Overview
overview
7Static
static
3SecuriteIn...90.exe
windows7-x64
6SecuriteIn...90.exe
windows10-2004-x64
6SCMx86/SCM...up.msi
windows7-x64
7SCMx86/SCM...up.msi
windows10-2004-x64
7SCMx86/msiexec.exe
windows7-x64
1SCMx86/msiexec.exe
windows10-2004-x64
1SCMx86/setup.exe
windows7-x64
7SCMx86/setup.exe
windows10-2004-x64
7Analysis
- max time kernel
89s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
22/01/2024, 12:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
SCMx86/SCMx86Setup.msi
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
SCMx86/SCMx86Setup.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
SCMx86/msiexec.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SCMx86/msiexec.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SCMx86/setup.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
SCMx86/setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target SCMx86/SCMx86Setup.msi
- Size 3.9MB
- Sample240122-prrm8afdfl
- SHA256 4a846fe82a937531ad8d929c3eed01f1f7d5bc5b45225e5fa75d01a6f345c1da
- MD5 c1a5783c1222e92e7aa8382dcffc8d87
- SHA1 c9f9de33cedba3505dbe2955f97000db73376779
- SHA512 ed49fafe367ecbe84af003b7637a4264fef0252efe24f2ea247ec93e9a7bc48c9a43f19574fce94504fae786584206be5134058d7cf017fa5c4bedba7575d8aa
- SSDEEP 98304:lCDukHWlcMHWlcuHWlcHl/fiRdsWR70E6KIq+8fSuj2THA3G:Wuk2lb2lN2ls8Rp+q+MS2OEG
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 5012 MsiExec.exe 5012 MsiExec.exe - Blocklisted process makes network request 2 IoCs
flow pid Process 4 4604 msiexec.exe 6 4604 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4604 msiexec.exe Token: SeIncreaseQuotaPrivilege 4604 msiexec.exe Token: SeSecurityPrivilege 2328 msiexec.exe Token: SeCreateTokenPrivilege 4604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4604 msiexec.exe Token: SeLockMemoryPrivilege 4604 msiexec.exe Token: SeIncreaseQuotaPrivilege 4604 msiexec.exe Token: SeMachineAccountPrivilege 4604 msiexec.exe Token: SeTcbPrivilege 4604 msiexec.exe Token: SeSecurityPrivilege 4604 msiexec.exe Token: SeTakeOwnershipPrivilege 4604 msiexec.exe Token: SeLoadDriverPrivilege 4604 msiexec.exe Token: SeSystemProfilePrivilege 4604 msiexec.exe Token: SeSystemtimePrivilege 4604 msiexec.exe Token: SeProfSingleProcessPrivilege 4604 msiexec.exe Token: SeIncBasePriorityPrivilege 4604 msiexec.exe Token: SeCreatePagefilePrivilege 4604 msiexec.exe Token: SeCreatePermanentPrivilege 4604 msiexec.exe Token: SeBackupPrivilege 4604 msiexec.exe Token: SeRestorePrivilege 4604 msiexec.exe Token: SeShutdownPrivilege 4604 msiexec.exe Token: SeDebugPrivilege 4604 msiexec.exe Token: SeAuditPrivilege 4604 msiexec.exe Token: SeSystemEnvironmentPrivilege 4604 msiexec.exe Token: SeChangeNotifyPrivilege 4604 msiexec.exe Token: SeRemoteShutdownPrivilege 4604 msiexec.exe Token: SeUndockPrivilege 4604 msiexec.exe Token: SeSyncAgentPrivilege 4604 msiexec.exe Token: SeEnableDelegationPrivilege 4604 msiexec.exe Token: SeManageVolumePrivilege 4604 msiexec.exe Token: SeImpersonatePrivilege 4604 msiexec.exe Token: SeCreateGlobalPrivilege 4604 msiexec.exe Token: SeCreateTokenPrivilege 4604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4604 msiexec.exe Token: SeLockMemoryPrivilege 4604 msiexec.exe Token: SeIncreaseQuotaPrivilege 4604 msiexec.exe Token: SeMachineAccountPrivilege 4604 msiexec.exe Token: SeTcbPrivilege 4604 msiexec.exe Token: SeSecurityPrivilege 4604 msiexec.exe Token: SeTakeOwnershipPrivilege 4604 msiexec.exe Token: SeLoadDriverPrivilege 4604 msiexec.exe Token: SeSystemProfilePrivilege 4604 msiexec.exe Token: SeSystemtimePrivilege 4604 msiexec.exe Token: SeProfSingleProcessPrivilege 4604 msiexec.exe Token: SeIncBasePriorityPrivilege 4604 msiexec.exe Token: SeCreatePagefilePrivilege 4604 msiexec.exe Token: SeCreatePermanentPrivilege 4604 msiexec.exe Token: SeBackupPrivilege 4604 msiexec.exe Token: SeRestorePrivilege 4604 msiexec.exe Token: SeShutdownPrivilege 4604 msiexec.exe Token: SeDebugPrivilege 4604 msiexec.exe Token: SeAuditPrivilege 4604 msiexec.exe Token: SeSystemEnvironmentPrivilege 4604 msiexec.exe Token: SeChangeNotifyPrivilege 4604 msiexec.exe Token: SeRemoteShutdownPrivilege 4604 msiexec.exe Token: SeUndockPrivilege 4604 msiexec.exe Token: SeSyncAgentPrivilege 4604 msiexec.exe Token: SeEnableDelegationPrivilege 4604 msiexec.exe Token: SeManageVolumePrivilege 4604 msiexec.exe Token: SeImpersonatePrivilege 4604 msiexec.exe Token: SeCreateGlobalPrivilege 4604 msiexec.exe Token: SeCreateTokenPrivilege 4604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4604 msiexec.exe Token: SeLockMemoryPrivilege 4604 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4604 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2328 wrote to memory of 5012 2328 msiexec.exe 90 PID 2328 wrote to memory of 5012 2328 msiexec.exe 90 PID 2328 wrote to memory of 5012 2328 msiexec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SCMx86\SCMx86Setup.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4604
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 66203A99BF49330FC90E60F0885AA157 C2⤵
- Loads dropped DLL
PID:5012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI4C0D.tmp
- Size 231KB
- SHA256 82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9
- MD5 def1669123bc5bd8e9a3a93e7f68b58c
- SHA1 101e1f6e9795672319543b9e69f9cb62a3d55055
- SHA512 b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c
- SSDEEP 3072:A7jfONyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYS:IRzCLbY92NLmPUj/u4yQ7wJ
- MD5 SHA1 SHA512 SSDEEP