Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 14:31
Static task
static1
Behavioral task
behavioral1
Sample
CapTalkSetup.msi
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
CapTalkSetup.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
CapTalkSetup.msi
-
Size
22.0MB
-
MD5
73137946a664fcf4c79a8d4ab7e3e90e
-
SHA1
f9c0dd55ba400af20bab9fd9faf881c361810700
-
SHA256
1ffe8209764db06b2f65a1bf47d208bbd7c08f5b31d5f798ba6b397f04ae421c
-
SHA512
d7e122b43a4d8bc52386a4d2919091a4a3ff4e7900883f5242e6e8b646b6514081d95c9d748947088b8e47b2798709ade3df5c54b0d232a3445b3c9ff66d06af
-
SSDEEP
393216:oRXWmhkB2RevIOXmc87p5jcCknXXnS4BzYRzgG8vccAzT1H//jA44:7mS2GIumc8jjcCmBzQsGt/t4
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 1916 msiexec.exe 7 1916 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcr100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp100.dll msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 960 MsiExec.exe 960 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1916 msiexec.exe Token: SeIncreaseQuotaPrivilege 1916 msiexec.exe Token: SeSecurityPrivilege 4296 msiexec.exe Token: SeCreateTokenPrivilege 1916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1916 msiexec.exe Token: SeLockMemoryPrivilege 1916 msiexec.exe Token: SeIncreaseQuotaPrivilege 1916 msiexec.exe Token: SeMachineAccountPrivilege 1916 msiexec.exe Token: SeTcbPrivilege 1916 msiexec.exe Token: SeSecurityPrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeLoadDriverPrivilege 1916 msiexec.exe Token: SeSystemProfilePrivilege 1916 msiexec.exe Token: SeSystemtimePrivilege 1916 msiexec.exe Token: SeProfSingleProcessPrivilege 1916 msiexec.exe Token: SeIncBasePriorityPrivilege 1916 msiexec.exe Token: SeCreatePagefilePrivilege 1916 msiexec.exe Token: SeCreatePermanentPrivilege 1916 msiexec.exe Token: SeBackupPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeShutdownPrivilege 1916 msiexec.exe Token: SeDebugPrivilege 1916 msiexec.exe Token: SeAuditPrivilege 1916 msiexec.exe Token: SeSystemEnvironmentPrivilege 1916 msiexec.exe Token: SeChangeNotifyPrivilege 1916 msiexec.exe Token: SeRemoteShutdownPrivilege 1916 msiexec.exe Token: SeUndockPrivilege 1916 msiexec.exe Token: SeSyncAgentPrivilege 1916 msiexec.exe Token: SeEnableDelegationPrivilege 1916 msiexec.exe Token: SeManageVolumePrivilege 1916 msiexec.exe Token: SeImpersonatePrivilege 1916 msiexec.exe Token: SeCreateGlobalPrivilege 1916 msiexec.exe Token: SeCreateTokenPrivilege 1916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1916 msiexec.exe Token: SeLockMemoryPrivilege 1916 msiexec.exe Token: SeIncreaseQuotaPrivilege 1916 msiexec.exe Token: SeMachineAccountPrivilege 1916 msiexec.exe Token: SeTcbPrivilege 1916 msiexec.exe Token: SeSecurityPrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeLoadDriverPrivilege 1916 msiexec.exe Token: SeSystemProfilePrivilege 1916 msiexec.exe Token: SeSystemtimePrivilege 1916 msiexec.exe Token: SeProfSingleProcessPrivilege 1916 msiexec.exe Token: SeIncBasePriorityPrivilege 1916 msiexec.exe Token: SeCreatePagefilePrivilege 1916 msiexec.exe Token: SeCreatePermanentPrivilege 1916 msiexec.exe Token: SeBackupPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeShutdownPrivilege 1916 msiexec.exe Token: SeDebugPrivilege 1916 msiexec.exe Token: SeAuditPrivilege 1916 msiexec.exe Token: SeSystemEnvironmentPrivilege 1916 msiexec.exe Token: SeChangeNotifyPrivilege 1916 msiexec.exe Token: SeRemoteShutdownPrivilege 1916 msiexec.exe Token: SeUndockPrivilege 1916 msiexec.exe Token: SeSyncAgentPrivilege 1916 msiexec.exe Token: SeEnableDelegationPrivilege 1916 msiexec.exe Token: SeManageVolumePrivilege 1916 msiexec.exe Token: SeImpersonatePrivilege 1916 msiexec.exe Token: SeCreateGlobalPrivilege 1916 msiexec.exe Token: SeCreateTokenPrivilege 1916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1916 msiexec.exe Token: SeLockMemoryPrivilege 1916 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1916 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4296 wrote to memory of 960 4296 msiexec.exe 93 PID 4296 wrote to memory of 960 4296 msiexec.exe 93 PID 4296 wrote to memory of 960 4296 msiexec.exe 93
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CapTalkSetup.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1916
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 602C2BD0F6A0E0EA2EB1AA26B543CA0B C2⤵
- Loads dropped DLL
PID:960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD55494165b1384faeefdd3d5133df92f5a
SHA1b7b82805f1a726c4eee39152d1a6a59031d7798c
SHA256ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
SHA512ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613