Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-02-2024 13:11
Static task
static1
Behavioral task
behavioral1
Sample
install.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.msi
Resource
win10v2004-20240221-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
install.msi
-
Size
3.3MB
-
MD5
4e5903c4ff6d79dbad178815b377554d
-
SHA1
74f50126aebbd186d6defa3641113cdc88a37fa2
-
SHA256
d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46
-
SHA512
9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8
-
SSDEEP
98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2720 ICACLS.EXE 2916 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f762dd4.msi msiexec.exe File created C:\Windows\Installer\f762dd5.ipi msiexec.exe File opened for modification C:\Windows\Installer\f762dd5.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f762dd4.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2E9F.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE -
Loads dropped DLL 1 IoCs
pid Process 1944 MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3064 msiexec.exe 3064 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeRestorePrivilege 3064 msiexec.exe Token: SeTakeOwnershipPrivilege 3064 msiexec.exe Token: SeSecurityPrivilege 3064 msiexec.exe Token: SeCreateTokenPrivilege 2944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2944 msiexec.exe Token: SeLockMemoryPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeMachineAccountPrivilege 2944 msiexec.exe Token: SeTcbPrivilege 2944 msiexec.exe Token: SeSecurityPrivilege 2944 msiexec.exe Token: SeTakeOwnershipPrivilege 2944 msiexec.exe Token: SeLoadDriverPrivilege 2944 msiexec.exe Token: SeSystemProfilePrivilege 2944 msiexec.exe Token: SeSystemtimePrivilege 2944 msiexec.exe Token: SeProfSingleProcessPrivilege 2944 msiexec.exe Token: SeIncBasePriorityPrivilege 2944 msiexec.exe Token: SeCreatePagefilePrivilege 2944 msiexec.exe Token: SeCreatePermanentPrivilege 2944 msiexec.exe Token: SeBackupPrivilege 2944 msiexec.exe Token: SeRestorePrivilege 2944 msiexec.exe Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeDebugPrivilege 2944 msiexec.exe Token: SeAuditPrivilege 2944 msiexec.exe Token: SeSystemEnvironmentPrivilege 2944 msiexec.exe Token: SeChangeNotifyPrivilege 2944 msiexec.exe Token: SeRemoteShutdownPrivilege 2944 msiexec.exe Token: SeUndockPrivilege 2944 msiexec.exe Token: SeSyncAgentPrivilege 2944 msiexec.exe Token: SeEnableDelegationPrivilege 2944 msiexec.exe Token: SeManageVolumePrivilege 2944 msiexec.exe Token: SeImpersonatePrivilege 2944 msiexec.exe Token: SeCreateGlobalPrivilege 2944 msiexec.exe Token: SeBackupPrivilege 2880 vssvc.exe Token: SeRestorePrivilege 2880 vssvc.exe Token: SeAuditPrivilege 2880 vssvc.exe Token: SeBackupPrivilege 3064 msiexec.exe Token: SeRestorePrivilege 3064 msiexec.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeLoadDriverPrivilege 2744 DrvInst.exe Token: SeLoadDriverPrivilege 2744 DrvInst.exe Token: SeLoadDriverPrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 3064 msiexec.exe Token: SeTakeOwnershipPrivilege 3064 msiexec.exe Token: SeRestorePrivilege 3064 msiexec.exe Token: SeTakeOwnershipPrivilege 3064 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2944 msiexec.exe 2944 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 3064 wrote to memory of 1944 3064 msiexec.exe 32 PID 1944 wrote to memory of 2720 1944 MsiExec.exe 33 PID 1944 wrote to memory of 2720 1944 MsiExec.exe 33 PID 1944 wrote to memory of 2720 1944 MsiExec.exe 33 PID 1944 wrote to memory of 2720 1944 MsiExec.exe 33 PID 1944 wrote to memory of 2776 1944 MsiExec.exe 35 PID 1944 wrote to memory of 2776 1944 MsiExec.exe 35 PID 1944 wrote to memory of 2776 1944 MsiExec.exe 35 PID 1944 wrote to memory of 2776 1944 MsiExec.exe 35 PID 1944 wrote to memory of 1428 1944 MsiExec.exe 37 PID 1944 wrote to memory of 1428 1944 MsiExec.exe 37 PID 1944 wrote to memory of 1428 1944 MsiExec.exe 37 PID 1944 wrote to memory of 1428 1944 MsiExec.exe 37 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 39 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 39 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 39 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 39 PID 1944 wrote to memory of 2916 1944 MsiExec.exe 42 PID 1944 wrote to memory of 2916 1944 MsiExec.exe 42 PID 1944 wrote to memory of 2916 1944 MsiExec.exe 42 PID 1944 wrote to memory of 2916 1944 MsiExec.exe 42 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADAAE9A45C17812459DC46868520C9DB2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8bf62d35-c0a1-4834-833f-7c09d09ee0a6\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2720
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:2776
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf3⤵PID:1428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-8bf62d35-c0a1-4834-833f-7c09d09ee0a6\files"3⤵PID:2192
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8bf62d35-c0a1-4834-833f-7c09d09ee0a6\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:2916
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000594" "0000000000000568"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c5251b4a0300ac59b9c51b39b48960ef
SHA11a9f4710e07aff28c8961b8bb4d5a525ea385e42
SHA2564d5fd376d65beb611b661283d72a19f92e69812c716546e3b3809062671238f2
SHA512a00ddbbd2e4d29b6e54ad422d3a69c4cf3b68cec704c677b5713afe8080774a7b35367464fe5bde19efdd07795f1f7ce2ef13f236241b048638f56fa158b2e76
-
Filesize
7.5MB
MD54db0c5db8518ab3053b42dcc5edc7667
SHA1bfe6556c531e2792440d20b5e78e4913614b281a
SHA256e5d06932ffd5ec59922f88d902c6e3d91bafd00a6ab8924e5e6d7b203cc4b904
SHA512feba62b50dda3559e9290b9b9bcb82534b5fc97a9862435a8a3937de9b7fc00afd3911c08b34f8155bd8706556edae5d257fa454dd7fc46720f3c88d615251d6
-
Filesize
1KB
MD531c1b639cf7e5be487979098de01bd59
SHA1e87e8c334358ead057150e5441fe3050429fbaf5
SHA256ad1b4d9763648043c9acca3fdc3177f2cf43d7ad19e81aaa7619354d70685307
SHA5125dabeccb242ee10a5bdc07033740c4cb6796c9ad68c6432cf689d3c88fd4cc3b9adff4e3e83ddcf6d081bcaeccdc8a9db515c59eb340d72522ad0c24fa717813
-
Filesize
1KB
MD59b78db4ac41d4a15dc88f42734569a47
SHA1ed4f98c00f4e8aa267a0e63be6ff6b50e2c738e2
SHA2560f74212c5be83b1d045953ccb63c515439a24c2e0f3bfc0d2f9ca388d540e475
SHA5121f6eb0b31547a164842186105cbd183a13edddd3fd1b430c1394b60f1cab5c815dccb752baa01514eb33a3814455568c721d2958343df0d42c3a9af9231985d3
-
Filesize
208KB
MD54caaa03e0b59ca60a3d34674b732b702
SHA1ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA51225888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34