Analysis
-
max time kernel
9s -
max time network
10s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-01-2024 13:57
Static task
static1
Behavioral task
behavioral1
Sample
31012024_2156_CommunitySetup.msi
Resource
win7-20231129-en
windows7-x64
General
-
Target
31012024_2156_CommunitySetup.msi
-
Size
17.1MB
-
MD5
eb64b1dbb38961bdb4c0f4b724b1ed3d
-
SHA1
a375bc847388cdddc6cffd57dc7f0c3d6be72cdf
-
SHA256
cf5d6c68811f37d9ae1a9cc62abc1987fdd8900d271fdaa01d4a84853d7db10d
-
SHA512
5c56b478f88002e10b3bea6ed2151a8e89e1693270effaa6ded943b1325b0d1e1a4aa9fa66fd8b372f70da86feab6cee781518bb50514dfb341a9767a01d36a7
-
SSDEEP
393216:QnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vho:pbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIne
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1824 dsw.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 3 3040 msiexec.exe 6 3040 msiexec.exe 8 3040 msiexec.exe 9 1044 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\f762462.msi msiexec.exe File opened for modification C:\Windows\Installer\f762462.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2698.tmp msiexec.exe File created C:\Windows\Installer\f762465.msi msiexec.exe File opened for modification C:\Windows\Installer\f762463.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f762463.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1044 msiexec.exe 1044 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3040 msiexec.exe Token: SeIncreaseQuotaPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeSecurityPrivilege 1044 msiexec.exe Token: SeCreateTokenPrivilege 3040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3040 msiexec.exe Token: SeLockMemoryPrivilege 3040 msiexec.exe Token: SeIncreaseQuotaPrivilege 3040 msiexec.exe Token: SeMachineAccountPrivilege 3040 msiexec.exe Token: SeTcbPrivilege 3040 msiexec.exe Token: SeSecurityPrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeLoadDriverPrivilege 3040 msiexec.exe Token: SeSystemProfilePrivilege 3040 msiexec.exe Token: SeSystemtimePrivilege 3040 msiexec.exe Token: SeProfSingleProcessPrivilege 3040 msiexec.exe Token: SeIncBasePriorityPrivilege 3040 msiexec.exe Token: SeCreatePagefilePrivilege 3040 msiexec.exe Token: SeCreatePermanentPrivilege 3040 msiexec.exe Token: SeBackupPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeShutdownPrivilege 3040 msiexec.exe Token: SeDebugPrivilege 3040 msiexec.exe Token: SeAuditPrivilege 3040 msiexec.exe Token: SeSystemEnvironmentPrivilege 3040 msiexec.exe Token: SeChangeNotifyPrivilege 3040 msiexec.exe Token: SeRemoteShutdownPrivilege 3040 msiexec.exe Token: SeUndockPrivilege 3040 msiexec.exe Token: SeSyncAgentPrivilege 3040 msiexec.exe Token: SeEnableDelegationPrivilege 3040 msiexec.exe Token: SeManageVolumePrivilege 3040 msiexec.exe Token: SeImpersonatePrivilege 3040 msiexec.exe Token: SeCreateGlobalPrivilege 3040 msiexec.exe Token: SeBackupPrivilege 2680 vssvc.exe Token: SeRestorePrivilege 2680 vssvc.exe Token: SeAuditPrivilege 2680 vssvc.exe Token: SeBackupPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 2956 DrvInst.exe Token: SeLoadDriverPrivilege 2956 DrvInst.exe Token: SeLoadDriverPrivilege 2956 DrvInst.exe Token: SeLoadDriverPrivilege 2956 DrvInst.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 msiexec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1824 1044 msiexec.exe 32 PID 1044 wrote to memory of 1824 1044 msiexec.exe 32 PID 1044 wrote to memory of 1824 1044 msiexec.exe 32 PID 1044 wrote to memory of 1824 1044 msiexec.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\31012024_2156_CommunitySetup.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3040
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe"C:\Users\Admin\AppData\Local\Programs\Clip Plus Community\dsw.exe"2⤵
- Executes dropped EXE
PID:1824
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003CC" "00000000000003D0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD56428065bb837570b91fa59efa7c81d3f
SHA147826c706498fa95a90e5fad9d09edb75356b99e
SHA25688a129d7088989010edf45627420d3d9c075acce1c99a46c05ead7bb52c37831
SHA5127bd93940286aaff480a90ba252998f8f3473d365be758fe8e7b2841b8aa90ee23e3006bb861f238117c3c57d538fa8c55b11e8df9a6ea0d22f48124348bd9bde
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57642e3b2d93d60f1eaaef398fa3dd931
SHA1257c2906ba47618a22e20e8964b53ee1b798774c
SHA2562a1ae7b53589789148f6bae0616c768c681fd0fc410a8b57c0d17ec6f3c7a615
SHA512c578176d8605ceb98d862595bc1fc9c940bec96a24774e963496ca5cc172e049b1b3aeccb799c46bd1dc26666973bcb65b134c598b46f7a02291d466ce04185c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57000bcd356168ce0bf37cebc6c1ba867
SHA19164c8e178cab3ca6a5d20132326ddb543210bba
SHA256e2a9361df3df83ebae0c301b9c4e370289ba25038fd0d50cec9173ebb033d35e
SHA512b0d99a354f596cca4fde71a05ee3aafb3f563b5e2e3ba12d9ae8fb17c72e5003e26f590530cc1e90653cf497be8b6c0209d8347d9bf5bbbf92d0cca5afa1529d
-
Filesize
21KB
MD5cdfbe254cc64959fc0fc1200f41f34c0
SHA14e0919a8a5c4b23441e51965eaaa77f485584c01
SHA2569513129c0bb417698a60c5e4dd232963605d1c84e01b9f883f63d03b453173a9
SHA51263704a7a4d0cd8b53972e29fcbee71f2c3eb86a0411f90fc8375e67cb4b3bddb36c753f3f5b113c3ca333c381f86a19e2168218cc2074f05ad1143bc118cd610
-
Filesize
64KB
MD58b38bcca2d9c9a02dd8ce668427fde51
SHA146864e89e2f744e31086e3cc276394aebe3be920
SHA25658d06980017a62c030ecbe32a090ac90ae10583ede4f55491bac5b4fcb30f200
SHA51233ffaae24634b5c3eb3732ef43942d9a8b3f9d5018d26a72f306924f8a5481012dce0350527022fbe748e93fced6dfcd6d1f68473559713f40dd6b5fd1fe7050
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
135KB
MD58e58fcc0672a66c827c6f90fa4b58538
SHA13e807dfd27259ae7548692a05af4fe54f8dd32ed
SHA2566e1bf8ea63f9923687709f4e2f0dac7ff558b2ab923e8c8aa147384746e05b1d
SHA5120e9faf457a278ad4c5dd171f65c24f6a027696d931a9a2a2edd4e467da8b8a9e4ab3b1fd2d758f5744bf84bece88c046cda5f7e4204bead14d7c36a46702b768
-
Filesize
45KB
MD51cd2a0ab1997fee4c12032159aeed369
SHA12bf5767053a9eed277df0ceb848381cb7518e6e6
SHA256a5aaa514c5f3d27385ad043f31e9775bc3406e0fc8f534bd30ade32028942854
SHA5129d45aa67a40950e23fe7f114212c1b22dd43cf809730eca5f4655b9edd180e37b6febffe804dbbe77b50e9b4c0a996fee3815434f93410915f75241efa30de62