Analysis

  • max time kernel
    119s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 02:48

General

  • Target

    AcerDisplayWidget.msi

  • Size

    29.5MB

  • MD5

    d203f457661a5302f7314ba5803191bc

  • SHA1

    1813fa747fdc7fc798bb7bd45a2088ff5d310ec1

  • SHA256

    e708fe4b7a8d6a07bf5e670cfd64e0e6949b4a8752e013ca9693313b1c50e15f

  • SHA512

    ac64ec7b80f011fadb65418d491639e7c3c147857812993c336f893ad46e70fb8dedeea87d2d0605aa50295f58aae460d2dcb0f19e9283a7165bb47d1dba28a3

  • SSDEEP

    786432:OqousVZRHad2yswfP6e1oU7iE+Zc7aB5J6j0GxR:yZHw62oOIZc+6Fx

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AcerDisplayWidget.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2512
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C152DB270E038151D7200BB1741CB296 C
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      PID:1968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab5295.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\MSI5654.tmp

    Filesize

    216KB

    MD5

    d261a064a6612a2b5f8774e55d49e8bb

    SHA1

    a4ac194b86202bc8ad412a642f42ce1aeca2c433

    SHA256

    83a68300f22fa9f45fea46e16aada7887c3b8b09cef3faf098c30b428e6a4629

    SHA512

    2857e9422de455ec3351bc61a62f2d1e49a29112efdadf30f84d7920c2867b2bb20bdb43e8f4346b5004e8ee8612cedd098ebb4b66dc6ba8a2fff718e0154238

  • C:\Users\Admin\AppData\Local\Temp\MSI5906.tmp

    Filesize

    377KB

    MD5

    197b1bdd8ca8123d3d4a9445e2a8859c

    SHA1

    f1ed85a054d63c4bf9006bd75062549179b9d776

    SHA256

    b10fbfbcf69cbf5f728e508dbfdde40cfe045e8b7a8e58e4e1b0f05150ede90a

    SHA512

    e7d711f8c1f87ab59bfcd50944082ad49e87c3457ff93188f99c171b5d788941af22480e65957936263bd9fbd3179dbeb84532b3dd5b2086bcdb8dee21af4cc8

  • C:\Users\Admin\AppData\Local\Temp\MSI5964.tmp

    Filesize

    375KB

    MD5

    1d5bf0c2a610dd324f0e1990cdf3b65f

    SHA1

    c94c6f943b0fad5a05351a2fd62e93e75b17faad

    SHA256

    3b16c4678f727d35db5e033883cd943e8bb0b84ee15afeb18cf796ae2372e1e9

    SHA512

    73ae2bcc83ad67f41f416f295d516d45c7786b3f09276ff9c1c611b151d1e8f1ee1bff80ff2c966a2746e1ced2c888dd70b9fe10ae42563ace09c42076a3bc4f

  • C:\Users\Admin\AppData\Local\Temp\Tar53DF.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06