Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465.msi
Resource
win7-20240221-en
General
-
Target
8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465.msi
-
Size
7.8MB
-
MD5
cbce77f88d5fd1df590d5172bbb83a2c
-
SHA1
65bd87e1c512e9cd60a3952e0712d0f67aa952e1
-
SHA256
8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465
-
SHA512
4d579a70782b99c4fb19398f9d7b430cbe5f9ee5b67dbf360f543fecd010aba373a43266b63b5e7bbe00f8636cdd7d9346806cdaffbaa02608c08310cd752ded
-
SSDEEP
196608:jxaEo5JeKKpyRqNJMWb75RGlzGban/ba:joEWJeKKpyRqNJMWb75RGlzGbCba
Malware Config
Extracted
bumblebee
onkomsi2
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
yykdmh0r.life
is45ipqt.life
btycmaq0.life
bei9dppm.life
3jhcm6ou.life
1q04n1r6.life
10ciy2hb.life
11ou1grl.life
83b0leyy.life
t31jn4t1.life
b24f19ne.life
igak9l9s.life
hkgd9kar.life
02uhomlq.life
zpy1vssg.life
j57fzy12.life
zmlly8xo.life
pe6r5tzc.life
cg4cuoyi.life
pyjijjlm.life
m3vc2ce4.life
p1p97dov.life
ep0kbvph.life
0rlxan4o.life
zdx0i18o.life
7kmzys39.life
e97igyz6.life
hjcbhzd8.life
az77sw77.life
d0k4fdaa.life
c9l8ri53.life
ay03u2te.life
t99iv15x.life
6a1fbhay.life
zna5lybe.life
vxyojl27.life
mddoknvi.life
2z2dl1og.life
vojg90l2.life
awr5omre.life
tcjcv520.life
aqjjchti.life
6qwim2j8.life
1p34o0do.life
8hxwl72r.life
wykpnxcx.life
o10qz4xe.life
7564a2mg.life
aiv8bb2b.life
jwyxm0f3.life
4soexc4m.life
3xqy6csn.life
3k8iq1nb.life
w2hje2t7.life
fra3xqrx.life
4r3inwrt.life
qhfoevow.life
a9nhflze.life
jpngew6a.life
baunjh6t.life
yqofro9q.life
uq034w07.life
oq36weoi.life
vv5sfo80.life
0req10rd.life
m4v4xq2f.life
1p24echu.life
ohwv1vpp.life
z2tp7x2v.life
q65io756.life
-
dga_seed
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 2 636 msiexec.exe 23 4788 MsiExec.exe 94 4788 MsiExec.exe 97 4788 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4788 MsiExec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIEF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1099.tmp msiexec.exe File created C:\Windows\Installer\e580318.msi msiexec.exe File opened for modification C:\Windows\Installer\e580318.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI51C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID2B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA3.tmp msiexec.exe -
Loads dropped DLL 5 IoCs
pid Process 2856 MsiExec.exe 2856 MsiExec.exe 2856 MsiExec.exe 2856 MsiExec.exe 4788 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 636 msiexec.exe Token: SeIncreaseQuotaPrivilege 636 msiexec.exe Token: SeSecurityPrivilege 5116 msiexec.exe Token: SeCreateTokenPrivilege 636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 636 msiexec.exe Token: SeLockMemoryPrivilege 636 msiexec.exe Token: SeIncreaseQuotaPrivilege 636 msiexec.exe Token: SeMachineAccountPrivilege 636 msiexec.exe Token: SeTcbPrivilege 636 msiexec.exe Token: SeSecurityPrivilege 636 msiexec.exe Token: SeTakeOwnershipPrivilege 636 msiexec.exe Token: SeLoadDriverPrivilege 636 msiexec.exe Token: SeSystemProfilePrivilege 636 msiexec.exe Token: SeSystemtimePrivilege 636 msiexec.exe Token: SeProfSingleProcessPrivilege 636 msiexec.exe Token: SeIncBasePriorityPrivilege 636 msiexec.exe Token: SeCreatePagefilePrivilege 636 msiexec.exe Token: SeCreatePermanentPrivilege 636 msiexec.exe Token: SeBackupPrivilege 636 msiexec.exe Token: SeRestorePrivilege 636 msiexec.exe Token: SeShutdownPrivilege 636 msiexec.exe Token: SeDebugPrivilege 636 msiexec.exe Token: SeAuditPrivilege 636 msiexec.exe Token: SeSystemEnvironmentPrivilege 636 msiexec.exe Token: SeChangeNotifyPrivilege 636 msiexec.exe Token: SeRemoteShutdownPrivilege 636 msiexec.exe Token: SeUndockPrivilege 636 msiexec.exe Token: SeSyncAgentPrivilege 636 msiexec.exe Token: SeEnableDelegationPrivilege 636 msiexec.exe Token: SeManageVolumePrivilege 636 msiexec.exe Token: SeImpersonatePrivilege 636 msiexec.exe Token: SeCreateGlobalPrivilege 636 msiexec.exe Token: SeRestorePrivilege 5116 msiexec.exe Token: SeTakeOwnershipPrivilege 5116 msiexec.exe Token: SeRestorePrivilege 5116 msiexec.exe Token: SeTakeOwnershipPrivilege 5116 msiexec.exe Token: SeRestorePrivilege 5116 msiexec.exe Token: SeTakeOwnershipPrivilege 5116 msiexec.exe Token: SeRestorePrivilege 5116 msiexec.exe Token: SeTakeOwnershipPrivilege 5116 msiexec.exe Token: SeRestorePrivilege 5116 msiexec.exe Token: SeTakeOwnershipPrivilege 5116 msiexec.exe Token: SeRestorePrivilege 5116 msiexec.exe Token: SeTakeOwnershipPrivilege 5116 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 636 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5116 wrote to memory of 2856 5116 msiexec.exe 98 PID 5116 wrote to memory of 2856 5116 msiexec.exe 98 PID 5116 wrote to memory of 2856 5116 msiexec.exe 98 PID 5116 wrote to memory of 4788 5116 msiexec.exe 99 PID 5116 wrote to memory of 4788 5116 msiexec.exe 99
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:636
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 465F3CE80F688C03FEA5DC0BD78DCB952⤵
- Loads dropped DLL
PID:2856
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DFF81969323DD8AEACA89905F0E8FE722⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Loads dropped DLL
PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5bedb0f369ebb79dbcf856379ecb6566c
SHA14a8c27c1a2f0be31b73fdad222782648c9ce6b0c
SHA256189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd
SHA51206a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a