Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
install.msi
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
install.msi
Resource
win10v2004-20240221-en
General
-
Target
install.msi
-
Size
3.3MB
-
MD5
4e5903c4ff6d79dbad178815b377554d
-
SHA1
74f50126aebbd186d6defa3641113cdc88a37fa2
-
SHA256
d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46
-
SHA512
9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8
-
SSDEEP
98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 1320 ICACLS.EXE 2284 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f769270.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI954D.tmp msiexec.exe File opened for modification C:\Windows\Installer\f769271.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f769270.msi msiexec.exe File created C:\Windows\Installer\f769271.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE -
Loads dropped DLL 1 IoCs
pid Process 2496 MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 860 msiexec.exe 860 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1312 msiexec.exe Token: SeIncreaseQuotaPrivilege 1312 msiexec.exe Token: SeRestorePrivilege 860 msiexec.exe Token: SeTakeOwnershipPrivilege 860 msiexec.exe Token: SeSecurityPrivilege 860 msiexec.exe Token: SeCreateTokenPrivilege 1312 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1312 msiexec.exe Token: SeLockMemoryPrivilege 1312 msiexec.exe Token: SeIncreaseQuotaPrivilege 1312 msiexec.exe Token: SeMachineAccountPrivilege 1312 msiexec.exe Token: SeTcbPrivilege 1312 msiexec.exe Token: SeSecurityPrivilege 1312 msiexec.exe Token: SeTakeOwnershipPrivilege 1312 msiexec.exe Token: SeLoadDriverPrivilege 1312 msiexec.exe Token: SeSystemProfilePrivilege 1312 msiexec.exe Token: SeSystemtimePrivilege 1312 msiexec.exe Token: SeProfSingleProcessPrivilege 1312 msiexec.exe Token: SeIncBasePriorityPrivilege 1312 msiexec.exe Token: SeCreatePagefilePrivilege 1312 msiexec.exe Token: SeCreatePermanentPrivilege 1312 msiexec.exe Token: SeBackupPrivilege 1312 msiexec.exe Token: SeRestorePrivilege 1312 msiexec.exe Token: SeShutdownPrivilege 1312 msiexec.exe Token: SeDebugPrivilege 1312 msiexec.exe Token: SeAuditPrivilege 1312 msiexec.exe Token: SeSystemEnvironmentPrivilege 1312 msiexec.exe Token: SeChangeNotifyPrivilege 1312 msiexec.exe Token: SeRemoteShutdownPrivilege 1312 msiexec.exe Token: SeUndockPrivilege 1312 msiexec.exe Token: SeSyncAgentPrivilege 1312 msiexec.exe Token: SeEnableDelegationPrivilege 1312 msiexec.exe Token: SeManageVolumePrivilege 1312 msiexec.exe Token: SeImpersonatePrivilege 1312 msiexec.exe Token: SeCreateGlobalPrivilege 1312 msiexec.exe Token: SeBackupPrivilege 2592 vssvc.exe Token: SeRestorePrivilege 2592 vssvc.exe Token: SeAuditPrivilege 2592 vssvc.exe Token: SeBackupPrivilege 860 msiexec.exe Token: SeRestorePrivilege 860 msiexec.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 2468 DrvInst.exe Token: SeLoadDriverPrivilege 2468 DrvInst.exe Token: SeLoadDriverPrivilege 2468 DrvInst.exe Token: SeLoadDriverPrivilege 2468 DrvInst.exe Token: SeRestorePrivilege 860 msiexec.exe Token: SeTakeOwnershipPrivilege 860 msiexec.exe Token: SeRestorePrivilege 860 msiexec.exe Token: SeTakeOwnershipPrivilege 860 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1312 msiexec.exe 1312 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 860 wrote to memory of 2496 860 msiexec.exe 32 PID 2496 wrote to memory of 1320 2496 MsiExec.exe 33 PID 2496 wrote to memory of 1320 2496 MsiExec.exe 33 PID 2496 wrote to memory of 1320 2496 MsiExec.exe 33 PID 2496 wrote to memory of 1320 2496 MsiExec.exe 33 PID 2496 wrote to memory of 2744 2496 MsiExec.exe 35 PID 2496 wrote to memory of 2744 2496 MsiExec.exe 35 PID 2496 wrote to memory of 2744 2496 MsiExec.exe 35 PID 2496 wrote to memory of 2744 2496 MsiExec.exe 35 PID 2496 wrote to memory of 844 2496 MsiExec.exe 37 PID 2496 wrote to memory of 844 2496 MsiExec.exe 37 PID 2496 wrote to memory of 844 2496 MsiExec.exe 37 PID 2496 wrote to memory of 844 2496 MsiExec.exe 37 PID 2496 wrote to memory of 3036 2496 MsiExec.exe 39 PID 2496 wrote to memory of 3036 2496 MsiExec.exe 39 PID 2496 wrote to memory of 3036 2496 MsiExec.exe 39 PID 2496 wrote to memory of 3036 2496 MsiExec.exe 39 PID 2496 wrote to memory of 2284 2496 MsiExec.exe 41 PID 2496 wrote to memory of 2284 2496 MsiExec.exe 41 PID 2496 wrote to memory of 2284 2496 MsiExec.exe 41 PID 2496 wrote to memory of 2284 2496 MsiExec.exe 41 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1312
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A703B781DFC1C917A7FC81639F5E03FA2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:1320
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:2744
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf3⤵PID:844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\files"3⤵PID:3036
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-512e4df1-6a6d-4e66-a8f7-587e3a4a5470\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:2284
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000244" "00000000000005BC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c5251b4a0300ac59b9c51b39b48960ef
SHA11a9f4710e07aff28c8961b8bb4d5a525ea385e42
SHA2564d5fd376d65beb611b661283d72a19f92e69812c716546e3b3809062671238f2
SHA512a00ddbbd2e4d29b6e54ad422d3a69c4cf3b68cec704c677b5713afe8080774a7b35367464fe5bde19efdd07795f1f7ce2ef13f236241b048638f56fa158b2e76
-
Filesize
728KB
MD5ccd9c86fd49aee6fb7eabf11afd51eb7
SHA1b1edd5e79ecd1984e5f9aedd34f1aea4dfcc52c1
SHA25650049e1d89171d8fc89da29df0914e2ba4e83f04db9fd0e88cb489ae8f9fce63
SHA5126fbada4f5c348ee49bee35ef93f033fa1b3a916399e47ce04480557faaf337e5521c95b9cbabc6eca8a867143fd6e2f908650cb6951f9551fb274cf746c27ed5
-
Filesize
336B
MD5db14ee85817ef91f3a181fcee2cd344c
SHA1d75e18e0942ed6a6daa3dd16c07de3448043b4ec
SHA25601507c3b0c9a0981697cfae84d71d1c56a7b3806250a7163417c380ac7376f70
SHA512337c111fcba4407f4b030497c4830b42a554fa2fc32d8510b0cc71829a7cb05509e43b1c9a03e3bf91fd7f5cdb6428a13fab0fa11c6e422f602724087563798b
-
Filesize
1KB
MD52b432e10b188d3abd6b8e0b8d691ee80
SHA1b0fcbef1bc2d511d535dd0b00149fcbe586ffcfb
SHA256b15470944b707a116cd65d009754ac891da979a876224c027544c6b081d8fa55
SHA5121531a28740b02bb8329126c3d7fd6a51e43d509cc439f574a21dc52df94b5496280f245fa15a3b795bd9141a34d860f1b72bd3d05969fc53a38cac6d8125ff24
-
Filesize
1KB
MD59ec2e55af51696a3a03ce89a92ceac58
SHA1ed6f8f4d1e0468e937b28df93573d685c69d4fca
SHA256d27a95818ded8495fd8525e696fb392cbeb8ba8f724b773dd869f2a3e4805c34
SHA51235ae53f5d11bc87722154fbb379126e8da81c437f11dc51970e03c8074f309cb22a3b8ced882944771ba2e5ce95cdd1ead3305d84aaa1c8c8d8922e22ee42a82
-
Filesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34