/wzRZXDiy/QYVxF1NXZRc6k5EH:fytUbelDquvhwhMEcIDWJ4Rwy/QYVxFG
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2904 MSI1E8A.tmp 1800 QtUpDaDa.exe -
Loads dropped DLL 2 IoCs
pid Process 2904 MSI1E8A.tmp 2904 MSI1E8A.tmp -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f761dd0.ipi msiexec.exe File created \??\c:\Windows\a1.txt MSI1E8A.tmp File opened for modification C:\Windows\Installer\MSI1E5A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1E8A.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f761dcd.msi msiexec.exe File opened for modification C:\Windows\Installer\f761dcd.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f761dd0.ipi msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2320 msiexec.exe 2320 msiexec.exe 2904 MSI1E8A.tmp -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 1712 msiexec.exe Token: SeIncreaseQuotaPrivilege 1712 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe Token: SeSecurityPrivilege 2320 msiexec.exe Token: SeCreateTokenPrivilege 1712 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1712 msiexec.exe Token: SeLockMemoryPrivilege 1712 msiexec.exe Token: SeIncreaseQuotaPrivilege 1712 msiexec.exe Token: SeMachineAccountPrivilege 1712 msiexec.exe Token: SeTcbPrivilege 1712 msiexec.exe Token: SeSecurityPrivilege 1712 msiexec.exe Token: SeTakeOwnershipPrivilege 1712 msiexec.exe Token: SeLoadDriverPrivilege 1712 msiexec.exe Token: SeSystemProfilePrivilege 1712 msiexec.exe Token: SeSystemtimePrivilege 1712 msiexec.exe Token: SeProfSingleProcessPrivilege 1712 msiexec.exe Token: SeIncBasePriorityPrivilege 1712 msiexec.exe Token: SeCreatePagefilePrivilege 1712 msiexec.exe Token: SeCreatePermanentPrivilege 1712 msiexec.exe Token: SeBackupPrivilege 1712 msiexec.exe Token: SeRestorePrivilege 1712 msiexec.exe Token: SeShutdownPrivilege 1712 msiexec.exe Token: SeDebugPrivilege 1712 msiexec.exe Token: SeAuditPrivilege 1712 msiexec.exe Token: SeSystemEnvironmentPrivilege 1712 msiexec.exe Token: SeChangeNotifyPrivilege 1712 msiexec.exe Token: SeRemoteShutdownPrivilege 1712 msiexec.exe Token: SeUndockPrivilege 1712 msiexec.exe Token: SeSyncAgentPrivilege 1712 msiexec.exe Token: SeEnableDelegationPrivilege 1712 msiexec.exe Token: SeManageVolumePrivilege 1712 msiexec.exe Token: SeImpersonatePrivilege 1712 msiexec.exe Token: SeCreateGlobalPrivilege 1712 msiexec.exe Token: SeBackupPrivilege 2544 vssvc.exe Token: SeRestorePrivilege 2544 vssvc.exe Token: SeAuditPrivilege 2544 vssvc.exe Token: SeBackupPrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2784 DrvInst.exe Token: SeLoadDriverPrivilege 2784 DrvInst.exe Token: SeLoadDriverPrivilege 2784 DrvInst.exe Token: SeLoadDriverPrivilege 2784 DrvInst.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe Token: SeRestorePrivilege 2320 msiexec.exe Token: SeTakeOwnershipPrivilege 2320 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1712 msiexec.exe 1712 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2904 2320 msiexec.exe 32 PID 2320 wrote to memory of 2904 2320 msiexec.exe 32 PID 2320 wrote to memory of 2904 2320 msiexec.exe 32 PID 2320 wrote to memory of 2904 2320 msiexec.exe 32 PID 2904 wrote to memory of 1800 2904 MSI1E8A.tmp 33 PID 2904 wrote to memory of 1800 2904 MSI1E8A.tmp 33 PID 2904 wrote to memory of 1800 2904 MSI1E8A.tmp 33 PID 2904 wrote to memory of 1800 2904 MSI1E8A.tmp 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1712
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\Installer\MSI1E8A.tmp"C:\Windows\Installer\MSI1E8A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Default\Links\QtUpDaDa.exeC:\Users\Default\Links\QtUpDaDa.exe3⤵
- Executes dropped EXE
PID:1800
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A8" "0000000000000584"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD563b047b8a800e448b947c977107d46df
SHA16902f160dde7ebde42c6c6bfa3360324b23e0b42
SHA25610575209de737c80e72ace550b296879399cdff2057c27c9577c1cfb4e3201e6
SHA5129c10560a42c6395b450b745bd7ffcb4200073c1eeb63360384b801cc20fe4b89c3da075e4e1f5e6c85ffe910132ca2e959a01446fe51b7135280f73d1be0c1e9
-
Filesize
92KB
MD579eb958751eab61722b457a2dbf587fa
SHA1dc0cccb6802a2147bde645205c6e90a9fa288e8a
SHA25615238585413ed82e07f28eefb1d2570f926e9bbae33f837220c7e5e9c9f889c4
SHA512aa644d2d466a496720ec115544615fd99b9770dc73651fb7fe4ca5c6d1dbe5ef1dfdf82c0ca5f1cdf1f1756aab37188e01cca9e3eb914b9a6d0870b5edd60537