Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 13:13

General

  • Target

    install.msi

  • Size

    3.3MB

  • MD5

    4e5903c4ff6d79dbad178815b377554d

  • SHA1

    74f50126aebbd186d6defa3641113cdc88a37fa2

  • SHA256

    d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46

  • SHA512

    9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8

  • SSDEEP

    98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1964
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 71A8B1278CDFB685B7003129B6DCC751
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:1412
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:1228
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf
        3⤵
          PID:1576
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\files"
          3⤵
            PID:2788
          • C:\Windows\SysWOW64\ICACLS.EXE
            "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\." /SETINTEGRITYLEVEL (CI)(OI)LOW
            3⤵
            • Modifies file permissions
            PID:1296
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C0" "00000000000003C8"
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2472

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\files.cab

        Filesize

        3.1MB

        MD5

        c5251b4a0300ac59b9c51b39b48960ef

        SHA1

        1a9f4710e07aff28c8961b8bb4d5a525ea385e42

        SHA256

        4d5fd376d65beb611b661283d72a19f92e69812c716546e3b3809062671238f2

        SHA512

        a00ddbbd2e4d29b6e54ad422d3a69c4cf3b68cec704c677b5713afe8080774a7b35367464fe5bde19efdd07795f1f7ce2ef13f236241b048638f56fa158b2e76

      • C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\files\install.exe

        Filesize

        16.3MB

        MD5

        28fe14a92c5f8a9a8b0b12281285627e

        SHA1

        32c3d22421322a59f985aa98e983c93a3ff844c0

        SHA256

        f3149e1220f621d46adcb403f65a60cbf191adf13b6caebbe5da522bd430dfd3

        SHA512

        9f0ac05f369b4675e9c0f6df80706d4d9c0ad1c9dea3330faa617596cb518b2b40b06d6d7e7ea071daedaa5e05c70d7ebc171e2b40cad3eeb2457fb0118a5470

      • C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\msiwrapper.ini

        Filesize

        1KB

        MD5

        401a998d657a84436598dd7835e5b73c

        SHA1

        57304888ce0557f4fdec9c970236c3d0f6178fbf

        SHA256

        34546bd81b229d3500d3073c8853033f500ff5a52726573d968e646a474e75dd

        SHA512

        f0bf43cc688bff3007c1f4d576508294caf57daf3065c96a4b57125dcae1af754b8693352fe564727fa42ee0b0ea7c59e283b71e187e95efcebe9cb3249be412

      • C:\Windows\Installer\MSI93B7.tmp

        Filesize

        208KB

        MD5

        4caaa03e0b59ca60a3d34674b732b702

        SHA1

        ee80c8f4684055ac8960b9720fb108be07e1d10c

        SHA256

        d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

        SHA512

        25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

      • memory/1576-76-0x0000000002320000-0x0000000002321000-memory.dmp

        Filesize

        4KB