Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 13:10

General

  • Target

    install.msi

  • Size

    3.3MB

  • MD5

    4e5903c4ff6d79dbad178815b377554d

  • SHA1

    74f50126aebbd186d6defa3641113cdc88a37fa2

  • SHA256

    d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46

  • SHA512

    9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8

  • SSDEEP

    98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1312
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A703B781DFC1C917A7FC81639F5E03FA
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:1320
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:2744
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf
        3⤵
          PID:844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\files"
          3⤵
            PID:3036
          • C:\Windows\SysWOW64\ICACLS.EXE
            "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\." /SETINTEGRITYLEVEL (CI)(OI)LOW
            3⤵
            • Modifies file permissions
            PID:2284
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2592
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000244" "00000000000005BC"
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2468

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\files.cab

              Filesize

              3.1MB

              MD5

              c5251b4a0300ac59b9c51b39b48960ef

              SHA1

              1a9f4710e07aff28c8961b8bb4d5a525ea385e42

              SHA256

              4d5fd376d65beb611b661283d72a19f92e69812c716546e3b3809062671238f2

              SHA512

              a00ddbbd2e4d29b6e54ad422d3a69c4cf3b68cec704c677b5713afe8080774a7b35367464fe5bde19efdd07795f1f7ce2ef13f236241b048638f56fa158b2e76

            • C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\files\install.exe

              Filesize

              728KB

              MD5

              ccd9c86fd49aee6fb7eabf11afd51eb7

              SHA1

              b1edd5e79ecd1984e5f9aedd34f1aea4dfcc52c1

              SHA256

              50049e1d89171d8fc89da29df0914e2ba4e83f04db9fd0e88cb489ae8f9fce63

              SHA512

              6fbada4f5c348ee49bee35ef93f033fa1b3a916399e47ce04480557faaf337e5521c95b9cbabc6eca8a867143fd6e2f908650cb6951f9551fb274cf746c27ed5

            • C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\msiwrapper.ini

              Filesize

              336B

              MD5

              db14ee85817ef91f3a181fcee2cd344c

              SHA1

              d75e18e0942ed6a6daa3dd16c07de3448043b4ec

              SHA256

              01507c3b0c9a0981697cfae84d71d1c56a7b3806250a7163417c380ac7376f70

              SHA512

              337c111fcba4407f4b030497c4830b42a554fa2fc32d8510b0cc71829a7cb05509e43b1c9a03e3bf91fd7f5cdb6428a13fab0fa11c6e422f602724087563798b

            • C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\msiwrapper.ini

              Filesize

              1KB

              MD5

              2b432e10b188d3abd6b8e0b8d691ee80

              SHA1

              b0fcbef1bc2d511d535dd0b00149fcbe586ffcfb

              SHA256

              b15470944b707a116cd65d009754ac891da979a876224c027544c6b081d8fa55

              SHA512

              1531a28740b02bb8329126c3d7fd6a51e43d509cc439f574a21dc52df94b5496280f245fa15a3b795bd9141a34d860f1b72bd3d05969fc53a38cac6d8125ff24

            • C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\msiwrapper.ini

              Filesize

              1KB

              MD5

              9ec2e55af51696a3a03ce89a92ceac58

              SHA1

              ed6f8f4d1e0468e937b28df93573d685c69d4fca

              SHA256

              d27a95818ded8495fd8525e696fb392cbeb8ba8f724b773dd869f2a3e4805c34

              SHA512

              35ae53f5d11bc87722154fbb379126e8da81c437f11dc51970e03c8074f309cb22a3b8ced882944771ba2e5ce95cdd1ead3305d84aaa1c8c8d8922e22ee42a82

            • C:\Windows\Installer\MSI954D.tmp

              Filesize

              208KB

              MD5

              4caaa03e0b59ca60a3d34674b732b702

              SHA1

              ee80c8f4684055ac8960b9720fb108be07e1d10c

              SHA256

              d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

              SHA512

              25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

            • memory/844-75-0x0000000000390000-0x0000000000391000-memory.dmp

              Filesize

              4KB