Overview
overview
7Static
static
3SecuriteIn...90.exe
windows7-x64
6SecuriteIn...90.exe
windows10-2004-x64
6SCMx86/SCM...up.msi
windows7-x64
7SCMx86/SCM...up.msi
windows10-2004-x64
7SCMx86/msiexec.exe
windows7-x64
1SCMx86/msiexec.exe
windows10-2004-x64
1SCMx86/setup.exe
windows7-x64
7SCMx86/setup.exe
windows10-2004-x64
7Analysis
- max time kernel
117s - max time network
119s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
22/01/2024, 12:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
SCMx86/SCMx86Setup.msi
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
SCMx86/SCMx86Setup.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
SCMx86/msiexec.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SCMx86/msiexec.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SCMx86/setup.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
SCMx86/setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target SCMx86/setup.exe
- Size 420KB
- Sample240122-prrm8afdfl
- SHA256 f0fbc759f323f60f4253516b95c31a3f9062f68c26551fdb5ba842483d2fadb6
- MD5 5152547409903834c5f329a69f1e3872
- SHA1 70034442230bc3b29040a51a24edfac20976ba88
- SHA512 5eaa18284588e5b87e653101204a00b25e47aee184249f663cd4bd7b56d71c8b1dabcc15fef95eb8ac5835312c2f608f66cd85cc17f9e836bea970fe6f841b54
- SSDEEP 6144:gqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3RojDuUlX2eO3:g7IRWDvFa+nhmuF3Y0scReDuUlXba
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2604 MsiExec.exe 2604 MsiExec.exe - Blocklisted process makes network request 3 IoCs
flow pid Process 3 1252 msiexec.exe 5 1252 msiexec.exe 7 1252 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1252 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1252 msiexec.exe Token: SeIncreaseQuotaPrivilege 1252 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeSecurityPrivilege 2940 msiexec.exe Token: SeCreateTokenPrivilege 1252 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1252 msiexec.exe Token: SeLockMemoryPrivilege 1252 msiexec.exe Token: SeIncreaseQuotaPrivilege 1252 msiexec.exe Token: SeMachineAccountPrivilege 1252 msiexec.exe Token: SeTcbPrivilege 1252 msiexec.exe Token: SeSecurityPrivilege 1252 msiexec.exe Token: SeTakeOwnershipPrivilege 1252 msiexec.exe Token: SeLoadDriverPrivilege 1252 msiexec.exe Token: SeSystemProfilePrivilege 1252 msiexec.exe Token: SeSystemtimePrivilege 1252 msiexec.exe Token: SeProfSingleProcessPrivilege 1252 msiexec.exe Token: SeIncBasePriorityPrivilege 1252 msiexec.exe Token: SeCreatePagefilePrivilege 1252 msiexec.exe Token: SeCreatePermanentPrivilege 1252 msiexec.exe Token: SeBackupPrivilege 1252 msiexec.exe Token: SeRestorePrivilege 1252 msiexec.exe Token: SeShutdownPrivilege 1252 msiexec.exe Token: SeDebugPrivilege 1252 msiexec.exe Token: SeAuditPrivilege 1252 msiexec.exe Token: SeSystemEnvironmentPrivilege 1252 msiexec.exe Token: SeChangeNotifyPrivilege 1252 msiexec.exe Token: SeRemoteShutdownPrivilege 1252 msiexec.exe Token: SeUndockPrivilege 1252 msiexec.exe Token: SeSyncAgentPrivilege 1252 msiexec.exe Token: SeEnableDelegationPrivilege 1252 msiexec.exe Token: SeManageVolumePrivilege 1252 msiexec.exe Token: SeImpersonatePrivilege 1252 msiexec.exe Token: SeCreateGlobalPrivilege 1252 msiexec.exe Token: SeCreateTokenPrivilege 1252 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1252 msiexec.exe Token: SeLockMemoryPrivilege 1252 msiexec.exe Token: SeIncreaseQuotaPrivilege 1252 msiexec.exe Token: SeMachineAccountPrivilege 1252 msiexec.exe Token: SeTcbPrivilege 1252 msiexec.exe Token: SeSecurityPrivilege 1252 msiexec.exe Token: SeTakeOwnershipPrivilege 1252 msiexec.exe Token: SeLoadDriverPrivilege 1252 msiexec.exe Token: SeSystemProfilePrivilege 1252 msiexec.exe Token: SeSystemtimePrivilege 1252 msiexec.exe Token: SeProfSingleProcessPrivilege 1252 msiexec.exe Token: SeIncBasePriorityPrivilege 1252 msiexec.exe Token: SeCreatePagefilePrivilege 1252 msiexec.exe Token: SeCreatePermanentPrivilege 1252 msiexec.exe Token: SeBackupPrivilege 1252 msiexec.exe Token: SeRestorePrivilege 1252 msiexec.exe Token: SeShutdownPrivilege 1252 msiexec.exe Token: SeDebugPrivilege 1252 msiexec.exe Token: SeAuditPrivilege 1252 msiexec.exe Token: SeSystemEnvironmentPrivilege 1252 msiexec.exe Token: SeChangeNotifyPrivilege 1252 msiexec.exe Token: SeRemoteShutdownPrivilege 1252 msiexec.exe Token: SeUndockPrivilege 1252 msiexec.exe Token: SeSyncAgentPrivilege 1252 msiexec.exe Token: SeEnableDelegationPrivilege 1252 msiexec.exe Token: SeManageVolumePrivilege 1252 msiexec.exe Token: SeImpersonatePrivilege 1252 msiexec.exe Token: SeCreateGlobalPrivilege 1252 msiexec.exe Token: SeCreateTokenPrivilege 1252 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 msiexec.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 3044 wrote to memory of 1252 3044 setup.exe 28 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30 PID 2940 wrote to memory of 2604 2940 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCMx86\setup.exe"C:\Users\Admin\AppData\Local\Temp\SCMx86\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\SCMx86\SCMx86Setup.msi"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1252
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99D0CF76FC815C1B05D73817E124D029 C2⤵
- Loads dropped DLL
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Cab478D.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI4AFB.tmp
- Size 231KB
- SHA256 82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9
- MD5 def1669123bc5bd8e9a3a93e7f68b58c
- SHA1 101e1f6e9795672319543b9e69f9cb62a3d55055
- SHA512 b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c
- SSDEEP 3072:A7jfONyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYS:IRzCLbY92NLmPUj/u4yQ7wJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar48E7.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP