Analysis
- max time kernel
119s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
install.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.msi
Resource
win10v2004-20240221-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target install.msi
- Size 3.3MB
- Sample240224-qf259add2x
- SHA256 d67bc5bfd6512b944e1c5e3e7d6871771c84d9eb94c863d123c5e92c6a86dc46
- MD5 4e5903c4ff6d79dbad178815b377554d
- SHA1 74f50126aebbd186d6defa3641113cdc88a37fa2
- SHA512 9a513449963c860e9be50c05a79beeea554fc6bc9748b260340711d8cb705cb022f53f10cfdc35ce1ad8d97644df57a9aae959b6dbb96c15b85d8ecaf62031a8
- SSDEEP 98304:5pKIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsg:6IHmnqvZlUFz8RtyPg
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Modifies file permissions 1 TTPs 2 IoCs
pid Process 1412 ICACLS.EXE 1296 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI93B7.tmp msiexec.exe File opened for modification C:\Windows\Installer\f769177.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f769176.msi msiexec.exe File created C:\Windows\Installer\f769176.msi msiexec.exe File created C:\Windows\Installer\f769177.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Loads dropped DLL 1 IoCs
pid Process 268 MsiExec.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2336 msiexec.exe 2336 msiexec.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeSecurityPrivilege 2336 msiexec.exe Token: SeCreateTokenPrivilege 1964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1964 msiexec.exe Token: SeLockMemoryPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeMachineAccountPrivilege 1964 msiexec.exe Token: SeTcbPrivilege 1964 msiexec.exe Token: SeSecurityPrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeLoadDriverPrivilege 1964 msiexec.exe Token: SeSystemProfilePrivilege 1964 msiexec.exe Token: SeSystemtimePrivilege 1964 msiexec.exe Token: SeProfSingleProcessPrivilege 1964 msiexec.exe Token: SeIncBasePriorityPrivilege 1964 msiexec.exe Token: SeCreatePagefilePrivilege 1964 msiexec.exe Token: SeCreatePermanentPrivilege 1964 msiexec.exe Token: SeBackupPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeDebugPrivilege 1964 msiexec.exe Token: SeAuditPrivilege 1964 msiexec.exe Token: SeSystemEnvironmentPrivilege 1964 msiexec.exe Token: SeChangeNotifyPrivilege 1964 msiexec.exe Token: SeRemoteShutdownPrivilege 1964 msiexec.exe Token: SeUndockPrivilege 1964 msiexec.exe Token: SeSyncAgentPrivilege 1964 msiexec.exe Token: SeEnableDelegationPrivilege 1964 msiexec.exe Token: SeManageVolumePrivilege 1964 msiexec.exe Token: SeImpersonatePrivilege 1964 msiexec.exe Token: SeCreateGlobalPrivilege 1964 msiexec.exe Token: SeBackupPrivilege 3036 vssvc.exe Token: SeRestorePrivilege 3036 vssvc.exe Token: SeAuditPrivilege 3036 vssvc.exe Token: SeBackupPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2472 DrvInst.exe Token: SeLoadDriverPrivilege 2472 DrvInst.exe Token: SeLoadDriverPrivilege 2472 DrvInst.exe Token: SeLoadDriverPrivilege 2472 DrvInst.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe Token: SeRestorePrivilege 2336 msiexec.exe Token: SeTakeOwnershipPrivilege 2336 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1964 msiexec.exe 1964 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 2336 wrote to memory of 268 2336 msiexec.exe 32 PID 268 wrote to memory of 1412 268 MsiExec.exe 33 PID 268 wrote to memory of 1412 268 MsiExec.exe 33 PID 268 wrote to memory of 1412 268 MsiExec.exe 33 PID 268 wrote to memory of 1412 268 MsiExec.exe 33 PID 268 wrote to memory of 1228 268 MsiExec.exe 35 PID 268 wrote to memory of 1228 268 MsiExec.exe 35 PID 268 wrote to memory of 1228 268 MsiExec.exe 35 PID 268 wrote to memory of 1228 268 MsiExec.exe 35 PID 268 wrote to memory of 1576 268 MsiExec.exe 37 PID 268 wrote to memory of 1576 268 MsiExec.exe 37 PID 268 wrote to memory of 1576 268 MsiExec.exe 37 PID 268 wrote to memory of 1576 268 MsiExec.exe 37 PID 268 wrote to memory of 2788 268 MsiExec.exe 39 PID 268 wrote to memory of 2788 268 MsiExec.exe 39 PID 268 wrote to memory of 2788 268 MsiExec.exe 39 PID 268 wrote to memory of 2788 268 MsiExec.exe 39 PID 268 wrote to memory of 1296 268 MsiExec.exe 41 PID 268 wrote to memory of 1296 268 MsiExec.exe 41 PID 268 wrote to memory of 1296 268 MsiExec.exe 41 PID 268 wrote to memory of 1296 268 MsiExec.exe 41 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1964
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71A8B1278CDFB685B7003129B6DCC7512⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:1412
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:1228
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.concurtraining.com/customers/tech_pubs/Docs/_Current/UG_Inv/Inv_UG_Invoice_Pay.pdf3⤵PID:1576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\files"3⤵PID:2788
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:1296
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C0" "00000000000003C8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\files.cab
- Size 3.1MB
- SHA256 4d5fd376d65beb611b661283d72a19f92e69812c716546e3b3809062671238f2
- MD5 c5251b4a0300ac59b9c51b39b48960ef
- SHA1 1a9f4710e07aff28c8961b8bb4d5a525ea385e42
- SHA512 a00ddbbd2e4d29b6e54ad422d3a69c4cf3b68cec704c677b5713afe8080774a7b35367464fe5bde19efdd07795f1f7ce2ef13f236241b048638f56fa158b2e76
- SSDEEP 98304:CIwis1N1AaewONvZOIUFz+PlROVt1OTLmUsgA:CIHmnqvZlUFz8RtyPgA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\files\install.exe
- Size 16.3MB
- SHA256 f3149e1220f621d46adcb403f65a60cbf191adf13b6caebbe5da522bd430dfd3
- MD5 28fe14a92c5f8a9a8b0b12281285627e
- SHA1 32c3d22421322a59f985aa98e983c93a3ff844c0
- SHA512 9f0ac05f369b4675e9c0f6df80706d4d9c0ad1c9dea3330faa617596cb518b2b40b06d6d7e7ea071daedaa5e05c70d7ebc171e2b40cad3eeb2457fb0118a5470
- SSDEEP 98304:e/Tn3LbKjO+t+NmUtZqVcqbXmZ66z24VZbwpgMLWzmidN:eb3IO6PUNqSZ66z24VZbwpgOWzmidN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-5579e1e5-d388-4fa0-b330-baead160e9ee\msiwrapper.ini
- Size 1KB
- SHA256 34546bd81b229d3500d3073c8853033f500ff5a52726573d968e646a474e75dd
- MD5 401a998d657a84436598dd7835e5b73c
- SHA1 57304888ce0557f4fdec9c970236c3d0f6178fbf
- SHA512 f0bf43cc688bff3007c1f4d576508294caf57daf3065c96a4b57125dcae1af754b8693352fe564727fa42ee0b0ea7c59e283b71e187e95efcebe9cb3249be412
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI93B7.tmp
- Size 208KB
- SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
- MD5 4caaa03e0b59ca60a3d34674b732b702
- SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
- SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
- SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
- MD5 SHA1 SHA512 SSDEEP