00335ac2ede76fa9f1a1c7fce54cc57263c594bcf14708d752b6d5b88015332a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSIit.msi
Size

136KB
MD5

9a3dd1be1950df2971f211d81836f2b2
SHA1

35e017037485516ace21df4598279b8c7a8e9a1c
SHA256

8f9fd8f143a75aed6fee28406b0d7de8304903db94fd361731711ee6606692e6
SHA512

c2a809a7afc279cb97281fc4ff1f67e6bc4495f83917553a2791f2a725b4b8ad394c388f507d85c7a87a20b1709dc8df456ef0eeb9759ef85dc6b1c8b93ce0f2
SSDEEP

1536:fWFtC7FSUHlXAcK2T1ZIBxIQJKqECeLtviBhmVFFpKyQS8hQQhiOGQQhQQhi:uCZXtK2I0CzEC0aBhmLFp

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeRestorePrivilege	2504	msiexec.exe
Token: SeTakeOwnershipPrivilege	2504	msiexec.exe
Token: SeSecurityPrivilege	2504	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe
Token: SeLockMemoryPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeMachineAccountPrivilege	2192	msiexec.exe
Token: SeTcbPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	2192	msiexec.exe
Token: SeTakeOwnershipPrivilege	2192	msiexec.exe
Token: SeLoadDriverPrivilege	2192	msiexec.exe
Token: SeSystemProfilePrivilege	2192	msiexec.exe
Token: SeSystemtimePrivilege	2192	msiexec.exe
Token: SeProfSingleProcessPrivilege	2192	msiexec.exe
Token: SeIncBasePriorityPrivilege	2192	msiexec.exe
Token: SeCreatePagefilePrivilege	2192	msiexec.exe
Token: SeCreatePermanentPrivilege	2192	msiexec.exe
Token: SeBackupPrivilege	2192	msiexec.exe
Token: SeRestorePrivilege	2192	msiexec.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeDebugPrivilege	2192	msiexec.exe
Token: SeAuditPrivilege	2192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2192	msiexec.exe
Token: SeChangeNotifyPrivilege	2192	msiexec.exe
Token: SeRemoteShutdownPrivilege	2192	msiexec.exe
Token: SeUndockPrivilege	2192	msiexec.exe
Token: SeSyncAgentPrivilege	2192	msiexec.exe
Token: SeEnableDelegationPrivilege	2192	msiexec.exe
Token: SeManageVolumePrivilege	2192	msiexec.exe
Token: SeImpersonatePrivilege	2192	msiexec.exe
Token: SeCreateGlobalPrivilege	2192	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MSIit.msi
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2192

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads